1862450 - Make installer changes for dual browser extension on Windows

Status: RESOLVED FIXED

(Firefox :: Installer, enhancement)

Description

[Nipun Shukla]

This bug describes the changes that we want to make to enable the dual browser extension to work with Firefox. As this still needs to be reviewed by Legal, I've marked it confidential.

Comment 1

[Nipun Shukla]

Attachment: Bug 1862450 - Made installer changes for dual browser extension r=mhughes,bytesized

Comment 2

[Nipun Shukla]

Attachment: Bug 1862450 - Made installer changes for dual browser extension to MacOS r=mhughes,bytesized

Comment 3

[Michael Hughes]

Attachment: Bug 1862450 - Installer changes for firefox and firefox-private protocol r=nshukla,bytesized

Made it so that the installer will only register itself as the protocol handler if there isn't one registered already.
Made it so that the uninstaller only deregisters itself if it's the current protocol handler.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/74bc36c16ea3
Made installer changes for dual browser extension r=mhughes
https://hg.mozilla.org/integration/autoland/rev/804fb6912077
Made installer changes for dual browser extension to MacOS r=mhughes

Comment 5

[Nipun Shukla]

Attachment: Bug 1862450 - Made changes to dual browser installer on Windows and MacOS r=mhughes

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4e7d94dd79fe
Made changes to dual browser installer on Windows and MacOS r=mhughes,bytesized

Comment 7

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/74bc36c16ea3
https://hg.mozilla.org/mozilla-central/rev/804fb6912077

Comment 8

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/74bc36c16ea3
https://hg.mozilla.org/mozilla-central/rev/804fb6912077

Comment 9

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/4e7d94dd79fe

Comment 10

[Masatoshi Kimura [:emk]]

Don't these new protocols re-introduce bug 384384?

Comment 11

[Michael Hughes]

Attachment: Fix to use null principle

Comment 12

[Michael Hughes]

Attachment: Fix for security issues

Comment 13

[Michael Hughes]

Attachment: Security Review Request and Notes doc

Comment 14

[Michael Hughes]

(In reply to Masatoshi Kimura [:emk] from comment #10)

Don't these new protocols re-introduce bug 384384?

Based on my understanding of Bug 384384, the risk is that arbitrary numbers of parameters can be sent locally to the Firefox command line because of Internet Explorer. Internet Explorer is less of a factor now, and besides that, the code implemented in the below link only allows for one non-dashed argument to Firefox (only one argument without --) and that argument has to start with http: and https: after the Firefox protocol.

https://phabricator.services.mozilla.com/rBETA31e067248e3c5326ee178777c2939075b50f9cda