Bug 1332061 Add warning for unsigned extensions
MozReview-Commit-ID: JAvjmh0IgBW
--- a/browser/base/content/test/webextensions/browser.ini
+++ b/browser/base/content/test/webextensions/browser.ini
@@ -1,25 +1,28 @@
[DEFAULT]
support-files =
head.js
file_install_extensions.html
browser_legacy.xpi
browser_legacy_webext.xpi
browser_webext_permissions.xpi
browser_webext_nopermissions.xpi
+ browser_webext_unsigned.xpi
browser_webext_update1.xpi
browser_webext_update2.xpi
browser_webext_update_icon1.xpi
browser_webext_update_icon2.xpi
browser_webext_update_perms1.xpi
browser_webext_update_perms2.xpi
browser_webext_update.json
browser_webext_search.xml
[browser_extension_sideloading.js]
[browser_extension_update_background.js]
[browser_permissions_addons_search.js]
[browser_permissions_installTrigger.js]
[browser_permissions_local_file.js]
[browser_permissions_mozAddonManager.js]
+[browser_permissions_unsigned.js]
+skip-if = require_signing
[browser_update_interactive.js]
[browser_update_interactive_noprompt.js]
new file mode 100644
--- /dev/null
+++ b/browser/base/content/test/webextensions/browser_permissions_unsigned.js
@@ -0,0 +1,44 @@
+"use strict";
+
+const ID = "permissions@test.mozilla.org";
+const WARNING_ICON = "chrome://browser/skin/warning.svg";
+
+add_task(async function test_unsigned() {
+ await SpecialPowers.pushPrefEnv({set: [
+ ["extensions.webapi.testing", true],
+ ["extensions.install.requireBuiltInCerts", false],
+
+ // XXX remove this when prompts are enabled by default
+ ["extensions.webextPermissionPrompts", true],
+ ]});
+
+ let testURI = makeURI("https://example.com/");
+ Services.perms.add(testURI, "install", Services.perms.ALLOW_ACTION);
+ registerCleanupFunction(() => Services.perms.remove(testURI, "install"));
+
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser);
+
+ gBrowser.selectedBrowser.loadURI(`${BASE}/file_install_extensions.html`);
+ await BrowserTestUtils.browserLoaded(gBrowser.selectedBrowser);
+
+ ContentTask.spawn(gBrowser.selectedBrowser, `${BASE}/browser_webext_unsigned.xpi`, function*(url) {
+ content.wrappedJSObject.installTrigger(url);
+ });
+
+ let panel = await promisePopupNotificationShown("addon-webext-permissions");
+
+ is(panel.getAttribute("icon"), WARNING_ICON);
+ checkPermissionString(document.getElementById("addon-webext-perm-text").textContent,
+ "webextPerms.unsignedWarning", null,
+ "Install notification includes unsigned warning");
+
+ // cancel the install
+ let promise = promiseInstallEvent({id: ID}, "onInstallCancelled");
+ panel.secondaryButton.click();
+ await promise;
+
+ let addon = await AddonManager.getAddonByID(ID);
+ is(addon, null, "Extension is not installed");
+
+ await BrowserTestUtils.removeTab(tab);
+});
new file mode 100644
index 0000000000000000000000000000000000000000..55779530ce60de67e342d16e84ebf0b3a310703d
GIT binary patch
literal 12620
