625054 - Add-on builder accepts invalid identifiers as package names

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[Kris Maglione [:kmag]]

User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:2.0b9pre) Gecko/20110109 Firefox/4.0b9pre
Build Identifier: 

The add-on builder should only accept strings which constitute valid domain names as package names, and should mangle them into proper JavaScript identifiers before using them to generate code. At the moment, for instance, foo-addon is accepted as a package name and used as a JavaScript identifier without complaint (I've just rejected and add-on which used it unchanged, I'm sorry to say).

I'd recommend a validator that accepts /^[a-z][a-z0-9-]+$/ and a mangler along the lines of re.sub(r'-(.)', lambda m: m.group(1).upper(), name).

Reproducible: Always

Comment 1

[Kris Maglione [:kmag]]

Attachment: Proposed fix

This is against the http://svn.mozilla.org/projects/fizzypop/trunk/ repo that Jorge has been pushing to. If the http://svn.mozilla.org/libs/fizzypop.mozdev repo has changed significantly since then, I'll update once Jorge's changes have been pushed, since this patch depends on them.

Comment 2

[Mark Finkle (:mfinkle) (use needinfo?)]

Comment on attachment 503200 [details] [diff] [review]
Proposed fix

looks good to me. we can tweak the "valid_namespace" regex if it seems to restrictive.

Comment 3

[Matt Basta [:basta]]

So not sure why this got taken, but for whoever works on this, the new packager is here:

https://github.com/mattbasta/addon-packager

and here:

https://github.com/jbalogh/zamboni/blob/master/apps/devhub/views.py#L512

Comment 4

[Daniel Buchner [:dbuc]]

ohhh, I think this is in the wrong component...

Comment 5

[Wil Clouser [:clouserw]]

Thanks for filing this.  Due to resource constraints we are closing bugs which we won't realistically be able to fix.  If you have a patch that applies to this bug please reopen.

For more info see http://micropipes.com/blog/2014/09/24/the-great-add-on-bug-triage/