750119 - "Foxlingo" add-on sends all visited URLs (incl. HTTPS) to http://api??.thetrafficstat.net

Status: VERIFIED FIXED

(addons.mozilla.org :: Security, defect)

Description

[Manuel Romeiro]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0
Build ID: 20120420145725

Steps to reproduce:

I installed Foxlingo (https://addons.mozilla.org/en-US/firefox/addon/foxlingo-translator-dictionary/).
The extension version is  2.7.3, but the problem my be reproducible on other versions.
I use Firefox 12 on Windows 7, but is reproducible also on Firefox 11, and maybe on other versions of Firefox




Actual results:

With Foxlingo extension installed, the firefox sent all visited urls (full urls including HTTPS urls) to : http://api??.thetrafficstat.net.
Url sent when I writing this bug:
http://api25.thetrafficstat.net/related?s=175&md=21&pid=null&sess=S77856895407477&q=https%3A%2F%2Fbugzilla.mozilla.org%2Fenter_bug.cgi%23h%3DbugForm%257CFirefox&prev=https%3A%2F%2Fbugzilla.mozilla.org%2Fenter_bug.cgi%23h%3Ddupes%257CFirefox&link=1&hreferer=https%3A%2F%2Fbugzilla.mozilla.org%2Findex.cgi&sub=Toolbar1


This should be marked as spyware!



Expected results:

The Firefox should block Foxlingo extension until the Foxlingo developers solve the problem!
Thanks

Comment 1

[Andre Klapper]

Seems like others also second this statement: https://addons.mozilla.org/en-US/firefox/addon/foxlingo-translator-dictionary/reviews/

Moving to "add-ons" product.

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

Andrew, please have a look.

Comment 3

[Andrew Williamson [:eviljeff]]

Confirming.  The code appears (perhaps falsely) to be part of the similarsites functionality but I can't see anywhere to turn off or on similarsite, nor any suggestions of any similar sites.

I forced the addon to deactivate its 'from mozilla' mode (which disables some of the 3rd party addon installation) but it still doesn't offer to install or enable/disable similarsites.

The add-on is currently preliminary reviewed only and their latest update in the queue doesn't change this functionality (though does change some of the random hash code in the offending tabslistener.js file).

Jorge: is this serious enough to disable and require changes for preliminary review?

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

Lets require them to change it for the next version and see what they have to say about it.

Comment 5

[Andrew Williamson [:eviljeff]]

I've rejected the pending version asking them to remove or justify the functionality.

Comment 6

[Alex]

Is this still the case with version 2.7.6?

Comment 7

[Alex]

I noticed in the settings of 2.7.6 that the "extra features (adsupported)" checkbox cannot be turned off.  I uncheck it but the next time edit the addon's settings, it is checked again.

Comment 8

[Andrew Williamson [:eviljeff]]

The options dialog appears to be broken - the pref (identifysitelanguage) isn't changing on Save.

Comment 9

[Jorge Villalobos [:jorgev] (he/him)]

Andrew or Kris, what's the status of this bug?

Comment 10

[Andrew Williamson [:eviljeff]]

(In reply to Jorge Villalobos [:jorgev] from comment #9)
> Andrew or Kris, what's the status of this bug?

From looking at the emails we got, the last version I reviewed I rejected; a discussion was had between the developers, you and Kris, where you agreed to allow the functionality. 

They submitted a new version; they asked for confirmation on 27th Sept (no reply); Kris rejected on 2nd Oct.  I can't say how close the version Kris rejected was to what you agreed though.

Comment 11

[Alex]

> where you agreed to allow the functionality

Could you please explain to our mere mortals why would such functionality be allowed?

Thank you.

Comment 12

[Kris Maglione [:kmag]]

So, to be clear, the last version I rejected does not seem to do this. It does inject scripts into all web pages, if that's been opted into (which is more than a bit shady, since people are opting into ad injection into search results and not script injection into every page they visit, but...)

There are some other issues that I'm not remotely happy about, though.

Comment 13

[Jorge Villalobos [:jorgev] (he/him)]

The add-on is no longer available on the add-ons site because of lack of updates and overall bad quality. They are free to submit new versions as long as they address the pending problems.

Comment 14

[Madalin Cotetiu]

The add-on is no longer available https://addons.mozilla.org/en-US/firefox/addon/foxlingo-translator-dictionary/
Screencast: http://screencast.com/t/cCver9CI8EF
Closing.