Security/Reviews/AppsProject/ExtensionDataFlow

From MozillaWiki
Jump to: navigation, search

Data Flow

  • Extension retrieves manifest from URL, records origin

Extension parses manifest into in-memory variables

variable type produced from value
launchURI nsIURI app.origin + app.manifest.launch_path
iconURI nsIURI app.origin + app.manifest.icons[${biggest_icon_index}]
appName string app.manifest.name
appNameAsFilename string ${appName} (regex applied to remove unprintables)
developerName string app.developer.name
shortDescription string app.manifest.description (unprintables regex; trimmed)
versionStr string (currently static value "Developer Preview")

Windows-specific

variable type produced from value
appNameAsFilename string ${appNameAsFilename} (Windows filename regex applied)
installDir nsIFile launchURI values + ${appNameAsFilename}
XULDir nsIFile installDir
uninstallerFile nsIFile installDir + "uninstall.exe"
iconFile nsIFile installDir + "chrome\icons\default\" + ${appNameAsFilename} + ".ico"
installerDir nsIFile Unique dir name produced as "temp dir + ${appNameAsFilename}"
firefoxFile nsIFile Dir of current running process + "firefox.exe"
desktopShortcut nsIFile Desktop + ${appNameAsFilename} + ".lnk"
startMenuShortcut nsIFile Start Menu + ${appNameAsFilename} + ".lnk"
uninstallSubkeyStr string ${launchURI} values

Mac-specific

variable type produced from value
appNameAsFilename string ${appNameAsFilename} (Mac filename regex applied)
installDir nsILocalFile "~/Applications" + ${appNameAsFilename} + ".app"
XULDir nsIFile ${installDir} + "XUL"
iconFile nsIFile ${installDir} + "Contents\Resources\appicon.icns"

Extension sets up substitution values for file copies

subst string produced from value
$NAME_AS_XUL_APP_PROPERTY ${appName}
$VERSION_AS_XUL_APP_PROPERTY ${versionStr}
$ORIGIN_AS_XUL_APP_PROPERTY ${launchURI}.prePath
$NAME_AS_JS_STRING makeJSString(${appName})
$LAUNCH_PATH_AS_XML_STRING makeXMLString(${launchURI}.spec)

Windows-specific

subst string produced from value
$PROFILE_DIR ${installDir}.parent.leafName
$NAME_AS_XUL_APP_PROPERTY ${appName}.replace("\\", "")

Mac-specific

subst string produced from value
$PROFILE_DIR "Mozilla/" + ${appNameAsFilename}
$NAME_AS_FILENAME ${appNameAsFilename}
$FILENAME_AS_XML makeXMLString(${appNameAsFilename})
$REVERSED_APPDOMAIN createInvertedDNSIdentifier(${launchURI})

Extension clears previous installation

  • Extension removes ${installDir}

Windows-specific

  • Extension removes HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\${uninstallKey}
  • Extension removes ${desktopShortcut}
  • Extension removes ${startMenuShortcut}

Mac-specific

  • (No additional steps)

Extension retrieves app icon

Windows-specific

  • Extension downloads icon from ${iconURI} into memory
  • Extension converts icon to image/vnd.microsoft.icon
  • Extension writes icon to ${iconFile}

Mac-specific

  • Extension downloads icon from ${iconURI} into temporary file (${icon})
  • Extension calls "sips -s format icns ${icon} --out ${iconFile} -z 128 128

Extension copies files to disk, performs text substitutions

application.ini (renamed from newapp_template.ini)
$NAME_AS_XUL_APP_PROPERTY
$VERSION_AS_XUL_APP_PROPERTY
$ORIGIN_AS_XUL_APP_PROPERTY
$PROFILE_DIR
window.js
$NAME_AS_JS_STRING
window.xul
$NAME_AS_XML_STRING

Mac-specific

  • foxlauncher is renamed to $NAME_AS_FILENAME
Info.plist
$NAME_AS_JS_STRING
$FILENAME_AS_XML
$REVERSED_APPDOMAIN

Extension performs additional install steps

Windows-specific

Extension writes registry key values

  • Key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Value name Value Type
DisplayName ${appName} string (REG_SZ)
ShortcutName ${appNameAsFilename} string (REG_SZ)
DisplayIcon ${iconFile}.path string (REG_SZ)
UninstallString ${launchURI} values string (REG_SZ)
InstallLocation ${installDir}.path string (REG_SZ)
NoModify 1 int (REG_DWORD)
NoRepair 1 int (REG_DWORD)
RegOwner (Want this to be BrowserID) string (REG_SZ)
UrlUpdateInfo Not sure yet string (REG_SZ)
Publisher ${developerName} string (REG_SZ)
DisplayVersion ${versionStr} string (REG_SZ)
InstallSource Not sure yet (should be app store URL) string (REG_SZ)
Comments ${shortDescription} string (REG_SZ)
HelpLink Not sure yet string (REG_SZ)
URLInfoAbout ${launchURI}.prePath string (REG_SZ)
Contact Not sure yet string (REG_SZ)
Readme Not sure yet string (REG_SZ)

Extension copies NSIS installer to ${installerDir}

Extension runs installer

  • Command line:
 * ${installerDir}\install.exe
 * /S
 * /FIREFOX_PATH=
 * ${firefoxFile}.path
 * /ORIGIN_SCHEME=
 * ${launchURI}.scheme
 * /ORIGIN_HOST=
 * ${launchURI}.host
 * /ORIGIN_PORT=
 * ${launchURI}.port
  • Installer reads registry values
 * InstallLocation
 * ShortcutName
 * ShortcutComment
 * DisplayIcon
  • Installer creates a shortcut in InstallLocation named ShortcutName.lnk with description set to ShortcutComment and icon set to DisplayIcon
  • Shortcut points to: FIREFOX_PATH -app ${path generated from origin info}\application.ini
  • Installer creates an uninstaller at InstallLocation\uninstall.exe
  • Uninstaller reads similar registry keys and command-line args and performs following operations
 * Delete shortcuts
 * Remove InstallLocation
 * Remove registry key

Extension copies shortcut (created by installer) from ${installDir} to ${desktopShortcut} and ${startMenuShortcut}