Add-ons can cancel uninstall

NEW
Unassigned

Status

()

Toolkit
Add-ons Manager
4 years ago
4 years ago

People

(Reporter: Wesley Hardman, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

2.50 KB, application/octet-stream
Details
(Reporter)

Description

4 years ago
It is possible for add-ons to hook into the uninstall event and disable event, then cancel the requested uninstall/disable action preventing users from disabling or removing the add-on.  This can be used by malicious add-ons to "inform" the user that the add-on is hijacking the browser for their "benefit" (via popup) then prevent the user from removing the add-on.   

This is now being used by Conduit add-ons (note: they are not preventing the uninstall, just displaying a popup which prevents removal/disable unless you hit OK).  Examples: Bug 902569 and Bug 902578.

Expected Results:
Add-ons can be disabled or removed as requested by the user.

Actual Results:
Add-ons can be disabled or removed only if permitted by the add-on.
Wesley can you still reproduce this issue? If so please provide the addon and it's version.
(Reporter)

Comment 2

4 years ago
The 2 bugs listed in comment 0 have attached add-ons which will prevent removal of the add-on unless you hit the OK button.

I will see if I can create a reduced test case.
(Reporter)

Comment 3

4 years ago
Created attachment 796713 [details]
Proof of Concept addon

This is a proof of concept that demonstrates preventing the add-on from being disabled or uninstalled.  If you click disable nothing happens. If you click remove, a warning message is displayed, and the add-on is not removed.  The only way to remove the add-on is to delete it from the extensions folder.

This was tested on the latest Nightly 26.0a1 (2013-08-28).
Status: UNCONFIRMED → NEW
Ever confirmed: true
You need to log in before you can comment on or make changes to this bug.