From 18908d2f06f7781f157c347dde1c3f7c9777c766 Mon Sep 17 00:00:00 2001 From: Fedor Date: Fri, 30 Jul 2021 17:05:20 +0300 Subject: [PATCH] [Basilisk] Fix error when installing signed webextensions --- .../basilisk/base/content/browser-addons.js | 23 ++----- .../en-US/chrome/browser/browser.properties | 1 - .../webextensions/content/extensions.js | 33 ---------- .../webextensions/content/extensions.xml | 16 ----- .../webextensions/internal/XPIProvider.jsm | 63 +------------------ 5 files changed, 5 insertions(+), 131 deletions(-) diff --git a/application/basilisk/base/content/browser-addons.js b/application/basilisk/base/content/browser-addons.js index 733114ba99..0ecfc32040 100644 --- a/application/basilisk/base/content/browser-addons.js +++ b/application/basilisk/base/content/browser-addons.js @@ -154,25 +154,10 @@ const gXPInstallObserver = { let messageString; let notification = document.getElementById("addon-install-confirmation-notification"); - if (unsigned.length == installInfo.installs.length) { - // None of the add-ons are verified - messageString = gNavigatorBundle.getString("addonConfirmInstallUnsigned.message"); - notification.setAttribute("warning", "true"); - options.learnMoreURL += "unsigned-addons"; - } - else if (unsigned.length == 0) { - // All add-ons are verified or don't need to be verified - messageString = gNavigatorBundle.getString("addonConfirmInstall.message"); - notification.removeAttribute("warning"); - options.learnMoreURL += "find-and-install-add-ons"; - } - else { - // Some of the add-ons are unverified, the list of names will indicate - // which - messageString = gNavigatorBundle.getString("addonConfirmInstallSomeUnsigned.message"); - notification.setAttribute("warning", "true"); - options.learnMoreURL += "unsigned-addons"; - } + + messageString = gNavigatorBundle.getString("addonConfirmInstall.message"); + notification.removeAttribute("warning"); + options.learnMoreURL += "find-and-install-add-ons"; let brandBundle = document.getElementById("bundle_brand"); let brandShortName = brandBundle.getString("brandShortName"); diff --git a/application/basilisk/locales/en-US/chrome/browser/browser.properties b/application/basilisk/locales/en-US/chrome/browser/browser.properties index d83468406a..a14f84e3d7 100644 --- a/application/basilisk/locales/en-US/chrome/browser/browser.properties +++ b/application/basilisk/locales/en-US/chrome/browser/browser.properties @@ -50,7 +50,6 @@ addonInstall.acceptButton.accesskey=I # #1 is brandShortName # #2 is the number of add-ons being installed addonConfirmInstall.message=This site would like to install an add-on in #1:;This site would like to install #2 add-ons in #1: -addonConfirmInstallUnsigned.message=Caution: This site would like to install an unverified add-on in #1. Proceed at your own risk.;Caution: This site would like to install #2 unverified add-ons in #1. Proceed at your own risk. # LOCALIZATION NOTE (addonConfirmInstallSomeUnsigned.message): # Semicolon-separated list of plural forms. See: diff --git a/toolkit/mozapps/webextensions/content/extensions.js b/toolkit/mozapps/webextensions/content/extensions.js index 3159eb1e14..2dc27d7860 100644 --- a/toolkit/mozapps/webextensions/content/extensions.js +++ b/toolkit/mozapps/webextensions/content/extensions.js @@ -271,12 +271,6 @@ function loadView(aViewId) { } } -function isCorrectlySigned(aAddon) { - // Add-ons without an "isCorrectlySigned" property are correctly signed as - // they aren't the correct type for signing. - return aAddon.isCorrectlySigned !