From 86ed577b3bd71dafce97e9a0e7215bff961219d6 Mon Sep 17 00:00:00 2001 From: Dave Townsend Date: Sun, 2 Nov 2008 12:13:48 +0000 Subject: [PATCH] Bug 455906: Support severities for blocklist entries. r=robstrong, r=jst --- browser/app/profile/firefox.js | 3 + modules/plugin/base/src/nsPluginHostImpl.cpp | 31 +- .../chrome/mozapps/extensions/blocklist.dtd | 10 + .../chrome/mozapps/extensions/extensions.dtd | 4 + .../mozapps/extensions/extensions.properties | 11 +- toolkit/locales/jar.mn | 1 + .../mozapps/extensions/content/blocklist.css | 11 + .../mozapps/extensions/content/blocklist.js | 81 +++ .../mozapps/extensions/content/blocklist.xul | 80 +++ .../mozapps/extensions/content/extensions.js | 11 + .../mozapps/extensions/content/extensions.xml | 68 ++- toolkit/mozapps/extensions/content/list.js | 82 +-- toolkit/mozapps/extensions/content/list.xul | 7 +- toolkit/mozapps/extensions/jar.mn | 3 + toolkit/mozapps/extensions/public/Makefile.in | 1 - .../extensions/public/nsIExtensionManager.idl | 21 +- .../extensions/src/nsBlocklistService.js | 271 +++++++-- .../extensions/src/nsExtensionManager.js.in | 194 ++++--- .../test/unit/data/bug455906_block.xml | 18 + .../test/unit/data/bug455906_empty.xml | 7 + .../test/unit/data/bug455906_start.xml | 30 + .../test/unit/data/bug455906_warn.xml | 33 ++ .../extensions/test/unit/test_bug449027.js | 21 +- .../extensions/test/unit/test_bug455906.js | 531 ++++++++++++++++++ .../mozapps/extensions/extensions.css | 6 +- .../mozapps/extensions/blocklist.css | 16 + .../mozapps/extensions/extensions.css | 8 +- toolkit/themes/pinstripe/mozapps/jar.mn | 1 + .../mozapps/extensions/blocklist.css | 16 + .../mozapps/extensions/extensions.css | 6 +- toolkit/themes/winstripe/mozapps/jar.mn | 1 + xpcom/system/Makefile.in | 1 + .../system}/nsIBlocklistService.idl | 55 +- 33 files changed, 1401 insertions(+), 239 deletions(-) create mode 100644 toolkit/locales/en-US/chrome/mozapps/extensions/blocklist.dtd create mode 100644 toolkit/mozapps/extensions/content/blocklist.css create mode 100644 toolkit/mozapps/extensions/content/blocklist.js create mode 100755 toolkit/mozapps/extensions/content/blocklist.xul create mode 100644 toolkit/mozapps/extensions/test/unit/data/bug455906_block.xml create mode 100644 toolkit/mozapps/extensions/test/unit/data/bug455906_empty.xml create mode 100644 toolkit/mozapps/extensions/test/unit/data/bug455906_start.xml create mode 100644 toolkit/mozapps/extensions/test/unit/data/bug455906_warn.xml create mode 100644 toolkit/mozapps/extensions/test/unit/test_bug455906.js create mode 100644 toolkit/themes/pinstripe/mozapps/extensions/blocklist.css create mode 100644 toolkit/themes/winstripe/mozapps/extensions/blocklist.css rename {toolkit/mozapps/extensions/public => xpcom/system}/nsIBlocklistService.idl (54%) diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js index 1848e08ad2361..d246357762724 100644 --- a/browser/app/profile/firefox.js +++ b/browser/app/profile/firefox.js @@ -80,6 +80,9 @@ pref("extensions.getAddons.search.url", "https://services.addons.mozilla.org/%LO // Blocklist preferences pref("extensions.blocklist.enabled", true); pref("extensions.blocklist.interval", 86400); +// Controls what level the blocklist switches from warning about items to forcibly +// blocking them. +pref("extensions.blocklist.level", 2); pref("extensions.blocklist.url", "https://addons.mozilla.org/blocklist/2/%APP_ID%/%APP_VERSION%/%PRODUCT%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/"); pref("extensions.blocklist.detailsURL", "http://%LOCALE%.www.mozilla.com/%LOCALE%/blocklist/"); diff --git a/modules/plugin/base/src/nsPluginHostImpl.cpp b/modules/plugin/base/src/nsPluginHostImpl.cpp index 