zc$|H^WlSAR&^CMy?(Po7-QA_QQ=D>eDDDmicc&D0ch}-p+}+(>i@v>|=f{`4$@}eQ
zc4x9XS2nXhb~d?2MII6g3jhGX0f<Ai<gg#CTqplo_CNpt89)TEHL|lZH*<Dj{^4wI
z_e}#H07(!~qy3+_dLROTP!Iq1{g1nA?8J|LR;1x8PlN&!coe3Bu<S<&??BZ^i;9TU
z?plRm&D+bQB+-^$m&6ZJ5tpmvKoEsN!r4J+2%QvfnZ#DKCB!HYU!Kekr-EKgTR+SO
z@t~di170Y;b_sSS-O}mNRMEPg*B$!H>QiI&{>OASp<>v*)FxrpDBKUtJ2{FD^8NU`
z=lOQUdA?Y(-IUjWqyYwvyP;`@)NpJ19NU=NDP+U=m1xQXKd}#z)E^T*1TZPV!*nAi
z%+L~!%S^2kn<uEZlj*x8k8K$p_A38^f&loh{TGx@z5OC#769Nsf%_K}D-(M=W(PZq
z|G#)ds3=JzBM|%tf-EZ|srGLc{ZHUv{*C2Uj++1g0-KeDgo><$1euDHy}6Z*835ps
znU&(Mp}v9>Hr2_~sgj5mnLKT6sRki~+$od5OwR_7Cf5@Wpx~C&aFA3@D28LF-3Av(
zB-Bwvh5%LT&Y<um=N%oe2vcNDtMIpedtOasY>__sS?6?4ZCG6SF17>W--4j~6tv;N
zNO{^=J4b`zF;NyESRm3h0MZ7q?a<I5j`RE#A`QZ4Ioc)-^BK3Z9fj=gEB%~EbT8mD
zC%H|Bf(@XO8hv#8yrPefJHjiZl}Xj2Jd)bXsW{0hH%Xxr$gY{>e9Nfk^O$Ca%6G>e
zEQmkmJh^Ljy}wSg7sH3q6`cUW$3233Ze#DFHVJZ(4HX@--><{>QQ`*BCayCdI;)%7
zFqtIMvIjElc>=a&MhvfKS+vKeFvm~_C&zV}F(^yI@u~IILt~OKqjsjI6px|?$5~N$
zV!rIMEvMn@5bZbt%%|RTusm(?>nQ}5dHHx*ZJBJlXy^S6-ZB!O+)};=`(NTql0Nr8
zYWbxh18R%SnpR%IY^|^X24_H(j`y$$5DOr(zRMNG*O8>%=eyd#E~5oQ#rnFwJTS+a
zj^+63B?rY{!q8_*t!v}zz{uk+i8s-OP2xL`ow--B<iMZFU5CF&hdE)-q_7{ZBsl1A
zlwIL0$x@PI#R_B!DNTBRFvFqK#6v}&bJCwt`#%a-+EOA`pV6mNv>}Sf2}J!!0JQYz
zWbodm4AWP>h(pqle<z}5(o(Ztrvg8GwOSQE{@_sh$C^k>vbSQWPM)W~=|XUl0i;AB
zPelojAu)TPntRY&0jS%M5Ms39P>vwB?Le$}pd=YC7Pu)FFFCLZL{kdmnv2dE#O;9R
z5@52;$qUOIFb0BJ2dc56WP|Ch5ynN)f<ykGVXK9?kV*U@st?hQC)|gGmOxh_N`|A7
z5SM|#7Cp;VD<vuqJ<T&e);p$kA!r96OSI&wT4KCld%=ETg)i>atwpziZU8Cs!o>#T
z_KsY$^O7<Lw)FgTfb>DT3|8*{wT-TgAQDi54n{-g&yQk7$Laejp5Q?Vk4|0@k5LF=
zCAu0<Qb^hsDU(q0M-K}|N{UTIAsKO$6gy-$KP68ykGr5;6;>syRCxZ|JnavJ2Xw`+
z*7*}Nlg9uTMt=OPDCVzPxf#>M#|_8m_q;FIFhO}H(QL7J{t86Y*bNX3_zi?}v3w!;
zL(xXXb=sBui$rIU$b(L`#x`ut2;OMk7~aqVvA#iHc3m8rc@6aimBJYYzHRF|&^Ty0
zV7B7_#@Ix=ibfs0yB@nSd;aQ!>IWwhn?p{E84X_@EF(^D#FUpf{gqd~Ro+9465}CU
zX}}>L+#0GaD<~<bOhna1r7B}i$xRnPNp4GiL6b$XLD5N;H1gFH)k#oCVN=|WI){9V
zrdu_aUYj0@_8Lo*VV>57USHLtI9!WU<6c9*GPOoK&qLBt=B5ne`-n_L)qtvQkw$@w
z#!2XGBm1|NuY4MO5}plCQMb?s(pZdx;kyz$s*$v>v=+1`8o}ktX6kM8uJd0{bxwJa
zB{+(qr`4>A8tpBE8tJejBeUch<+9~sMjf%~i1P?%AdgS(*<XxaTwesfF@011)^$p~
zz`ejwUbApm>REcTAUD6d@O6H(jAPz+er~>{%)M-DPSh&ZD%g7e$N3Cz#f=M!ZR{A)
zWo9B@*wOl8FxLd<7fvn9%Q>Ry%*ENo+qu!%@>%|Z2aSyCi@dDzPKnpx$3m2E!-~?m
z4H8F%lO~}E{YeRvrKb06#V%Z~@2*ts5A8wi99~0Ss$L;p7hX^I@Gp$-l<&kZoiFMz
z{4nG&&@fdnEyy>ajQv>s2BGhvH8IgK#?jn(uJ}Uinj9#slRS1@UDo2<jyyW%vmmDl
zER#`oMUD+yuN5Tj1|E5~3N}LaunFRE=);bQFs5l7B^>c6m?%O8jJc$=ejBq`-C3p}
zCPbzV#vC1d?Lj@;hSQc8OI!OayA4a<;ZS2tOLfaRle>zlG^VBIp~qGITm7xJiX*ov
zUpouC;g&TM_qpsJq{iL7T}vN9K?Om7@+ORCXL{IX>K1QcqJ|JmY|XRW#RWY1s@(Vw
z?-y5kb<Ta3|Kj2n%csjnjTLwf-96tC9L2PqwmIpa85G$ewMe#f+Nrr4xW{@2y+We;
zqGn4c4F{K$S(G1%O<8<j{7zAWQnO@Z@hJC5XFsqu)iK~b9kz>kpnl=Jr8UK~(z4(_
zI<;vZvPI|L=pX;d{YePa1+Ie+!DXVuJwF3{#R_ww#TLX+11AEddWFaxWI%r&<2&w<
zj}VXCLjtG4(-(P9ebN0XA-<%s@TiD2@cwv4n5t+q-Qaf6NMH(d4Miu#7{!%jnxt&L
zR{?ebW`0J2;jqVW^016am9f^)_sF?$%mLS7lf8nyjNKC47smBA2f<$9Jl>rbiajaM
zC}ze*?aZ#{XN*CrOe$%NnFzKBrid%PyiAzM`&n>NlYB|5%_Z|CW;U!ntbO9uD9e#D
