Closed Bug 878101 Opened 12 years ago Closed 12 years ago

Validate origin in manifest

Categories

(Marketplace Graveyard :: Validation, defect, P1)

Product:
Marketplace Graveyard
Component:
Validation
Platform:
x86
macOS
Type:
defect

Tracking

(Not tracked)

Status:
VERIFIED FIXED
Milestone:
2013-06-27

People

(Reporter: andy+bugzilla, Assigned: robhudson)

References

Details

In bug 852720 packaged apps were allowed to have an origin in the manifest. This is for the validator to check that the origin is valid.
Blocking bug 867265, so bumping to P1.
Blocks: 867265
Priority: -- → P1
Do we need to ping the domain? Or just check that its a valid fqdn?
Is bug 883185 possibly a dupe of this?
That's about checking domain ownership and could be considered a follow on from this. My original intent of this bug was to check that someone hasn't entered garbage into this field.
Assignee: nobody → robhudson.mozbugs
Target Milestone: --- → 2013-06-27
https://github.com/mozilla/zamboni/commit/f1a7a39
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Please add STR here or mark it with [qa-] if no QA is needed.
To verify: Submit a packaged app with an "origin" property in the manifest. The origin should only be allowed if it follows the form of "app://domain.com". Things like "http://domain.com" or "mailto:domain.com" or even "app:something-else" should fail validation and show a warning.
(In reply to Rob Hudson [:robhudson] from comment #7) > To verify: > Submit a packaged app with an "origin" property in the manifest. The origin > should only be allowed if it follows the form of "app://domain.com". Things > like "http://domain.com" or "mailto:domain.com" or even "app:something-else" > should fail validation and show a warning. Should "app://something-else" also pass validation? To pass validation it only needs to have "app://" in the beginning or it has to contain a valid domain after? http://screencast.com/t/t5q65TPaI
Flags: needinfo?(robhudson.mozbugs)
I'm not sure anymore, sorry. Basta, do you know the answer to comment 8?
Flags: needinfo?(robhudson.mozbugs) → needinfo?(mattbasta)
There is no requirement that the origin represents a valid domain or a domain that the developer owns. The following are perfectly valid origins: app://my.great.domain app://not.actually.a.domain app://trolololo app://hypens-are-fun-too
Flags: needinfo?(mattbasta)
Ok. Thanks Basta. Verified as fixed in https://marketplace-dev.allizom.org/developers/submit/ on FF28 (Win 7). Closing bug.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.