892670 - Trying to submit a packaged app with an origin matching a Core Gaia application origin is allowed, but shouldn't be

Status: VERIFIED FIXED

(Marketplace Graveyard :: Validation, defect)

Description

[Jason Smith [:jsmith]]

Attachment: Test App

STR

1. Go to https://marketplace-dev.allizom.org/developers/submit/
2. Try to submit the attached packaged app

Expected

Validation should fail - the app origin provided matches a Core Gaia application, which isn't allowed to be used by third-party app developers.

Actual

Validation passes. As a result, an app can be published that uses a Core Gaia application origin. If the user tries to install this app, the app will fail to install, as we ban multiple apps per origin on the client-side.

We should implement a blacklist of origins that third-party app developers are not allowed to use. As a start, this blacklist should contain the origins of each Core Gaia application.

Comment 1

[Matt Basta [:basta]]

Please provide a list of origins that should be banned.

Comment 2

[Jason Smith [:jsmith]]

List of origins:

* app://costcontrol.gaiamobile.org
* app://bluetooth.gaiamobile.org
* app://camera.gaiamobile.org
* app://system.gaiamobile.org
* app://calendar.gaiamobile.org
* app://communications.gaiamobile.org
* app://wallpaper.gaiamobile.org
* app://clock.gaiamobile.org
* app://sms.gaiamobile.org
* app://settings.gaiamobile.org
* app://browser.gaiamobile.org
* app://pdfjs.gaiamobile.org
* app://gallery.gaiamobile.org
* app://video.gaiamobile.org
* app://fm.gaiamobile.org
* app://music.gaiamobile.org
* app://keyboard.gaiamobile.org
* app://email.gaiamobile.org
* app://homescreen.gaiamobile.org
* app://marketplace.firefox.com

Comment 3

[Jason Smith [:jsmith]]

Should note with marketplace - someone else shouldn't be able to use that origin, but we should be able to. That might already be handled by the fact that we have that app in the marketplace itself.

Comment 4

[Wil Clouser [:clouserw]]

I think we have a blacklist in the db for add-on names already, we could do the same here and just pick a pile of domains.  *.gaiamobile.org, *.firefox.com, *.mozilla.org, *.mozilla.com, etc.

Any official apps can be uploaded by admins.  That would save us remembering to update this list when someone writes an app for flashlight.gaiamobile.org.

Comment 5

[Matt Basta [:basta]]

https://github.com/mozilla/app-validator/commit/c541ac30ff573e3aaf882f0bd81e5d3818fd36ff

Comment 6

[Victor Carciu]

Verified as fixed : http://screencast.com/t/YImx0h451