602265 - Validator lists many security warnings for Jetpack SDK addons.

Status: RESOLVED DUPLICATE of bug 563522

(addons.mozilla.org Graveyard :: Developer Pages, enhancement)

Description

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b7pre) Gecko/20101005 Firefox/4.0b7pre
Build Identifier: 

I uploaded an SDK-built add-on to AMO, and the validator says it has 44 warnings and 9 passes. All of those warnings are from files in the bootstrap/harness files, addon-kit, or jetpack-core, and outside of my control.

It'd be nice if the validator could detect SDK-build add-ons and not throw those errors. 

Reproducible: Always

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Once we have checksum validations for these common files, we can ignore any warnings coming from them.

Comment 2

[Wil Clouser [:clouserw]]

(In reply to comment #1)
> Once we have checksum validations for these common files, we can ignore any
> warnings coming from them.
> 
> *** This bug has been marked as a duplicate of bug 563522 ***

Can we fix the files?

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to comment #2) 
> Can we fix the files?

There's a lot that can be done to reduce the warnings (using nsITimer instead of setTimeout and refactor all wrappedJSObject calls into a single function would go a long way), but there are some warnings that are inevitable.