406032 - Block update info urls that are not http/https

Status: RESOLVED FIXED

(Toolkit :: Add-ons Manager, defect, P3)

Description

[Dave Townsend [:mossop]]

Currently we accept and use any update info url we are given. We should restrict them to http/https only. This should be a simple fix.

Comment 1

[Dave Townsend [:mossop]]

Attachment: patch rev 1

This is the simple fix, just drop any updateInfoURL entries that are not http or https.

Comment 2

[Robert Strong (they/them - no direct email)]

Comment on attachment 290755 [details] [diff] [review]
patch rev 1

per discussion with Dave... only check the uri scheme when needed instead of every update check and create a uri and use the scheme property.

Comment 3

[Dave Townsend [:mossop]]

Attachment: patch rev 2

Shifted the check across to the UI side, only actually check when we need to use the uri.

Comment 4

[Robert Strong (they/them - no direct email)]

Comment on attachment 290929 [details] [diff] [review]
patch rev 2

r=me with declaring the vars where they are used

Comment 5

[Dave Townsend [:mossop]]

Comment on attachment 290929 [details] [diff] [review]
patch rev 2

This is a small change checking that the release notes are really coming from a web server.

Comment 6

[Dave Townsend [:mossop]]

Checking in toolkit/mozapps/extensions/content/extensions.js;
/cvsroot/mozilla/toolkit/mozapps/extensions/content/extensions.js,v  <--  extensions.js
new revision: 1.153; previous revision: 1.152
done

Comment 7

[Tony Chung [:tchung]]

Hi dave, do you have a testcase for this fix?  Thanks.

Comment 8

[Daniel Veditz [:dveditz]]

is this worth fixing on the 1.8 branch?

Comment 9

[Dave Townsend [:mossop]]

(In reply to comment #7)
> Hi dave, do you have a testcase for this fix?  Thanks.

I'll have to work something up after the holidays.

(In reply to comment #8)
> is this worth fixing on the 1.8 branch?

The feature doesn't exist on the 1.8 branch so no.

Comment 10

[Tony Chung [:tchung]]

(In reply to comment #9)
> (In reply to comment #7)
> > Hi dave, do you have a testcase for this fix?  Thanks.
> 
> I'll have to work something up after the holidays.

Hey Dave, revisiting this request for a testcase.  Thanks.

Comment 11

[Dave Townsend [:mossop]]

(In reply to comment #10)
> (In reply to comment #9)
> > (In reply to comment #7)
> > > Hi dave, do you have a testcase for this fix?  Thanks.
> > 
> > I'll have to work something up after the holidays.
> 
> Hey Dave, revisiting this request for a testcase.  Thanks.
> 

Sorry, lost this. Install https://people.mozilla.com/~dtownsend/testcases/bug406032/test.xpi and restart, then do an update check. Clicking on show information should say it has none. The update info actually has a data url in it that is getting ignored.