41f22f063ded3..0bc0d4f466195 100644 --- a/modules/plugin/base/src/nsPluginHostImpl.cpp +++ b/modules/plugin/base/src/nsPluginHostImpl.cpp @@ -92,6 +92,7 @@ #include "nsIPrefBranch2.h" #include "nsIScriptChannel.h" #include "nsPrintfCString.h" +#include "nsIBlocklistService.h" // Friggin' X11 has to "#define None". Lame! #ifdef None @@ -5129,13 +5130,14 @@ nsresult nsPluginHostImpl::ScanPluginsDirectory(nsIFile * pluginsDir, RemoveCachedPluginsInfo(NS_ConvertUTF16toUTF8(pfd->mFilename).get(), getter_AddRefs(pluginTag)); - PRUint32 oldFlags = NS_PLUGIN_FLAG_ENABLED; + PRBool enabled = PR_TRUE; + PRBool seenBefore = PR_FALSE; if (pluginTag) { + seenBefore = PR_TRUE; // If plugin changed, delete cachedPluginTag and don't use cache if (LL_NE(fileModTime, pluginTag->mLastModifiedTime)) { // Plugins has changed. Don't use cached plugin info. - oldFlags = pluginTag->Flags() & - (NS_PLUGIN_FLAG_ENABLED | NS_PLUGIN_FLAG_BLOCKLISTED); + enabled = (pluginTag->Flags() & NS_PLUGIN_FLAG_ENABLED) != 0; pluginTag = nsnull; // plugin file changed, flag this fact @@ -5211,12 +5213,25 @@ nsresult nsPluginHostImpl::ScanPluginsDirectory(nsIFile * pluginsDir, pluginTag->mLibrary = pluginLibrary; pluginTag->mLastModifiedTime = fileModTime; - if (!(oldFlags & NS_PLUGIN_FLAG_ENABLED) || - (pluginTag->mIsJavaPlugin && !mJavaEnabled)) - pluginTag->UnMark(NS_PLUGIN_FLAG_ENABLED); - if (oldFlags & NS_PLUGIN_FLAG_BLOCKLISTED) - pluginTag->Mark(NS_PLUGIN_FLAG_BLOCKLISTED); + nsCOMPtr blocklist = do_GetService("@mozilla.org/extensions/blocklist;1"); + if (blocklist) { + PRUint32 state; + rv = blocklist->GetPluginBlocklistState(pluginTag, EmptyString(), + EmptyString(), &state); + + if (NS_SUCCEEDED(rv)) { + // If the blocklist says so then block the plugin. If the blocklist says + // it is risky and we have never seen this plugin before then disable it + if (state == nsIBlocklistService::STATE_BLOCKED) + pluginTag->Mark(NS_PLUGIN_FLAG_BLOCKLISTED); + else if (state == nsIBlocklistService::STATE_SOFTBLOCKED && !seenBefore) + enabled = PR_FALSE; + } + } + + if (!enabled || (pluginTag->mIsJavaPlugin && !mJavaEnabled)) + pluginTag->UnMark(NS_PLUGIN_FLAG_ENABLED); // if this is unwanted plugin we are checkin for, or this is a duplicate plugin, // add it to our cache info list so we can cache the unwantedness of this plugin diff --git a/toolkit/locales/en-US/chrome/mozapps/extensions/blocklist.dtd b/toolkit/locales/en-US/chrome/mozapps/extensions/blocklist.dtd new file mode 100644 index 0000000000000..d08f00d6fcc2a --- /dev/null +++ b/toolkit/locales/en-US/chrome/mozapps/extensions/blocklist.dtd @@ -0,0 +1,10 @@ + + + + + + + + + + diff --git a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd index 6f2c9035f122b..c3a5419fa67de 100644 --- a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd +++ b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.dtd @@ -112,6 +112,7 @@ + @@ -168,3 +169,6 @@ + + + diff --git a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties index 571f0235a6d18..e80ba6e629ccb 100644 --- a/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties +++ b/toolkit/locales/en-US/chrome/mozapps/extensions/extensions.properties @@ -59,11 +59,12 @@ invalidGUIDMessage="%S" could not be installed because of an error in its Instal invalidVersionMessage="%S" could not be installed because of an error in its Install Manifest ("%S" is not a valid Version String). Please contact the author of this item about the problem. incompatiblePlatformMessage="%S" could not be installed because it is not compatible with your %S build type (%S). Please contact the author of this item about the problem. -blocklistedInstallTitle=This extension is not secure -blocklistedInstallMsg=The