938223 - Add validation for common GM pattern: sandbox.__proto__=sandbox.window

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: Add-on Validation, defect)

Description

[Jorge Villalobos [:jorgev] (he/him)]

This line is generated by the old GreaseMonkey compiler:
sandbox.__proto__=sandbox.window;

It no longer works in Firefox, and many add-ons are still created with this compiler and submitted to AMO. It'd be good that we warn against this, since it will generally break the add-ons in question.

The message can be something like: "Invalid sandbox usage. We recommend that you use the Scriptify add-on as an alternative to generate a userscript extension."

Comment 1

[Matt Basta [:basta]]

Rather than creating a predefined entity for `sandbox.__proto__`, would you say it's safe to match (via regexp) the exact snippet in comment #0? That would be the least invasive means of accomplishing this, I think.

Comment 2

[Kris Maglione [:kmag]]

I think a regexp would be best. Something like r'\b__proto__\s*=.*\bwindow\b'

Comment 3

[Kris Maglione [:kmag]]

It's probably too late for this to be useful.