zWgGQR8X-A1#m#KNwB2mAgj<as91X<ml9!UjqAn#w#kHJAIw9&#A;@0|sg4>l=*94_
z>`feZ>|qV#4Ur9nW0}7$^tq`JFu2SlR-)=V202%z=D`D!_21dk_fpi8?x=bApJcL~
zvRUmxZ7a8mV>GwEcirCubbAeE^m6rTn?Wu`N24#_rpt>eytK}0n01A^hU_N-nu43G
zto>;lnHgDp+L+A^loK>(((~&c{Lb{Eup^}gdAM6`O4q_yX_t9htuBkp6-nhisBq=0
z<Qe3)><{g_o_|hg{WSDlO>8u)9nZ6w(j3>^Sv*@?Zy~1DVxD3lT_dUQbcQvN9*O-W
z@az1yijkITOH{3Vy}T~I{)&N_N>kIRudCdHOpKPIca`}?@#<2CXGhKX&GMXP$u}+C
zC%YQZ)r42~%Op%eXryndFW)N(_g9`r|B09OHrax*#*==(9lw)+a7f>Y*og_IbSASZ
zhl)biTTox`*p`R?+{Tbig?&lOFA|6_$}kfDjOUAoez7p`xZ2o8UyEl0TiB+8Ld;YB
zO}>Snvs4$cXC%S|9*r%-MJ0RQV^>e4b3&TV`Uf5>@O=^am^n&^Ihn#gT~AL=_UBAG
z<-M*lBZQo*Sbp1I+f1+A9r;XUojje3cy2zt)geye#(p<7IB(x~D0A-d%iV*0CFO@9
zh7kxO3TtN(Fu26e=JDB$eEm76)mf9>f#Yy7`{ylT=S+3Uep9BEymO@E@3H1f)lrMH
z-PF2{Gp=vTe)eo<<ZJp9p&#daoxv%YknpJx|23#LNWf&hjz+}n^WN|GG5KGk!Qe^B
zyDw|f!_>YsEF#~ZJ>Fy&lhR5CMHoKyU&r@X+`B#A*jcd!xIXmn-{xvE3`@J0KW8t^
zu3VPy-?i{-%)kHot?KW*&2(n_*^%mw$<cOIcf}x*>UaDX@BZepBw9Jg5ArGa?zM1S
zpAP__{39zVrs0vf;O*)2bD`<6;qkT0LYU@`C{Yxn4=vskM+{98ohct1yQX=eylQb)
zx2kz{QFm?i$Hjw}UR9Mu9X*Pa6k38O0!M%-TtK|%<VaeH`_;p{BZO|neEE~#R?Dro
zvY*AOMU6#GXQ)LD?z179A}l&ESJ~rkug3cGdh)YG9IQl^0kj<Ie*G2$5aR0*$-6rk
z`z62+8~{MdkOCR?5PSzD6}GO0QEEI<-t%a+5m+GrPykeLGEm4{EFQp2b1+Y>JBy2r
zWZ(V1LBN5>fiB@RJ;e@fG?&Z4OOll1IBJ-PMurC_HeCuhvlm-kFTy)@BNs7}q96*s
zS`aZg(j$ylSpb`gW-6mKz>fo(;is(v?(I=0CkaG+xDWQtc!Yf&q;i`J;ubm4tOLmx
z_-I6-j1wjuSkaDO73LPZkv67!O6vh<YS-7?pf`=yIom%M59H;1psf~U--ok=+H62b
zDj0p7szCp55X*QK(%*A(=M)B%W#pe}Z0rOx50b3Kv(hMIh*vJ2*aUD$i=2wIMX6~b
zcBqta>Big~PIJEms&E=24zB13$hr598i{Yrj%x_PQs81{2y;}4kLfekdt4DQlUl-w
zG(HEj1Bst;Q0#ZWey-~xa=<T3^a4o+9=VvC6h=1alOYcdA{ui!R+~aI2l6;aR%Lof
z?Rc8O0vCxRR8?gP<#cMSWky<pj{-&O#gE6+n(xlI;<IRsc%OZv-Ko$>NVY=(jf~T@
z5YALzE#kzalp)2x#qbu9imoLH9V7CBT3E>d=Bz5HKZHcKnS|3ef{929F|bUajc1{f
zr!^FYFxyt3tKkD8YlW^_3nnB7r$;*oG6*Z)m}uNWzo_;CI45Mq2h0w0Bd=Jx&o0AI
zi1{kH?bjA4^i}AMKjg8y&;Wr+c;h*!sW_!UO8d-s0mk+W`2{JUUUbs(jO-wuL-69c
zsNOVcE-V;Eg^>KFSR7ZHpy5|x@&HA;%5?B7S6TAc#D`R0J%{EF|LLZfB!(;bE0O6v
z++RX=alhX|T6Z^Dj4l)A$<+C5q_=W+Ijv_Y0+&Qw^_+GMt4wt=t!c!}vc(uS=|@gP
zq!6Nzs1UNSu1b7+7f}J3=()RcydLzSMKMFAsi>xS@ez0fAYAHSo2Uj58{hl~M^BT&
zhXI;^T!5U>F$%X1yg3dii_+^4vO4Y`P22UKnwx~$f<hG!4_B6hm|3<z$d9<}CnuPh
z3N};l^hpRbw&_~;vade2CmS_N*6VHKu0sM@IX56Et}PsHEP&equ<$*`kRwpqH)$&$
z8~`$a6_^c2cTur*`BGGtHX0072oq09Mk1{p)vNo7Q=VRd9%Tzv2OtA7n_6;knMOPP
z9NZfpKpQoFwtdBjI&Sp0yl(#eTIE>p7E4ki_ejz;yKAlPB$!a&IxD4|%(4E{YtrFt
zacjfb{w5qfs0fTEU;SHSfy92lWz*w=HcT8%ZMIuiJ_`;6BS<Ie1ykCHEBFK6V{j|r
z^1CQnuCQ<<gf_qh&9c77=Yf;k;MGLmMtesUqgW<XlAEzMn15!@4eud<2Z#+!0*ay^
z#DbKbmYry|ki?<DQh4V2ON=R{w2bA|#~Ym>pT0C|#(>gm?D6^mrUkiyx9M;NlpHy(
zP~?xa3665!?JI5``?GmeVxiCiSDN^riHe;w)9Ac5+h9`Og6(by&=3@8*R<9QmemAq
z6fq@tZy^ZovJ3(dSQ@7n2(b(pU{kTh_uBFys;Fs&jB<sIZjGS4hg!rgT>?NOvBHBD
z0VHH-(`@;ILK#0-a>B_|!)u2V72&a)`P6B6oM%EGc(~j)D^y`5P#?ftQ7Y6RFFBUo
z3N0dM$ycY(Mjw<oA|8EMFqISV$yKs(OYmXq-N?}WXYH{{58smr;8-p|-|qU|Syi7*
z<+zpPfHm-=#=UL^PokCx~yS#TUm1CZGXslkc-zNvI?kwUKAA`ypKXo~kpWQsf?
