696245 - BlockList Request, Plugin - Old Quicktime versions are retained in about:addons [Plugins]

Status: RESOLVED WORKSFORME

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Rob]

Plugin Name: npqtplugin?.dll

Description of problem: When installing (for the first time) a new version of Firefox (or when doing an update and the version changes in the first digit) Firefox will locate EVERY previous version of Quicktime and create an entry for it in about:addons [Plugins].

Reason for a "Blocklist Request": I filed Bug 1544014 but have since learned from Bug 692685 Comment 25 that the Maintainer likes these request filed using this Template.

Related Bugs: Bug 430826 Bug 445256 


Rationale: 
1. It is a security issue that is unmanageable to not be able to know which VERSION of the Quicktime Plugin is _actually_ being used by Firefox.
2. Apple _usually_ updates it's Quicktime Plugin to fix a vulnerability (as opposed to offering more speedy performance or new features), thus it makes sense (and is _usually_ a security issue) to use the newest version.
3. Our PiC Page (https://www.mozilla.com/en-US/plugincheck/) reports that Quicktime needs to be updated IF multiple versions are installed even if the most current version is on the List.
4. It looks ugly to have multiple entries for the same Plugin in the about:addons [Plugins] List with different version (I have four that I must disable).


PS: I am filing this for "Aurora" but it also affect "Release" and "Nightly". In my "C:\Program Files\Nightly\plugins", "C:\Program Files\Aurora\plugins" and "C:\Program Files\Mozilla Firefox\plugins" Directories I have npqtplugin9.dll dated 11/21/2009 and QuickTimePlugin.class dated 10/2/2011 yet the PiC Page (and about:addons[Plugins]) reports that I have Quicktime 7.6.5 which WAS current last month (I can not update it since the most recent version BSODs my Computer - but that is unrelated to this Bug Report about "multiple entries").

Directory "C:\Program Files\QuickTime\Plugins" contains nsIQTScriptablePlugin.xpt and QuickTimePlugin.class both dated 10/2/2011 so I don't know where Firefox gets the other versions of Quicktime from but each time I install a fresh version of Firefox (or run the Updater and the Update is a new major version release) then I have to go into about:addons[Plugins] and disable all the old versions and restart Firefox to get a clean Report from our PiC Page.

Comment 1

[Rob]

I wonder what is with Firefox's internals as the same issue occurs with Java, the different is that Java is in the [Extensions] Tab and Quicktime is in the [Plugins] Tab of about:addons .


My about:addons [Extensions] says I have:

Java Console 6.0.22
Java Console 6.0.23
Java Console 6.0.24
Java Console 6.0.25
Java Console 6.0.26
Java Console 6.0.27
Java Quick Starter 1.0

(along with other add ons). I will file a separate Blocklist Request IF this is not a related issue.

Comment 2

[Rob]

(In reply to Rob from comment #1)
> I wonder what is with Firefox's internals as the same issue occurs with
> Java, the different is that Java is in the [Extensions] Tab and Quicktime is
> in the [Plugins] Tab of about:addons .
> 
> 
> My about:addons [Extensions] says I have:
> 
> Java Console 6.0.22
> Java Console 6.0.23
> Java Console 6.0.24 (CORRECTION: This version is not present)
> Java Console 6.0.25
> Java Console 6.0.26
> Java Console 6.0.27
> Java Quick Starter 1.0
> 
> (along with other add ons). I will file a separate Blocklist Request IF this
> is not a related issue.


When I visit http://www.java.com/en/download/uninstall.jsp it says:

"
/!\ We have detected the following old versions of Java that are installed on your system:

    J2SE Runtime Environment 5.0 Update 5

These should be removed to maintain your system security.
"

Our PiC Page says nothing about this.

-----

I completely removed Quicktime by following these instructions on Apple's Site:

Removing and Reinstalling iTunes, QuickTime, and other software components for Windows XP
http://support.apple.com/kb/ht1925

The newest version of QuickTimeInstaller.exe (7.70.80.34) no longer crashes my OS with a BSOD. 

Now I have "QuickTimePlugin.class", npqtplugin.dll AND npqtplugin2.dll (same size) all dated 10/20/2011 in Directories: C:\Program Files\Mozilla Firefox\plugins , C:\Program Files\Aurora\plugins and C:\Program Files\Nightly\plugins - the Quicktime Installer found ALL those Directories on it's own.

