Closed Bug 513940 Opened 11 years ago Closed 11 years ago

Check addons for setting of the preference site.update.url

Categories

(addons.mozilla.org Graveyard :: Admin/Editor Tools, defect)

x86
All
defect
Not set

Tracking

(Not tracked)

RESOLVED WONTFIX

People

(Reporter: ericjung, Unassigned)

Details

Can we add a reg exp to check for the string:

.*\.setCharPref(\”.*\@site\.update\.url\”.* (reg exp untested)

This will match, for example:

prefs.setCharPref(”extensions.sample@site.update.url”, “http://badsite.com”);

This effectively bypasses AMO for update checks.

See bug 382708 for details.
p.s. this is meant for the Addon Verification Tool
Bug 378216 also talks about this pref.
extensions\..*\.update\.url is already checked for in the unsafe settings tests in the add-on validator. This was noted in bug 382708 comment 7. Is there something else to this?

Also, checking for setCharPref wouldn't be very accurate as many extensions implement helper functions for prefs so that wouldn't necessarily catch that.
(In reply to comment #3)
> extensions\..*\.update\.url is already checked for in the unsafe settings tests
> in the add-on validator. This was noted in bug 382708 comment 7. Is there
> something else to this?

I don't see any reference to site.update.url, just extensions.update.url. However, there is some speculation in #amo that site.update.url may no longer be in the codebase.

 
> Also, checking for setCharPref wouldn't be very accurate as many extensions
> implement helper functions for prefs so that wouldn't necessarily catch that.

Sorry, my regexp wasn't intended to be thorough and it is untested, as labeled. Please consider the bug to be that we check for site.update.url without reference to any specific implementation provided by me.
site.update.url? I thought the pref format was extensions.ID.update.url?
http://kb.mozillazine.org/Manage_extension_updates_by_locale
(I can't find a decent MDC article at the moment)

(In bug 382708 comment #0)
> Here is some sample code for doing this, assuming the extension ID is
> "sample@site":
> const updateURL = "http://www.site.com/update.rdf";
> const prefs = Components.classes["@mozilla.org/preferences-service;1"]         
>         .getService(Components.interfaces.nsIPrefBranch);
> prefs.setCharPref("extensions.sample@site.update.url", updateURL);

The sample ID here as stated is "sample@site". The regexp I noted in comment 3 is for this. It gets extensions.*.update.url just fine. The word "site" in this example is part of the given ID, not part of the rest of the pref. An alternate pref, also caught by the current regexp, would be extensions.{1018e4d6-728f-4b20-ad56-37578a4de76b}.update.url, using a generated ID in this case.
Thanks for the explanation Dave.  It looks like our current regex will already catch this (extensions.*.update.url) so calling this a wontfix.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WONTFIX
Product: addons.mozilla.org → addons.mozilla.org Graveyard
You need to log in before you can comment on or make changes to this bug.