190378 - should not use "not.supplied.com" as default download host

Status: VERIFIED FIXED

(SeaMonkey :: Installer, defect)

Description

[Michael Lefevre]

bug 190309 made me notice that the default host is "not.supplied.com"

in the event that it doesn't get replaced with a real host, this will at best
lead to lots of dumb DNS queries at supplied.com (which is a real domain).

also, there's a potential security issue - if the folks at supplied.com create a
host called "not", they can serve trojans to the installer or whatever else...
not good.

RFC 2606 http://www.rfc-editor.org/rfc/rfc2606.txt suggests names which should
be used in these circumstances.  I think "not.supplied.invalid" would be a good
choice - clearly invalid to anyone that sees it, and guaranteed never to be a
real host.

Comment 1

[Daniel Veditz [:dveditz]]

Attachment: use a safe placeholder download location

Comment 2

[Daniel Veditz [:dveditz]]

Comment on attachment 112541 [details] [diff] [review]
use a safe placeholder download location

sr=me, patch can be considered supplied by Michael Lefevre. Seeking r= from ssu

Comment 3

[Sean Su]

Comment on attachment 112541 [details] [diff] [review]
use a safe placeholder download location

also don't for get the other makeall.pl:
  xpinstall/packager/win_gre
 xpinstall/packager/win_mfcembed

I'll take care of ns/xpinstall/packager/windows one.

Comment 4

[Adam D. Moss]

A cursory grep from the xpinstall directory shows this string in:

./packager/windows/makeall.pl
./packager/os2/makeall.pl
./packager/os2/deliver.pl
./packager/win_gre/makeall.pl
./packager/build/scripts/makeall.pl
./packager/win_mfcembed/makeall.pl
./wizard/windows/builder/build.pl
./wizard/windows/builder/build_mfcembed.pl
./wizard/windows/builder/build_static.pl
./wizard/windows/builder/build_gre.pl
./wizard/os2/builder/build.pl

Comment 5

[Sean Su]

Attachment: patch v1.1 (ns tree)

Comment 6

[Sean Su]

Attachment: patch v1.1 (moz tree)

this patch catches all of the other references to not.supplied.com and changes
it to not.supplied.invalid.

Comment 7

[Samir Gehani]

Comment on attachment 112806 [details] [diff] [review]
patch v1.1 (ns tree)

r=sgehani

Comment 8

[Samir Gehani]

Comment on attachment 112807 [details] [diff] [review]
patch v1.1 (moz tree)

r=sgehani

Comment 9

[(not reading, please use [e-mail] instead)]

Comment on attachment 112806 [details] [diff] [review]
patch v1.1 (ns tree)

rs=sspitzer

Comment 10

[(not reading, please use [e-mail] instead)]

Comment on attachment 112807 [details] [diff] [review]
patch v1.1 (moz tree)

rs=sspitzer

Comment 11

[Daniel Veditz [:dveditz]]

sr=dveditz

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 112807 [details] [diff] [review]
patch v1.1 (moz tree)

What does the version stuff that's in this patch do?  (Your email described
this as a 1-line patch.)

Comment 13

[Sean Su]

sorry, the version stuff in the diff was part of another patch that simply said
that the build*.pl files are not part of the regular build, but for testing
installer builds only.  They are not used by anyone, unless trying to do test
installer builds.

Comment 14

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 112807 [details] [diff] [review]
patch v1.1 (moz tree)

Approving with the assumption that the version changes weren't supposed to be
included.

Comment 15

[Sean Su]

patches checked in.  marking bug fixed.

Comment 16

[Grace Bush]

v