562303 - Wrong extension signature causes install from local file to fail silently

Status: VERIFIED FIXED

(Toolkit :: Add-ons Manager, defect, P2)

Description

[Wladimir Palant]

I was trying to install a version of Adblock Plus with a slightly modified install.rdf file and installation seemingly didn't do anything whatsoever. Error Console showed the reason:

Signature Verification Error: the signature on install.rdf is invalid because the MANIFEST.MF file does not contain a valid hash of the file being verified.

Error: ERROR addons.manager: Exception calling provider.getInstallForURL: Error: XPI is incorrectly signed

Shouldn't this produce some user-visible error? I don't think that we want the user to be able to install such an add-on but an error message would be useful if the download was corrupted by anti-virus software for example.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Wladimir, do you have an example of that XPI and could you attach it on that bug?

This bug depends on bug 552965 IMO.

Comment 2

[Wladimir Palant]

Attachment: Correctly signed XPI file

Correctly signed XPI file - this one should show "Wladimir Palant" as author.

Comment 3

[Wladimir Palant]

Attachment: Incorrectly signed XPI file

This has the same signature as the previous XPI file but some whitespace modification in install.rdf - the signature doesn't match.

Comment 4

[Wladimir Palant]

Actually, when installing from the web I get an error message:

The download of https://bug562303.bugzilla.mozilla.org/attachment.cgi?id=442047 failed: -3

With a file from your hard drive not even this (unhelpful) message is shown.

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Do you eventually see bug 562302? Does a new profile or removing the extensions.sqlite file help?

Comment 6

[Wladimir Palant]

No, the profile is brand new. And I can install extensions - it's only those with invalid signature that fail.

Comment 7

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Hmm, for local files, it seems the API sends no events until after its successfully loaded the manifest (and a bunch of other stuff). So the UI doesn't know anything has actually happened, let alone an error has occurred.

Comment 8

[Dave Townsend [:mossop]]

Certainly the poor error message is bug 552965, the total lack of errors for local installs is something new though

Comment 9

[Dave Townsend [:mossop]]

Fixed by the patch in bug 570200

Comment 10

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Given the automated tests it looks to be stable enough to call it out as verified fixed.