Open Bug 1973071 Opened 1 day ago Updated 1 day ago

Add options to AddonManager.getInstallForURL and AddonInstall to validate the addon type, id and/or version

Categories

(Toolkit :: Add-ons Manager, enhancement)

Product:
Toolkit
Component:
Add-ons Manager
Type:
enhancement

Tracking

()

People

(Reporter: robwu, Unassigned)

References

Details

(Whiteboard: [addons-jira])

Some add-on installations for a given URL triggered via getInstallForURL can be restricted to something more specific than "any add-on at this URL", as some of the callers expect to install a specific extension ID, version and/or type.

The options to AddonManager.getInstallForURL are ultimately passed to the AddonInstall base class (subclassed by DownloadAddonInstall and LocalAddonInstall). As a hardening feature, let's add options to allow callers to opt in to only accept add-on installations of a certain extension ID, type and/or version.

There is existing logic that prevents updates to change the addon ID (added in bug 1303418), addon type (added in bug 1750565) or addon version (bug 1766047). We expand these checks to new installations.

You need to log in before you can comment on or make changes to this bug.