extension %S is known to be dangerous, and can't be installed. -blocklistNotifyTitle2=Add-ons may be causing problems -blocklistNotifyMsg2=%S has determined that the following add-ons may be unstable or insecure. -blocklistRestartMsg2=You should restart %S so that these add-ons can be disabled. +blocklistedInstallTitle2=This add-on is dangerous to use +blocklistedInstallMsg2=The add-on %S has a high risk of causing stability or security problems and can't be installed. +softBlockedInstallTitle=This add-on may be dangerous to use +softBlockedInstallMsg=The add-on %S may cause stability or security problems. It is highly recommended that you do not install it. +softBlockedInstallAcceptLabel=Install Anyway +softBlockedInstallAcceptKey=I missingFileTitle=Missing File missingFileMessage=%S could not load this item because the file %S was missing. diff --git a/toolkit/locales/jar.mn b/toolkit/locales/jar.mn index 2dcefeacfdb09..293f387682ae5 100644 --- a/toolkit/locales/jar.mn +++ b/toolkit/locales/jar.mn @@ -77,6 +77,7 @@ locale/@AB_CD@/mozapps/downloads/downloads.properties (%chrome/mozapps/downloads/downloads.properties) locale/@AB_CD@/mozapps/extensions/extensions.dtd (%chrome/mozapps/extensions/extensions.dtd) locale/@AB_CD@/mozapps/extensions/extensions.properties (%chrome/mozapps/extensions/extensions.properties) + locale/@AB_CD@/mozapps/extensions/blocklist.dtd (%chrome/mozapps/extensions/blocklist.dtd) locale/@AB_CD@/mozapps/extensions/about.dtd (%chrome/mozapps/extensions/about.dtd) locale/@AB_CD@/mozapps/extensions/errors.dtd (%chrome/mozapps/extensions/errors.dtd) locale/@AB_CD@/mozapps/extensions/update.dtd (%chrome/mozapps/extensions/update.dtd) diff --git a/toolkit/mozapps/extensions/content/blocklist.css b/toolkit/mozapps/extensions/content/blocklist.css new file mode 100644 index 0000000000000..cdff016ee02bc --- /dev/null +++ b/toolkit/mozapps/extensions/content/blocklist.css @@ -0,0 +1,11 @@ +hbox.addon-name-version { + -moz-binding: url("chrome://mozapps/content/extensions/extensions.xml#addon-name-version"); +} + +.hardBlockedAddon { + -moz-binding: url("chrome://mozapps/content/extensions/extensions.xml#hardblockedaddon"); +} + +.softBlockedAddon { + -moz-binding: url("chrome://mozapps/content/extensions/extensions.xml#softblockedaddon"); +} diff --git a/toolkit/mozapps/extensions/content/blocklist.js b/toolkit/mozapps/extensions/content/blocklist.js new file mode 100644 index 0000000000000..f517c5b1ccb46 --- /dev/null +++ b/toolkit/mozapps/extensions/content/blocklist.js @@ -0,0 +1,81 @@ +# ***** BEGIN LICENSE BLOCK ***** +# Version: MPL 1.1/GPL 2.0/LGPL 2.1 +# +# The contents of this file are subject to the Mozilla Public License Version +# 1.1 (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# http://www.mozilla.org/MPL/ +# +# Software distributed under the License is distributed on an "AS IS" basis, +# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License +# for the specific language governing rights and limitations under the +# License. +# +# The Original Code is the Extension Blocklist UI. +# +# The Initial Developer of the Original Code is +# Mozilla Corporation +# Portions created by the Initial Developer are Copyright (C) 2008 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Dave Townsend +# +# Alternatively, the contents of this file may be used under the terms of +# either the GNU General Public License Version 2 or later (the "GPL"), or +# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), +# in which case the provisions of the GPL or the LGPL are applicable instead +# of those above. If you wish to allow use of your version of this file only +# under the terms of either the GPL or the