300082 - Firefox allows toolbar.google.com to install software without permission

Status: VERIFIED INVALID

(Toolkit :: Add-ons Manager, defect)

Description

[Hubert Gajewski]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Firefox doesn't block software installation from toolbar.google.com. I had
tested it on new profile (default Allowed Sites: addons.mozilla.org,
update.mozilla.org).

Reproducible: Always

Steps to Reproduce:
1. Go to http://toolbar.google.com/firefox/install.html
2. Click on "Agree and Install" button

Actual Results:  
Firefox displays "Software Instalation" window.

Expected Results:  
Firefox should show message: "To protect your computer Firefox prevented this
site (google.com) from installing software on your computer" and doesn't display
"Software Instalation" window.

Strange thing on toolbar.google.com: sometimes I see in "Sofware Installation"
window: "Unsigned", sometimes "Google, Inc."

Comment 1

[Hubert Gajewski]

Attachment: My white list

Comment 2

[Hubert Gajewski]

Attachment: Software Installation window - signed

Comment 3

[Hubert Gajewski]

Attachment: Software Installation window - unsigned

Comment 4

[Asa Dotzler [:asa]]

not a bug. the page that triggers the install is actually hosted at
addons.mozilla.org which is whitelisted. Google simply iframes one of AMO's pages.

Comment 5

[Hubert Gajewski]

(In reply to comment #4)
> not a bug. the page that triggers the install is actually hosted at
> addons.mozilla.org which is whitelisted. Google simply iframes one of AMO's pages.

I'm sorry, I didn't see this:
https://addons.mozilla.org/google/google_toolbar.html (but "from:
http://toolbar.google.com/firefox/extensions/toolbar/google-toolbar.xpi" in
Software Installation window looks strange)

PS. Should I report a problem with signed/unsigned ext. (sometimes extension is
signed, sometimes is unsigned) in new bug? Is it Firefox or Google bug?

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to comment #5)
> PS. Should I report a problem with signed/unsigned ext. (sometimes extension is
> signed, sometimes is unsigned) in new bug? Is it Firefox or Google bug?

If you mean the same extension sometimes appear signed, sometimes not, there is
already a bug filed for that (and iirc a patch).