zMn5TGc;-zu+e2g?d!amo@-cjzUhnu=(W%<K;z#*5msxi+A3ZZ;5A$lnX$t4Grnf1!
z{u`?~IOp8=;kqbhpv-Y=!j1c?m%(sCE5JkY?Qh7>TAeD|Q3g#e=^vP%5A%ClTA?NI
z0Vv2|!KKrjCh%A_#HlZwB4OCN1DbgwY=ZSrUf+7aF%Wq}?13(Y^LiZ#vKY2j0Ify4
z=T*~0xfZpmi+0`YE&=;0P?RIlFDMB`{NXXt>D$<4s62uF_vPDhXFrQ?W9<gk&UdhD
z#v4k4Hw#au8w0kx8UEhs1YhP<sPoB+K-5riw{}AUXFmD;q|%`@*dL<d%9&p9-(I=5
zu#@sE=+Nfz-Xh9a;UVBaN{8qC9B7D;aJ|v52{NfFI50;=z0PwkNV=Vn8%*Eh$*xPJ
zV6mZnxWFe84+2}gldFoy6X{6v^N_^@H|_7DTdH7A)-lS|$l&^thQ&*PTenEA%MO!&
zudG0<nE{!gZ!=Q0XuD9Hd5n(SRnd~k$<<Q<za~o50t6><ah(peUFSOv))6iw8-Uu>
zHcL6D(<Qy2qd`PR%6C_v?qo&e2QV9pY#K(N3z{!QgH|37si*4z@5g4$-g5I|0DMk=
z;>-KCtzN)sP5y{E-~+AnENefI)RzS7Q7i$VO{FNxDq%&Ck=8c4Nph^Oo>X^q!r(r&
z(FWRdUO04A&Q?WGv~2Ws$1YY*k6u8<+D@0|*?E82dmhT&dw!RA0%E|q0P_IO)41r$
z-S;JvmzTxvd4%Ic-$<#!Bc>sMp5A03_OQyd_8+JBz)rT=exvJNf^8!ng4;^o6IY6h
zOGH*LYfPo96MzehEV51Zmof^u?|veGM6N5u<@uHT_tKik019NYRJok}`KV5&g1<#p
zUk1vQUWeK*liQxgH@W^+!ys#V^CQ8|z!J9XY&2zDUqe2D2Hh=;N3|{`50>e8J&vJP
z3BCVaxtI3~RiT8x<AJ}(lp1k~wmvL8rppjCbrQ~EWsfDQ1yc<phtIy<YsbHJk%{&+
znb3|ftuMkuXnz=YFTaF&+{L>6IkXeS1eF0Ykg;O?>W$cFSO{1J%|)|T0wD2m0(w_g
zD&5_v%*~2Tg1l>qL}-0hu=mb?i97}z3|7Z;Bv{=<+84V<B*}aMwBF~prFsuO{F#^>
zB;L{wwea_X^by14YU1M6odegetDZL(TAw|3ZEZW2eD*F8POqHfAW_%Cj#N?)sDRCb
zQaI{)=TZ`cf^REhM+qUy2vE=FrYdubfv}2H>ofs@MyzYENq4^xIL(nfmL0A~yezr6
z;uHSRge@w&v?`DVf+kJluA_-G68K7zY=DtxuUqBr?>qb0uOyI-ua8_M5ftt!W8c8V
z(nfNi@lrW`&%Z?;+X-97hm8@bTxWp|{h@D0HXChWY5Dm#Sp~i&$_r4r-U__+xorq}
zx70yrYNCrG=&#<qudC#AW+IuKT+3*tD9#F4<|UyhE!_T;I#>=XW9aIB%hAG2OhVQA
z{C`sVevE5t+rM&~6AK3}T6~6o>2M23?fpz9^ofio8=Yd@w)`=ZzolVWVeS!EASNHt
zjmK<BpM^v3=P*gK*Ony##HdZe)$=Oenc3<@3Hv#{xEZqdK*Q!c3xx)iim%3YKG~pw
z`E>7bl4mF~^ZRPMS8-S=b9sIVTR(!dGh6KSEJE3DT2wj*cXw6co1l}p<7we~ow<H|
z!U4_%s{M)rAU?~s=ZA6;?XS2KRJFN!sbR0E$d`Ca7;63SzBecRTzrk`<v!T&-uPGk
z*TB+>vjzuFD2lIMU%TdXGJnmiF3fRq7CdiSWFp5Y+;A~W1ZyX$!M!^TNlEC{-I$Uu
zk~WYhxD!(=XNStOv;(*+u%`hWqbikTP(Y;0wN~^Xc{vsSR=m(W4l6P``~~UQ-L~#(
z%V%}z!AXb1^Iw(=#8>&A3^&-{e{vbuJO9Z?WPzLKYB_~3DXQ=`Bn0*p-dJ5f#9$Pd
zPgjd6C0Oxy<Ye$vyLD1nn@4VFCS>egEuO=#5R2{}EH(0Iby4qS5kuzPtAofWSR4L~
zO{yjv@EX}29*`2<+IgO8zYTnmZwTvbrS$Pp^=#GBgo0S*-Ur(+uojmhi>&+bk$9fl
zAD^5`=|;jb|3XxggTsiAG^+d2`f1TU^daP}`tR}hIO9PLk`WcFuRf9EfCDsES#R}e
zX}Q!~UccJyu1?xDc2Q?y`|6(d-Bo1?@CW{ghPV4cMGS}~g`Zt;MlH9Rt5W{awSF{&
z_4ILnaayN!VKdUWJY~(GAYdb;TRvP~)0%q-Y97W42?-Qf)qZ8=!u#VOOaVE?OEAN!
