513940 - Check addons for setting of the preference site.update.url

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: Admin/Editor Tools, defect)

Description

[Eric Jung [:ericjung]]

Can we add a reg exp to check for the string:

.*\.setCharPref(\”.*\@site\.update\.url\”.* (reg exp untested)

This will match, for example:

prefs.setCharPref(”[e-mail]”, “http://badsite.com”);

This effectively bypasses AMO for update checks.

See bug 382708 for details.

Comment 1

[Eric Jung [:ericjung]]

p.s. this is meant for the Addon Verification Tool

Comment 2

[Eric Jung [:ericjung]]

Bug 378216 also talks about this pref.

Comment 3

[Dave Garrett]

extensions\..*\.update\.url is already checked for in the unsafe settings tests in the add-on validator. This was noted in bug 382708 comment 7. Is there something else to this?

Also, checking for setCharPref wouldn't be very accurate as many extensions implement helper functions for prefs so that wouldn't necessarily catch that.

Comment 4

[Eric Jung [:ericjung]]

(In reply to comment #3)
> extensions\..*\.update\.url is already checked for in the unsafe settings tests
> in the add-on validator. This was noted in bug 382708 comment 7. Is there
> something else to this?

I don't see any reference to site.update.url, just extensions.update.url. However, there is some speculation in #amo that site.update.url may no longer be in the codebase.

 
> Also, checking for setCharPref wouldn't be very accurate as many extensions
> implement helper functions for prefs so that wouldn't necessarily catch that.

Sorry, my regexp wasn't intended to be thorough and it is untested, as labeled. Please consider the bug to be that we check for site.update.url without reference to any specific implementation provided by me.

Comment 5

[Dave Garrett]

site.update.url? I thought the pref format was extensions.ID.update.url?
http://kb.mozillazine.org/Manage_extension_updates_by_locale
(I can't find a decent MDC article at the moment)

(In bug 382708 comment #0)
> Here is some sample code for doing this, assuming the extension ID is
> "sample@site":
> const updateURL = "http://www.site.com/update.rdf";
> const prefs = Components.classes["@mozilla.org/preferences-service;1"]         
>         .getService(Components.interfaces.nsIPrefBranch);
> prefs.setCharPref("[e-mail]", updateURL);

The sample ID here as stated is "sample@site". The regexp I noted in comment 3 is for this. It gets extensions.*.update.url just fine. The word "site" in this example is part of the given ID, not part of the rest of the pref. An alternate pref, also caught by the current regexp, would be extensions.{1018e4d6-728f-4b20-ad56-37578a4de76b}.update.url, using a generated ID in this case.

Comment 6

[Wil Clouser [:clouserw]]

Thanks for the explanation Dave.  It looks like our current regex will already catch this (extensions.*.update.url) so calling this a wontfix.