870031 - Dropping XPI in staging directory bypasses about:newaddon

Status: RESOLVED INACTIVE

(Toolkit :: Add-ons Manager, defect)

Description

[Kris Maglione [:kmag]]

The summary says it all. Any XPI dropped in a profile directory's staging directory is silently installed without an opt-in. We should probably respect the extensions.autoDisableScopes value for the stage directory's parent.

Comment 1

[Dave Townsend [:mossop]]

Are people abusing this? Right now we use this in the Firefox test harness and we need a route to install add-ons that don't show that page for the UI. I seem to recall we had another bug on this and marked it as invalid for these reasons.

Comment 2

[Kris Maglione [:kmag]]

Yes. See bug 863387.

Comment 3

[Dave Townsend [:mossop]]

*sigh*

So we could reject anything in there that doesn't have a .json file with it (http://mxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/XPIProvider.jsm#2082). That is probably easiest but might break our test harnesses. The alternative is to just set a pref telling us to exclude a particular ID from about:newaddons on the next startup.

The latter is trivial to bypass, the former is a little harder since things might break badly if we changed the format of that json periodically...

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

Would it be very difficult for the test harness to change addons.sqlite or just drop a modified copy to install the add-ons?

Comment 5

[Dave Townsend [:mossop]]

(In reply to Jorge Villalobos [:jorgev] from comment #4)
> Would it be very difficult for the test harness to change addons.sqlite or
> just drop a modified copy to install the add-ons?

It's possible but I think it would be more complex than just manually creating the json files to drop in along with the add-ons, even if that would require changes with every change to that format (though they are rare these days)

Comment 6

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.