zr$YQlSOx39@s{DOh27;hsC4$xRA7uBfs>&gH^x1Fd^#}Hf^f67m)ZIl>b>o@vQv*E
zE(cA84+Sj3<Bp0QDt7bm_50moPDSy77Y>gUN*2>IE#6CeN~lzE$MQY+mGHyo#JxFM
zf0uF0ix0&AJFoZ){r#;qyvs8D1H^Gu0~!R{BvkyK^w;0+dfmCdAb@IPEW#>$8j_>0
zg_pIP&GvmmJBu|NFCXrH^>@ejq?EL%ZgJ`q%5WVUig>hwpLs8)p;B|p*(Yknn>c!;
z+Rjg~o_d%|L^}L7lVw!y7xirq<C4MI%J?ujbD_}%Rd6^T5CxMJ!T3qxgNiaEBjNdp
zAt7|w>vl9<PgQzkdq|2rJv}Q^GU{SWT)&@h&+=<Tg5{YrgV!aOkd{)-ewj{u7i2LT
z*oAnXH%9g|&O~8*i`Y-OeFXMWgSL!Nz6;zOw|A4$^POMS?X+wy4<soq&onbAXSwg#
z{q*0^J3-dk{J><}FMfdb%r;K<3ZbWC-mV<C31wQ?F1(;Y1v)v!3)yJP>D&xp2dSIC
z)9|?-wFkzW8R9=S>uQUPWx6=gx#CeHOz=MHu&Y=&?}^xT0qt4{XHDVq8}wx762qX?
z*ahu)M&+Z7(&=U8GTB;yXh?Z`DP~K(`Dd942@x((bFD0S>yN5OW^vtKDG5iMqEsX7
zzo3HYlIr{xa6ng9_d2%bppQm%f1M`(aGqIvbdk0nG!{hTSj0?j31->bX><16ol8pD
zCb6$G0()^>{)P-`*TrMmiFQn-3Z~fmD7?@Rzu)K8mWX08vGs{k-!HbF1Uo+h5ASGR
zE6Kg8Z#{i2kBAymc_=tmqeX_Yj$cMhXh#&J7?XMTL`0!dXM?A%l&i4-Wt90dP~nO4
zIs4Lo8MSX(B|WX+Gr1W8pcsi3F60_?_cn;D7)bqSX5W@*9XQig>jSId!JO0iD+5s$
z^%f7+k%L^)>hh<?*`c$HhO33UD1s`UL}NU-{rpE*BLz6Vo6}UcS7Xguj~(}hE6G~g
z25qaghviQc0h!(DJE>b|4~a2*`=fNYo(W>1?8}u+OS8|9btgfuV~+e)_!(o|xixgr
zll2sg-iKED{H~1SrD+Ojsd>qP8%Dh!oeS}5Mlbs};lWAN@)k~BFnF1byuy$WXfZ=Z
zO$6ZseU;<M!HOZBOjn)FeCzci(tYBU<G@o`v`AnaAzmVE^msp93)QMnDFfTy*-p}4
z^ZcQ+qC5YJVxN;cF8>pj=vZ8T3!7m_p@Z<Nc??=rnR=1^apqX-?J13k)q%)-_==q}
zX0#eU-28BJbCsV^1GBPL=Qfko+H*|b&ui~@hef`4XAAmjzwKYzysnHg5VQLY-s#u?
zV57SmH4}u-;{4QCQi|htpw%d<0V_=l!pXox2>~tML!&oD-74rV<2{!?=G%GYt!O<_
zu@iXimDfxXJ%;&U2r_QL%%-ib+tb{rCPxoaX_a_#s4`KL@vM0}B+2Rz!G+Y7-d|4d
zUDx03pw2~mx@7WKP@!3hKSPu2)82c4M@br-LJe((&juClRJNgNS^(eQFRtF%0j)x@
z>Luwa7!$)(ch!)9%I^*6K~b<q1L5q!Z;qDYl-LB?%ZraF@n7TR0wog%F$2+}26s@Q
zR8*2<!bN(E69I6V6@!$(y{Q_T3rB%&%?-WofR$Rz5mt^ffH0$t%ODsXdNh=*qM779
zv>F-~7s}9ZM$lz6W|H7b<67@fBV4DddZhL6QvRzc`XZdbY>7+0w+VX8R4ZYJ*Qfj)
zYPpIR>)c@R-QsA3S<q#t_unO)$qWglu!|h0;GK{I09cz62;OlMsI#8(OP!TGs6`ks
z!4O9?jb<}C_k3Qd@e7keWKQJHz@D*GfFq|(P+_eM)aq>4<ReDu+G(fak1%yxUfi@0
zbldup^@^(CY3$%>v<oJQys7mm?w752p;eZ&IIa%C4H!~}GBIrKI$dV8BA&fFFU~K|
z@PY`n!LriL*Ux9!2pq&by;=J*xU5Mc8L4KuDM%uefL}`Y3fzw%eiQ9ged#4O44OL$
zW;de7fM+_%o~$Le_~8_a22lx!l7P(USv2rAYS3kMGo@0X>m7G!WqMv4ZP8fhlGv3N
z(T^S1pdrhHQA&{NW(m~maz-6@sI{1Vt~)+IkFN2%dUqG-h!Z+h>aMKj_5S;ueQ8T`
zdiuFb<C&TmhCxaZFW79}a{|N84nIFNPdWv1SG|nSiDP|SCqpT=N5yuQ#G6kr9-Ouk
zO69D??B*53^A7bkI&;Z)+j}^+iQD_dlNm>t;um5DL7xzgNZv@vGx0_@h#3^mX$x@h
zVDxy+LU!OiPvx+thxqq%qT_bWZP!%D;CrpB!wzbwZaZi`lN$|-%x*@Rzg$~$zTVy}
zKg|A6uL^q-!rYeZ1{6B+uCmr+Ef=6Wpj)pZ#@A!!B-i>vI4hy0S7-g={%T~?YyX-4
zvgs~8knf~esbDS3J9AoVa&pjAN_(@Lm(}lR=|ieiO*_zH@s4KL{Z~%%3p^SWoa`9C
zceH!;s1djp1e2=pyWtUXJck33yW$%R1^GqdShd&P^vp(7l!>tES2nh>16q-bKdglP
zLf#v_f67t<*apB?pt45OLBJp@%rVhJL{e@X1sRkWdz4t4r=015#-y8mm#@t7l`iiy
z9RXp~O!|PzZ&MVh&i(*Wg{`2PX#SY1YT{_^M-0J-?V7|J&s^gmej37eWdH!c039|K
z=nESwO0Stj9h={A=~;RgG3+PYyXV;S+WDSLFSDvm!EZ+Y^6J}Dr<)%j9?+XvXb_&n
zAo{E|!0LOB&xZ#d{HhyDjIE<i;$Oa#Cr~l#Ml~w^Hjqks)jK1}O|mou3epLWlI9`X
