275545 - Firefox allows any web site to install .xpi extensions if the file URL is written manually in the address bar

Status: VERIFIED INVALID

(Firefox :: Installer, defect)

Description

[Razvan Cosma]

One of the issues listed in said blog refers to the Flashblock extension which
installs if the URL (http://mozdev.xmundo.net/flashblock/flashblock-1.2.5.xpi)
is written in the address bar although the site is not in the allowed list. This
is not related to just one extension, of course. User interaction is required,
and I couldn't figure any way to trick the browser via javascript, but who knows..

Comment 1

[Daniel Veditz [:dveditz] (OOO: back Aug 26)]

As-designed: if users manually type addresses into the URL bar we assume they
really, really, mean it and ignore whitelisting blocks for that install request.
Whitelisting is a mechanism to prevent sites from abusing users with modal
dialogs in an attempt to coerce them into giving up and clicking "Install", and
that's not the case for a manually entered URL.

The user is still presented with the install confirmation dialog.