273550 - [Submission] GUID from applications should not be allowed as extension GUID

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[alanjstr]

It is possible for someone to use the GUID from Firefox, Seamonkey, etc, in
their extension or theme.  The bug to limit incoming GUIDs to be unique has
already been fixed.  However, it probably  does not prevent someone from using
the Firefox GUID.  This was discovered in bug 267026 comment 3.

Comment 1

[alanjstr]

Attachment: Checks the applications table for GUID

Comment 2

[Wolf [:wolf]]

Comment on attachment 168578 [details] [diff] [review]
Checks the applications table for GUID

At a glance, this patch contains a section that appears to be a result of a CVS
merge, which doesn't belong here.

Otherwise, the patch looks ok.

Though the concept is a bit foggy, as the Apps GUIDs are actually perfectly
valid for 1 extension or theme, as they're not internally confused.

Comment 3

[alanjstr]

We should also not let people submit extensions with the GUID of the default
theme(s).

Comment 4

[Mike Shaver (:shaver emeritus)]

Yeah, we should create some dummy entries for all the registered UUIDs, or otherwise block them, and reject any that end in @applications.mozilla.org or whatever the canonical form is.

I wonder if there's a list of these UUIDs anywhere...

Comment 5

[alanjstr]

> I wonder if there's a list of these UUIDs anywhere...

http://kb.mozillazine.org/Install.rdf#Target_applications.27_GUIDs

Comment 6

[Justin Scott [:fligtar]]

This has been fixed in Remora (AMO v3). The additem script will not allow any GUIDs found in the applications table to be used as an add-on id.