LGPL, and not to allow others to +# use your version of this file under the terms of the MPL, indicate your +# decision by deleting the provisions above and replace them with the notice +# and other provisions required by the GPL or the LGPL. If you do not delete +# the provisions above, a recipient may use your version of this file under +# the terms of any one of the MPL, the GPL or the LGPL. +# +# ***** END LICENSE BLOCK ***** + +var gArgs; + +function init() { + var hasHardBlocks = false; + var hasSoftBlocks = false; + gArgs = window.arguments[0].wrappedJSObject; + + var richlist = document.getElementById("addonList"); + var list = gArgs.list; + list.sort(function(a, b) { return String.localeCompare(a.name, b.name); }); + for (let i = 0; i < list.length; i++) { + let item = document.createElement("richlistitem"); + item.setAttribute("name", list[i].name); + item.setAttribute("version", list[i].version); + item.setAttribute("icon", list[i].icon); + if (list[i].blocked) { + item.setAttribute("class", "hardBlockedAddon"); + hasHardBlocks = true; + } + else { + item.setAttribute("class", "softBlockedAddon"); + hasSoftBlocks = true; + } + richlist.appendChild(item); + } + + if (hasHardBlocks && hasSoftBlocks) + document.getElementById("bothMessage").hidden = false; + else if (hasHardBlocks) + document.getElementById("hardBlockMessage").hidden = false; + else + document.getElementById("softBlockMessage").hidden = false; +} + +function accept() { + gArgs.restart = true; + var list = gArgs.list; + var items = document.getElementById("addonList").childNodes; + for (let i = 0; i < list.length; i++) { + if (!list[i].blocked) + list[i].disable = items[i].checked; + } + return true; +} diff --git a/toolkit/mozapps/extensions/content/blocklist.xul b/toolkit/mozapps/extensions/content/blocklist.xul new file mode 100755 index 0000000000000..a73da4f7eaeca --- /dev/null +++ b/toolkit/mozapps/extensions/content/blocklist.xul @@ -0,0 +1,80 @@ + + +# -*- Mode: Java; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- +# ***** BEGIN LICENSE BLOCK ***** +# Version: MPL 1.1/GPL 2.0/LGPL 2.1 +# +# The contents of this file are subject to the Mozilla Public License Version +# 1.1 (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# http://www.mozilla.org/MPL/ +# +# Software distributed under the License is distributed on an "AS IS" basis, +# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License +# for the specific language governing rights and limitations under the +# License. +# +# The Original Code is the Extension List UI. +# +# The Initial Developer of the Original Code is Google Inc. +# Portions created by the Initial Developer are Copyright (C) 2005 +# the Initial Developer. All Rights Reserved. +# +# Contributor(s): +# Ben Goodger +# Robert Strong +# Dave Townsend +# +# Alternatively, the contents of this file may be used under the terms of +# either the GNU General Public License Version 2 or later (the "GPL"), or +# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), +# in which case the provisions of the GPL or the LGPL are applicable instead +# of those above. If you wish to allow use of your version of this file only +# under the terms of either the GPL or the LGPL, and not to allow others to +# use your version of this file under the terms of the MPL, indicate your +# decision by deleting the provisions above and replace them with the notice +# and other provisions required by the GPL or the LGPL. If you do not delete +# the provisions above, a recipient may use your version of this file under +# the terms of any one of the MPL, the GPL or the LGPL. +# +# ***** END LICENSE BLOCK ***** + + + + + + +%brandDTD; + +%extensionsDTD; +]> + + + +