== false; -} - function isDiscoverEnabled() { if (Services.prefs.getPrefType(PREF_DISCOVERURL) == Services.prefs.PREF_INVALID) return false; @@ -2755,15 +2749,6 @@ var gListView = { filterDisabledUnsigned: function(aFilter = true) { let foundDisabledUnsigned = false; - if (SIGNING_REQUIRED) { - for (let item of this._listBox.childNodes) { - if (!isCorrectlySigned(item.mAddon)) - foundDisabledUnsigned = true; - else - item.hidden = aFilter; - } - } - document.getElementById("show-disabled-unsigned-extensions").hidden = aFilter || !foundDisabledUnsigned; @@ -3175,15 +3160,6 @@ var gDetailView = { errorLink.value = gStrings.ext.GetStringFromName("details.notification.blocked.link"); errorLink.href = this._addon.blocklistURL; errorLink.hidden = false; - } else if (!isCorrectlySigned(this._addon) && SIGNING_REQUIRED) { - this.node.setAttribute("notification", "error"); - document.getElementById("detail-error").textContent = gStrings.ext.formatStringFromName( - "details.notification.unsignedAndDisabled", [this._addon.name, gStrings.brandShortName], 2 - ); - let errorLink = document.getElementById("detail-error-link"); - errorLink.value = gStrings.ext.GetStringFromName("details.notification.unsigned.link"); - errorLink.href = Services.urlFormatter.formatURLPref("app.support.baseURL") + "unsigned-addons"; - errorLink.hidden = false; } else if (!this._addon.isCompatible && (AddonManager.checkCompatibility || (this._addon.blocklistState != Ci.nsIBlocklistService.STATE_SOFTBLOCKED))) { this.node.setAttribute("notification", "warning"); @@ -3192,15 +3168,6 @@ var gDetailView = { [this._addon.name, gStrings.brandShortName, gStrings.appVersion], 3 ); document.getElementById("detail-warning-link").hidden = true; - } else if (!isCorrectlySigned(this._addon)) { - this.node.setAttribute("notification", "warning"); - document.getElementById("detail-warning").textContent = gStrings.ext.formatStringFromName( - "details.notification.unsigned", [this._addon.name, gStrings.brandShortName], 2 - ); - var warningLink = document.getElementById("detail-warning-link"); - warningLink.value = gStrings.ext.GetStringFromName("details.notification.unsigned.link"); - warningLink.href = Services.urlFormatter.formatURLPref("app.support.baseURL") + "unsigned-addons"; - warningLink.hidden = false; } else if (this._addon.blocklistState == Ci.nsIBlocklistService.STATE_SOFTBLOCKED) { this.node.setAttribute("notification", "warning"); document.getElementById("detail-warning").textContent = gStrings.ext.formatStringFromName( diff --git a/toolkit/mozapps/webextensions/content/extensions.xml b/toolkit/mozapps/webextensions/content/extensions.xml index 3addc8e6a7..e9b63ea917 100644 --- a/toolkit/mozapps/webextensions/content/extensions.xml +++ b/toolkit/mozapps/webextensions/content/extensions.xml @@ -1246,14 +1246,6 @@ this._errorLink.value = gStrings.ext.GetStringFromName("notification.blocked.link"); this._errorLink.href = this.mAddon.blocklistURL; this._errorLink.hidden = false; - } else if (!isUpgrade && !isCorrectlySigned(this.mAddon) && SIGNING_REQUIRED) { - this.setAttribute("notification", "error"); - this._error.textContent = gStrings.ext.formatStringFromName( - "notification.unsignedAndDisabled", [this.mAddon.name, gStrings.brandShortName], 2 - ); - this._errorLink.value = gStrings.ext.GetStringFromName("notification.unsigned.link"); - this._errorLink.href = Services.urlFormatter.formatURLPref("app.support.baseURL") + "unsigned-addons"; - this._errorLink.hidden = false; } else if ((!isUpgrade && !this.mAddon.isCompatible) && (AddonManager.checkCompatibility || (this.mAddon.blocklistState != Ci.nsIBlocklistService.STATE_SOFTBLOCKED))) { this.setAttribute("notification", "warning"); @@ -1263,14 +1255,6 @@ ); this._warningLink.hidden = true; this._warningBtn.hidden = true; - } else if (!isUpgrade && !isCorrectlySigned(this.mAddon)) { - this.setAttribute("notification", "warning"); - this._warning.textContent = gStrings.ext.formatStringFromName( - "notification.unsigned", [this.mAddon.name, gStrings.brandShortName], 2 - ); - this._warningLink.value = gStrings.ext.GetStringFromName("notification.unsigned.link"); - this._warningLink.href = Services.urlFormatter.formatURLPref("app.support.baseURL") + "unsigned-addons"; - this._warningLink.hidden = false; } else if (!isUpgrade && this.mAddon.blocklistState == Ci.nsIBlocklistService.STATE_SOFTBLOCKED) { this.setAttribute("notification", "warning"); this._warning.textContent = gStrings.ext.formatStringFromName( diff --git a/toolkit/mozapps/webextensions/internal/XPIProvider.jsm b/toolkit/mozapps/webextensions/internal/XPIProvider.jsm index c952214172..b930574c0c 100644 --- a/toolkit/mozapps/webextensions/internal/XPIProvider.jsm +++ b/toolkit/mozapps/webextensions/internal/XPIProvider.jsm @@ -738,11 +738,6 @@ function isUsableAddon(aAddon) { if (aAddon.type == "theme" && aAddon.internalName == XPIProvider.defaultSkin) return true; - if (mustSign(aAddon.type) && !aAddon.isCorrectlySigned) { - logger.warn(`Add-on ${aAddon.id} is not correctly signed.