zvKgY<T8(BaxJ5%wBg6O{=<qcs7mXLCBp8ZNN0w{B+kI>M<-=gptG>Qcn50I{5e1CI
zA+5eW!c9O>VH0Hro3nbv!k`Qn*hJ7?DrL659+`a9`uQzEf2}?Byi2>*zgHm=iK^+p
zYfL28(`_Y*VsmpLF(!wH5R(-qthllNUJ01v+;QVuxk8OF6nxP(DP?(vaFq*8cIwH;
z3ZM#(SGW&Jh6VVh1LBsz7f?v@5~o#P5(w5LOGJ*JA~wO%Jkm=(MZTp6S%#z?7lHW(
zQ`cSN1;3fz;m*Ith2Jk3AKuS^&=l0g!uPFS(`0==MiRzHCKgdi`0trlW&??=m7Lxn
zzp!7U(r`fmAz}DHVW=MgZ`Td)?H|9QR0vXPw`_XGVMp~$;8<ji=AaKi9XO0*?jf{^
zFQ-eJgnlntWdbSss_O#cEn$a%klFQwzu*18%NoHL<xU(RhO5c;1z`ta_g^^n9$g6c
z?PyY{9pM>(^FRRoKx3i-a*QJ<5pf^NpHTPeK<#1=R<-nS8Z6Ulu*o{ew0kkM`rB4d
zd^D#pYC^Uj$H!$klLR-Z&8-E_AVoaty!K~mk|BQqukT5coH+WiGnXDK4Ypew6Di3;
zI`}J8e{DwqFRIO7Wfg;<z(OPqhcZ|FQ<by%Op;H+;Wbr7QBr@k<sh}s>--Nj4u0x5
zQ7c}QW<Z}tj{=YR`g(wnvJbeObV|aLR<stqjk!>TP%w|Wuy5C{&fWj$nsZ044y;Ja
z8cZPL;IUn*1IHF`=~GWz1ggWUU55YWU0&z?3G{e<YqeVWCZjwBGJYq0!JSM^0|SC`
zK@`ZC#~Av5?ivNmkCP2BcxL(Cshb~Kc9bQjm$44hF2rRNp(7FThvOh;Br(8e><QA2
z%ZvzYgDRS$Ptx1A9B5_{@kSKJsW#-bkuvqQvYJ+jeit%#`QLq~jx|MCX=!vc_=sRQ
z11PWg(NG~1ERouaclPoN1N*JSlnq(@K93Ej=a$0q10l38aMm5p3|yve?bQ{iz4F?C
z*ifPtPffv;0FCfGynwPFNRv4r_%kY_P6NfcuxvxyuIJ`SIxGp&+@5I{QJSG`<6MtG
z%#?MgSev*n7-7PHP@Zn!yzV%)i4i7Q^Pc|xu;IdIFG2b%(-R0qiAPDvfyFUQ2PAiG
zabsUznL*aTLhs@IcRdnZ(mQw1@d??HIvmCM9u6cB@9--1QP!XXe3TMsnhd2qWtQL3
zo(&epmmzbtA3<3%%8Cagd&8DIn_a(Ij?a9gm&J%osbnMwO2oyC=!+dlf9uDN;Ki*B
z2C<nN;{~J|Ax!=pq{20^G7I`6(zhOsY!V0;r*nL0q<;6jOdg`Mgw&t?%l(VGtI<15
zJ}f63#PUJtyIwz=s{yL+$0m5M03jd**Ju+B_p77{oHY_0v^o5&;%o*L%0}(CGws$l
zmW8Kv$IgPHy0F(5?-BEcf`$%6CgO|b`YMF}QF+JV2_A9`S)_B%o@uV<K;cS{3q^hB
z1G7J4W8##SeYoet@-@}FHJ`&=zrDA}+dM`RuV6ccx^X4bcUynsA+i$UV)UomkumU~
zhWu@#WxV}T%@NEl#+nz5eR9aQ>Q<V7%2hq(-Tit`hFYeVtqZ7MMMtESlwd0LEFq}5
z3RfKg%i;iAS0GJ@CB~4+bp`PsYn1!UxQV%CSScJrjN`dOXQrdnxA=_=8miU;5`NBo
zU%7r9t$=npall)x7J_AKtVBA|VWu>uzVtp`0*!dw=e?pM4TwtC>T=pFw?p=a{Vbpr
z!R=K+5{Kg@f_Wt34HT~Vbu=YF>hJB#wc+(@urz#egDs)kVAaYv@j>$G!VGehtNjK+
z^pz86DJLEeB^D45rXW_5hrmM3FF6a>Txh)gfQPo_V-79DD)GqVZLc8c_N~&)gmEC~
z!GRDulFk<fADbX(>x3+qT3o-dlwaRAbX?yS<5aq1BvTtz+DccYvHnR89#W@Ka({RM
zvAJAcAd4<BIjmm5d6=-8^c0A6qYC>2GFr5HPZ}W<;6n59R8<3hSL#DaIKt%t$)JK9
z6^IPsGdAR6VlK434vJ29azw7BzvL<3XHa7fzv#~F^PtyDqQTJ(7~{Y#_7+O?fdf&X
z8N%`N;MBqDBS`|nwl_X<g#w@vrJjVtp3U+gUYC57vSHawt0!_8f6*Q#%D;&d2<5^^
zfBU!xTF%9dztJeYJpwdy5Y!4z3zZfQcRbelcM`%#+f8H~s}m8tq_uEw@0>)_Ve;T9
zO%pvzX;~!VT2RGJC>1cdGmux((!!~B$;4E~We<PB&D8c?-#RrmHYcR1yj9sVI)4}b
zO#G$GD9w&xl|8_AzKSQo3JNnflYwL91Z}H9;`RfAe@58a6z#pAeP{SsyZT=IpnO4I
zQ$xI#V++1A2<h4MKQEYtf!GHSLQjhd^@_&Aq#FgA@egE!Lsp4NY-ip=)-=2Bk0R({
z7S>m(-7YqwD!QHUja4~TRB{0s68*QYexU~~{+NRyp79vRClBI0F1+WDz)^3qaaDFs
zegn<le<%5|km-8{;J+x=@RYLXy6r{1E>^egd~Js}JDet;W3%wXbHrqYn}+E#cDjN2
zXaG;R;jOtZfeaUZ9A(VskeWSOU_503FxX%QL>}S&8jHlq%UZW7@v^8rm;y#S`F$=G
z(#-GH|NfaG%`CMx?E`j}H9?!uGXSAe)x=GR+pF`oaD&%QwoRIvew(c+?VFqRX+#z)
zrAu0fudO7#1wb*OYvFN}V}K=jvF2oH?^3L*4czR{PJV6L=(V_+YE6`>5v(Q;{-ttE
zy(zqavxJPPfij0|FM<`K+3HF9=4P4C;-VXYDH$D0xeKW<-EEVs0f~!_W<1@?7#Fye
