375398 - Files of nominated add-ons are public

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Admin/Editor Tools, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

1. Go to an extension in the nomination queue (example: https://addons.mozilla.org/de/firefox/editors/review/30574 )
2. Copy the file url ( https://addons.mozilla.org/de/firefox/downloads/file/13777/linkto-1.0-firefox.xpi ).
3. Log out or start a second Firefox session with -no-remote.
4. Paste file url into address bar and press enter.
5. See the install box prompting for input.

Result: Someone who could create a malicious extension and brand it as a boring one, requiring special external software for the add-on, could nominate it for public and it would stay for ages in the nomination queue, but he would be able to use the file url to point people to his untested / unapproved add-on and their Firefox will directly prompt for install because addons.mozilla.org is on the extension install whitelist.

Comment 1

[Mike Shaver (:shaver emeritus)]

(In reply to comment #0)
> Result: Someone who could create a malicious extension and brand it as a boring
> one, requiring special external software for the add-on, could nominate it for
> public and it would stay for ages in the nomination queue, but he would be able
> to use the file url to point people to his untested / unapproved add-on and
> their Firefox will directly prompt for install because addons.mozilla.org is on
> the extension install whitelist.

The user would have to directly enter the URL, rather than just click it, because it's the page that has the clicked link, not the site that's the _target_ of the link, that matters.

Copying sancus here so he can see the bug, not sure if that file is in fact public or not.

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Ah, I remember. So forget what I wrote about the whitelist. The files are accessible from the clean profile without being logged in. 

Comment 3

[Justin Scott [:fligtar]]

Fixed in r3011.