312428 - extension installation does not fail when .jar file missing

Status: RESOLVED WONTFIX

(Toolkit :: Add-ons Manager, defect)

Description

[Eyal Rozenberg]

I just tried installing an extension (BiDi Mail UI) from which I've removed the
main (and single) .jar file - the XPI only included an install.rdf and a
chrome.manifest file, which refer to the jar which does not exist in the XPI.
The installation succeeded, I got a 'restart tbird' message, and when I
restarted tbird of course I got chrome errors, couldn't open a compose window, etc.

Now, unless there's a possibility that an extension will only refer to
pre-existing jar files (in which case their existence should be checked), the
installation should always fail when the referred-to jar files are missing from
the XPI. Specifically, if install.rdf has an em:file tag referring to a file,
there should be a check for it.

Not sure which component to assign this bug to.

PS - tested with nightly build 2005-09-27; in much earlier builds the behavior
was at least at one time as described in bug 254791.

Comment 1

[Ria Klaassen (not reading all bugmail)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20051013
Firefox/1.4.1 ID:2005101321

I tried installing 4 extensions but 3 of them (the last versions of AboutSite,
Clustybar and Mediaplayer Connectivity) gave an error at startup (faillure in
chrome registration); only Adblock Plus installed but showed a bar at the bottom.

Comment 2

[Eyal Rozenberg]

Attachment: the dummy extension used

Attached the dummy extension I was using.

Comment 3

[Ria Klaassen (not reading all bugmail)]

Tried the attached extension in the latest branch Thunderbird, but it behaved
the same as Adblock in Firefox, it installed without problems but I got a bar at
the bottom.
No other problems. Could uninstall it easily.

Comment 4

[Eyal Rozenberg]

Indeed, uninstallation works; it's just that it shouldn't have been installable
in the first place without the .jar .

Comment 5

[Daniel Veditz [:dveditz]]

This is the new extension manager, not xpinstall engine.

How far do you want to go? I believe the install.rdf is parsed at install time
so the file existence could be checked. What if it's an invalid/corrupt .jar
file? Or doesn't contain some of the overlay or .dtd files it advertises as
having? This could be a lot of checking.

Or we could push it off until restart time, which is kind of what we're doing.

Couldn't find a toolkit Extension Manager component so assigning to Firefox --
but it's really a shared toolkit problem affecting Firefox and Thunderbird

Comment 6

[Eyal Rozenberg]

I'd say checking for validity wouldn't be too useful because the files could be
invalid in a way which only becomes apparent when they're used (e.g. trying to
overlay a missing element). But file existence checks (within the .jar even)
should be a good idea.

Comment 7

[Robert Strong (they/them - no direct email)]

The em:file tag is used to create the chrome.manifest along with the associated
jar file and an error is shown if there isn't a chrome.manifest in this instance
since we need the jar file as defined in the em:file section of the install.rdf.
These kind of errors in packaging an extension (e.g. not packaging the jar file
for the extension) would be caught with minimal testing by the extension author.
There are a ton of checks we could do that are similar to this one with the
target audience being the person developing the extension which would add both
complexity and bloat to the code. I'd say an extension packaging tool would be a
better place for these types of checks that in most if not all cases would only
be useful to extension authors vs. putting them in the toolkit. If not, then
there are a bunch of more checks we *could* do but I don't see much value in
doing so and reasons not to like bloat, complexity, etc. This hasn't been seen
as a problem except in the instance where someone intentionally does this or
they are just starting out with extension development.

Comment 8

[Eyal Rozenberg]

(In reply to comment #7)

Well, I would perhaps be more inclined to agree with you if, when using (not
installing) an extension which was missing its jar file or some files within it,
tbirdfirefox would give some message about failing to apply an overlay, or
failing to locate some part of a skin, etc. - which doesn't happen.

Anyway, I really don't think you can say that checking that the files in the
manifest/install.rdf exist is bloating the code.

Comment 9

[Robert Strong (they/them - no direct email)]

It isn't the one check that would cause bloat... it is the numerous checks that
could be made that are similar in nature. Also keep in mind the following, "This
hasn't been seen as a problem except in the instance where someone intentionally
does this or they are just starting out with extension development." This error
seldom if ever happens except under these circumstances and the value of adding
a check for a missing jar is questionable.

A single extension can work with multiple toolkit apps so if there were an error
displayed to the user then the user would see errors when using an extension
that overlays xul for Thunderbird that isn't included with Firefox, etc.

Comment 10

[Benjamin Smedberg]

I agree with robstrong, the pain/gain ratio is not worth it. WONTFIX.