z(eQS8wV|h~J5F<^C&h~)M!}qrm4z~aCeyTrejFDRj)o8ntjH1!kt!sz<7HQyc4-F^
za@!B}LEn*4<uHvFX*jf1g3L2{zr{73@#IaNg&5%#5)vF8q3CXEwD?ybKeB!)hN47=
ziL4DE5|ejAM~ZjopVbZHzb`-ygu-GA8ca*V0(^cgq2(Y8M!OEtuoGKZVliN4@jl47
z8vXbHQx}PI5)6i3==C7r2|4lN7}f*0863suPWCJOh1yRCOY{n?R_IQA^Pbm+;{?})
z&F9}j?hXwk$lyc&xyq$uzoHQLCMk=c_D|PY_6m+?vg2pFgaJh3K6h3SFMaLRsgrC>
zH8le@z-3riY)A%T^gsi2C`153p$u8dIMLMMC#iM9-^zdKVWyj=5{+CGOdLI-THirX
zRKl){NiJM43!a#~wZNj?GoZ!qGwgZh$<AVwHg}}!GQC5I=l3c~%dleEi@{6$>RHAY
z<EN2!>*8-nK_XZoG=s73TWirVYwp`?E$iVodtWIqB8=9m>4}!LhJP6f!#2^xk}hy5
zTc>eH?$&{)bAyRP4Z<Li5ZE~7iAG7nqJeU<P?Y__fiLqvF18@a@*w?i#S_3=Ck}y_
z+rjXnGEiU03tNToboijYFoc1gvVRCZU)$H-H?M(OR-lpk?ReB|(dWw5M%WK0H%pzb
zCd-ebRr_s}%=%L<z8zmY?aqYxhkL9KTzy^>p<LOCSGz)?aBEgLVoD!ZXm!83=dFyl
zOJ<p&7q4N!K@(2TG~&LdGqLKr@~VZJ7`MUF4N}oQoDaezg5cmvm5oA$1pt!Umf&r+
z>Dh(0Psw+>a#}(KuHn<`(F%Jp4)}J7;p@9m$D2w-HmhCBb<Z=V){B1$h=ur99V<C{
z^DNoFvUw1?SKepMIdbcMd*MUHU$K$G2J5YBdM<roulN1CB6m)3K`YT`wO&&Ux35nI
zHTKJmO>GyZXX@vgjf;9TQ^U(K8^<Sz<mh^FPYEG5065aV&BvQmOIxX_X}sO<!fQ}(
zBe(WC014S0GM6T<nwPV&8j-iLFu(Z6Q3m_6F*#;*D(J!E)3c#w1A*)5*x}l@4xYPY
zE0e+T#K4|fcTJ-BSQkPn88$e!GD-BdG6${xJYUz6uPQmH&Mc|1@37X_M>I=&?ITa%
zyyuv5i~Zj<vGb@z<w}B2Z-|C1_>-5VE#H=Rl3`WXx^S#_0+Uu}Vqr4P0m%U_lIYP7
z+Y|jEw84RWG|sb-XD?R(0GbROGPLI`_Dt8`%kq{FG^D@d%@;zuL(qokk$?@LPpuUx
zN=1L`-rCr63|EH6+pRol*U+KWahyOU26r<<m?J^;7x$5rE<WXr?z0XpL;Hqyq;=1y
z{^T^gF*=>V{#ZBL(Mq{<-Hy6DtvC@!`5s$eL}FqBjW>m-qm}mTe;M1ev_jT-?Uz8f
zIcfTlxUp_oV^(e1h-Pl|W2?8lT?X8@KHTe*7a0S=wnM%q$1P?Z=hkno_fNEOV^%-J
z3)0)YCW@@!H3JpU1gD#j>03`&j6V-;tDF04e%}m*hN{GcTT$Az|D~tTCd3UgC(!*K
zn&5H#D)O?%;(xcTfFIi}Wne&HdTw)80TVMtI|(Wc5P=XA1(3y(v4cKyl;V7qD5A*V
z#BcBpWRV%)51W2{wBGk2h7meKW5W{JA(|^?M-OYhF~#5hi8J(IP3K*PM75eN=IHpX
zoIb%)lk0~*L+?>6N0_CV`i^LCwwgO1%^7vb)!)Pw)>37?{C4h<aWvgEiZHz?M1Z-^
zcmKS8+Xf_K1x;a=m9>{!+ABF0nttCQ;4$jmt|uQvFEf3Jy^t<wa#fC5G~nvyz(7Pk
z8R1#}%An!%B)9V0n}h6@^{WAu8k2iD{M;GZeK2_ltW`0J_m%wabl$g9l}7xMRI>RJ
z&l?tc!y#K|0#3zZ*$8m}H7Ej5j>vjJ$r|pe4_m}EtHy#yU;p)E=G?=I$=mxAC4UBR
zl=tVE*uXoFEDE}|HW+0j)R*;WtY*gF&gZ9_7nc;}=Yua}j(pd)tuqvbjEwAeiXAFr
z)<IaGBpma>&hQ4Peg2h>9dVo(Z@y_m=s*-=v($hN6}5dMCZ+*)9I5enGD)<ZO_AL4
z_6#n=dR5U^QdN@YK0qcitHOAq@cpC;WD_>96zBjE&Ai}x3k7GyD(H|4EgXy{pDB8t
z3crZB%{WaqK!47cYZBN3)8tZ3c{mpTxkBhHa{C2|3_F*#2i_+&Z9D{f4iKCWHlnT1
ziC`t=ZruM!PXtDNKSDAxTwMRCkx2|kcMwx00Q3OGag?QEKZKP={hqbOKjP>=Kl9&e
zSpIwh74XRzroFH8{$tzAN-0TJi-Q7H<be<*kpHi;1ib%Y=KoUxg#rI*|5uR$^#79b
t|1U!R|3d!1Nd5l{3HTpK?0+u*AI1Owg$Df}ksko@um5-QpRE5`{|AU%&5i&7
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@@ -36,16 +36,18 @@ xpinstallDisabledButton.accesskey=n
# LOCALIZATION NOTE (webextPerms.header)
# This string is used as a header in the webextension permissions dialog,
# %S is replaced with the localized name of the extension being installed.
# See https://bug1308309.bmoattachments.org/attachment.cgi?id=8814612
# for an example of the full dialog.
# Note, this string will be used as raw markup. Avoid characters like <, >, &
webextPerms.header=Add %S?