`); - return false; - } - if (aAddon.blocklistState == Blocklist.STATE_BLOCKED) { logger.warn(`Add-on ${aAddon.id} is blocklisted.`); return false; @@ -1762,25 +1757,6 @@ function getSignedStatus(aRv, aCert, aAddonID) { } } -function shouldVerifySignedState(aAddon) { - // Updated system add-ons should always have their signature checked - if (aAddon._installLocation.name == KEY_APP_SYSTEM_ADDONS) - return true; - - // We don't care about signatures for default system add-ons - if (aAddon._installLocation.name == KEY_APP_SYSTEM_DEFAULTS) - return false; - - // Hotfixes should always have their signature checked - let hotfixID = Preferences.get(PREF_EM_HOTFIX_ID, undefined); - if (hotfixID && aAddon.id == hotfixID) - return true; - - // Otherwise only check signatures if signing is enabled and the add-on is one - // of the signed types. - return ADDON_SIGNING && SIGNED_TYPES.has(aAddon.type); -} - let gCertDB = Cc["@mozilla.org/security/x509certdb;1"] .getService(Ci.nsIX509CertDB); @@ -1797,11 +1773,6 @@ let gCertDB = Cc["@mozilla.org/security/x509certdb;1"] * cert: an nsIX509Cert */ function verifyZipSignedState(aFile, aAddon) { - if (!shouldVerifySignedState(aAddon)) - return Promise.resolve({ - signedState: AddonManager.SIGNEDSTATE_NOT_REQUIRED, - cert: null - }); let root = Ci.nsIX509CertDB.AddonsPublicRoot; if (!REQUIRE_SIGNING && Preferences.get(PREF_XPI_SIGNATURES_DEV_ROOT, false)) @@ -1839,11 +1810,6 @@ function verifyZipSignedState(aFile, aAddon) { * cert: an nsIX509Cert */ function verifyDirSignedState(aDir, aAddon) { - if (!shouldVerifySignedState(aAddon)) - return Promise.resolve({ - signedState: AddonManager.SIGNEDSTATE_NOT_REQUIRED, - cert: null, - }); let root = Ci.nsIX509CertDB.AddonsPublicRoot; if (!REQUIRE_SIGNING && Preferences.get(PREF_XPI_SIGNATURES_DEV_ROOT, false)) @@ -7039,32 +7005,6 @@ AddonInternal.prototype = { this.updateURL.substring(0, 6) == "https:"); }, - get isCorrectlySigned() { - switch (this._installLocation.name) { - case KEY_APP_SYSTEM_ADDONS: - // System add-ons must be signed by the system key. - return this.signedState == AddonManager.SIGNEDSTATE_SYSTEM - - case KEY_APP_SYSTEM_DEFAULTS: - case KEY_APP_TEMPORARY: - // Temporary and built-in system add-ons do not require signing. - return true; - - case KEY_APP_SYSTEM_SHARE: - case KEY_APP_SYSTEM_LOCAL: - // On UNIX platforms except OSX, an additional location for system - // add-ons exists in /usr/{lib,share}/mozilla/extensions. Add-ons - // installed there do not require signing. - if (Services.appinfo.OS != "Darwin") - return true; - break; - } - - if (this.signedState === AddonManager.SIGNEDSTATE_NOT_REQUIRED) - return true; - return this.signedState > AddonManager.SIGNEDSTATE_MISSING; - }, - get isCompatible() { return this.isCompatibleWith(); }, @@ -7909,8 +7849,7 @@ function defineAddonWrapperProperty(name, getter) { "providesUpdatesSecurely", "blocklistState", "blocklistURL", "appDisabled", "softDisabled", "skinnable", "size", "foreignInstall", "hasBinaryComponents", "strictCompatibility", "compatibilityOverrides", "updateURL", "dependencies", - "getDataDirectory", "multiprocessCompatible", "signedState", "mpcOptedOut", - "isCorrectlySigned"].forEach(function(aProp) { + "getDataDirectory", "multiprocessCompatible", "signedState", "mpcOptedOut"].forEach(function(aProp) { defineAddonWrapperProperty(aProp, function() { let addon = addonFor(this); return (aProp in addon) ? addon[aProp] : undefined;