1805305 - services.settings.server sometimes intentionally ignored; log something to avoid dev time-wastage

Status: RESOLVED FIXED

(Firefox :: Remote Settings Client, defect)

Description

[Dan Mosedale (:dmosedale, :dmose)]

In bug 1758645, the MOZ_REMOTE_SETTINGS_DEVTOOLS environment variable was added to make it possible to test different remote settings servers (eg stage) such that the services.settings.server would be read (rather than quietly ignored) in Nightly and Beta. I had to waste a bunch of time in order to realize that the problem was that the preference was being intentionally ignored, rather than there being some more direct kind of bug that was causing my problem.

I'm assuming this is for security reasons, so I've marked this bug private for now, though I'm a bit skeptical here.

I'd like to propose a log message explicitly mentioning MOZ_REMOTE_SETTINGS_DEVTOOLS if the pref is set and ignored, or, if we can't live with that, at least logging what server is being used, so that a developer has a chance of noticing what's going on without a bunch of unnecessary detective work.

Comment 1

[Dan Mosedale (:dmosedale, :dmose)]

Attachment: Bug 1805305 - log when services.settings.server is ignored, r?leplatrem

Comment 2

[Dan Mosedale (:dmosedale, :dmose)]

I've added a straw-man patch which I can modify to be more appropriate, once I know what would be acceptable. Mathieu, how would you feel about a message that explicitly mentions the environment variable?

Comment 3

[Mathieu Leplatre [:leplatrem]]

I'm sorry Dan if you wasted time on this. You're right, we could guide developers better.

such that the services.settings.server would be read (rather than quietly ignored) in Nightly and Beta.

Quick note: the services.settings.server pref is always read on Nightly and when running tests.
The env var is necessary on Beta and Release (source)

Mathieu, how would you feel about a message that explicitly mentions the environment variable?

I don't think it would be problematic. The env var is mentionned in the docs and in the code.
If an attacker gains enough privileges to modify environment variables on the machine, there's not much we can do.

I think it would make sense to output a warning message mentioning the env var when:

• the server preference is set to a value different than AppConstants.REMOTE_SETTINGS_SERVER_URL
• the env var is not set
• we're not running tests

Maybe the appropriate place is the getter of allowServerURLOverride where almost all these info are available at hand

Comment 4

[Andrew McCreight [:mccr8]]

I don't think it is necessary to hide this. I think the dangers of special testing environment variables are not that obscure.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/30fc4653fdff
log when services.settings.server is ignored, r=leplatrem

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/30fc4653fdff