713605 - Strongly advise against using contentScript rather than contentScriptFile for complex scripts.

Status: RESOLVED FIXED

(Add-on SDK Graveyard :: Documentation, defect, P1)

Description

[Kris Maglione [:kmag]]

The page-mod documentation should advise that contentScriptFile should be used rather than contentScript for complex scripts and that it should never be used with non-static strings. 

We get a lot of submissions to AMO with improperly sanitized, non-static strings used for content scripts (and elsewhere), and a fair number with unreadable, unformated, multiply concatenated strings. The former are a bug-prone security hazard, and the latter are nearly impossible to review and which can't be validated by our validator. I've rejected a lot of add-ons for using non-static strings, and wasted quite a lot of reviewing the the complex strings before giving a warning that it needs to be changed.

Comment 1

[Kris Maglione [:kmag]]

Bumping to major since I'm rejecting quite a lot of add-ons for this.

Comment 2

[Will Bamberg [:wbamberg]]

Attachment: big red warning

Comment 3

[Dietrich Ayala (:dietrich)]

Comment on attachment 588232 [details] [diff] [review]
big red warning

Review of attachment 588232 [details] [diff] [review]:
-----------------------------------------------------------------

r=me on this change.

I do wonder, however, if we should include a warning about the consequences of not heeding the warning - something about problems getting add-on approval on AMO.

Comment 4

[Will Bamberg [:wbamberg]]

Attachment: Reworded warning to mention AMO approval

Sorry to ask again, but I thought it was worth another check. I also made the warning a bit less jarring.

Comment 5

[[github robot]]

Commit pushed to https://github.com/mozilla/addon-sdk

https://github.com/mozilla/addon-sdk/commit/c6f71643d58285fdf7bf11af0dc05c8507fbc871
Bug 713605 - Strongly advise against using contentScript rather than contentScriptFile for complex scripts.; r=@dietrich

Comment 6

[[github robot]]

Commit pushed to https://github.com/mozilla/addon-sdk

https://github.com/mozilla/addon-sdk/commit/7152df115768d271a881ba74fcbc411ecb482c26
Bug 713605 - Strongly advise against using contentScript rather than contentScriptFile for complex scripts.; r=@dietrich
(cherry picked from commit c6f71643d58285fdf7bf11af0dc05c8507fbc871)