602101 - Check timestamp in the manifest before following instructions

Status: RESOLVED FIXED

(Mozilla Labs :: Labs Pack, defect)

Description

[Ed Lee :Mardak]

The timestamp can be used to:

1) make sure we don't process an older manifest than one we've already processed
2) only accept recent manifests from the last 30 days

for 1: we can store previous timestamps in a pref and check if newTimestamp <= oldTimestamp then ignore

for 2: if new Date(newTimestamp) < new Date(Date.now() - 30*24*6060*1000) then ignore

There might be issues for 2 if the user's clock is wrong, but the manifest/signature are served over ssl which needs a somewhat accurate clock to begin with.

Comment 1

[Ed Lee :Mardak]

http://hg.mozilla.org/labs/sigma/rev/21d4d6557e27
Read out the timestamp from the manifest and make sure it exists and is newer than the previous timestamp.