+webextPerms.unsignedWarning=Caution: This add-on is unverified. Malicious add-ons can steal your private information or compromise your computer. Only install this add-on if you trust the source.
+
# LOCALIZATION NOTE (webextPerms.listIntro)
# This string will be followed by a list of permissions requested
# by the webextension.
webextPerms.listIntro=It requires your permission to:
webextPerms.add.label=Add
webextPerms.add.accessKey=A
webextPerms.cancel.label=Cancel
webextPerms.cancel.accessKey=C
--- a/browser/modules/ExtensionsUI.jsm
+++ b/browser/modules/ExtensionsUI.jsm
@@ -139,37 +139,41 @@ this.ExtensionsUI = {
// Dismiss the progress notification. Note that this is bad if
// there are multiple simultaneous installs happening, see
// bug 1329884 for a longer explanation.
let progressNotification = target.ownerGlobal.PopupNotifications.getNotification("addon-progress", target);
if (progressNotification) {
progressNotification.remove();
}
+ info.unsigned = info.addon.signedState <= AddonManager.SIGNEDSTATE_MISSING;
let strings = this._buildStrings(info);
+
// If this is an update with no promptable permissions, just apply it
if (info.type == "update" && strings.msgs.length == 0) {
info.resolve();
return;
}
+ let icon = info.unsigned ? "chrome://browser/skin/warning.svg" : info.icon;
+
let histkey;
if (info.type == "sideload") {
histkey = "sideload";
} else if (info.type == "update") {
histkey = "update";
} else if (info.source == "AMO") {
histkey = "installAmo";
} else if (info.source == "local") {
histkey = "installLocal";
} else {
histkey = "installWeb";
}
- this.showPermissionsPrompt(target, strings, info.icon, histkey)
+ this.showPermissionsPrompt(target, strings, icon, histkey)
.then(answer => {
if (answer) {
info.resolve();
} else {
info.reject();
}
});
} else if (topic == "webextension-update-permissions") {
@@ -293,17 +297,18 @@ this.ExtensionsUI = {
}
}
// Now figure out all the rest of the notification text.
let name = this._sanitizeName(info.addon.name);
let addonName = `<span class="addon-webext-name">${name}</span>`;
result.header = bundle.formatStringFromName("webextPerms.header", [addonName], 1);
- result.text = "";
+ result.text = info.unsigned ?
+ bundle.GetStringFromName("webextPerms.unsignedWarning") : "";
result.listIntro = bundle.GetStringFromName("webextPerms.listIntro");
result.acceptText = bundle.GetStringFromName("webextPerms.add.label");
result.acceptKey = bundle.GetStringFromName("webextPerms.add.accessKey");
result.cancelText = bundle.GetStringFromName("webextPerms.cancel.label");
result.cancelKey = bundle.GetStringFromName("webextPerms.cancel.accessKey");
if (info.type == "sideload") {