My about:addons[Plugins] says I have "Quicktime Plug-in 7.7 7.7.0.0" (INSTALLED) and "Quicktime Plug-in 7.6.5 7.6.5.0" (DISABLED) even though "Quicktime 7.6.5.0" does not exist on my System (for certain, since I followed Apple's removal Instructions and deleted all the Directories as the advanced Instructions suggested).

-----

On the other issue (Java) the about:addons[Extensions] Page says I have:

"
Java Console 6.0.27
Java Console 6.0.29
Java Quick Starter 1.0
"

AND

"
Java Console 6.0.22 (disabled)
Java Console 6.0.23 (disabled)
Java Console 6.0.25 (disabled)
Java Console 6.0.26 (disabled)
Java Console 6.0.27 (disabled)
"

but http://www.java.com/en/download/uninstall.jsp does not report other versions that Oracle recommends to remove.

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

(In reply to Rob from comment #1)
> I wonder what is with Firefox's internals as the same issue occurs with
> Java, the different is that Java is in the [Extensions] Tab and Quicktime is
> in the [Plugins] Tab of about:addons .
> 
> 
> My about:addons [Extensions] says I have:
> 
> Java Console 6.0.22
> Java Console 6.0.23
> Java Console 6.0.24
> Java Console 6.0.25
> Java Console 6.0.26
> Java Console 6.0.27
> Java Quick Starter 1.0
> 
> (along with other add ons). I will file a separate Blocklist Request IF this
> is not a related issue.

An upcoming version of Firefox (8, I think?) will remove all of the Java Console extensions, as they are worthless.

Comment 4

[Rob]

(In reply to Wes Kocher (:KWierso) (Jetpack Bugmaster) from comment #3)
> (In reply to Rob from comment #1)
> > I wonder what is with Firefox's internals as the same issue occurs with
> > Java, the different is that Java is in the [Extensions] Tab and Quicktime is
> > in the [Plugins] Tab of about:addons .
> > 
> > 
> > My about:addons [Extensions] says I have:
> > 
> > Java Console 6.0.22
> > Java Console 6.0.23
> > Java Console 6.0.24
> > Java Console 6.0.25
> > Java Console 6.0.26
> > Java Console 6.0.27
> > Java Quick Starter 1.0
> > 
> > (along with other add ons). I will file a separate Blocklist Request IF this
> > is not a related issue.
> 
> An upcoming version of Firefox (8, I think?) will remove all of the Java
> Console extensions, as they are worthless.

The only possible use I could think of was that some Java Programs (Eclipse comes to mind) MIGHT actually use a specific version of Java to debug Programs that were compiled with a specific version.

For US it is certainly of no use to have multiple versions of exactly the same Plugin (or Extension); this is why I mentioned that Java was doing the same thing as Quicktime was, in case the "Blocklist Maintainers" felt it was not so much a 'Blocklist issue' but an issue in adjoining Code (to check for Dupes and remove them).

Comment 5

[Rob]

Even though I disable "Quicktime Plug-in 7.6.5 7.6.5.0" (and it does NOT even exist on my System) in about:addons[Plugins] it keeps reappearing in Nightly when I go use Aurora and then come back to Nightly.

A week ago I was able to disable 'phantom' (and existing) versions and they would stay away - must be Halloween.

Comment 6

[Rob]

(In reply to Rob (2 Weeks Vacation) from comment #5)
> Even though I disable "Quicktime Plug-in 7.6.5 7.6.5.0" (and it does NOT
> even exist on my System) in about:addons[Plugins] it keeps reappearing in
> Nightly when I go use Aurora and then come back to Nightly.
> 
> A week ago I was able to disable 'phantom' (and existing) versions and they
> would stay away - must be Halloween.

The above portion of this Bug does not seem to reoccur (at the moment). After a few Updates and switching between Aurora and Nightly a few times the uninstalled Quicktime seems to remain 'not shown' in [Tools][Add-ons][Plugins].

Comment 7

[Rob]

In "FF Release", Aurora, and Nightly this WFM.

@ Wes Kocher:
Are you able to close this as "FIXED" (with an appropriate Report) or shall I close it as WFM (without any details on when or what was actually fixed) ?

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

I don't have any information about what would have changed. (Maybe Quicktime started cleaning up after itself?)

I'd say close as WFM unless someone else comes in with the actual reason it's working.

Comment 9

[Rob]

(In reply to Wes Kocher (:KWierso) from comment #8)
> I don't have any information about what would have changed. (Maybe Quicktime
> started cleaning up after itself?)
> 
> I'd say close as WFM unless someone else comes in with the actual reason
> it's working.

OK.