529345 - need to ensure that updateIntervals are not negative

Status: NEW

(Firefox :: Search, defect, P5)

Description

[:Gavin Sharp [email: [e-mail]]]

We currently don't do much validation on updateInterval. AFAICT, someone can specify an updateInterval of -1, which will make us search for updates every six hours (every time our update timer fires).

Marking security sensitive for now, but this probably isn't _that_ big of a deal...

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

There are updateIntervals in many different parts of the source tree.
http://mxr.mozilla.org/mozilla-central/search?string=updateInterval
Did you have any particular one(s) in mind?

Comment 2

[:Gavin Sharp [email: [e-mail]]]

This bug is about the Firefox search service. That's why I filed it in Firefox :: Search.

Comment 3

[Daniel Veditz [:dveditz]]

Since 1 day is a valid setting this is only 4 times more often. how is that a security problem?

Comment 4

[:Gavin Sharp [email: [e-mail]]]

You're right, it's not really. Still something we should fix though, I think.