Security/Reviews/AppsProject/ExtensionDataFlow

Data Flow

• Extension retrieves manifest from URL, records origin

Extension parses manifest into in-memory variables

variable	type	produced from value
launchURI	nsIURI	app.origin + app.manifest.launch_path
iconURI	nsIURI	app.origin + app.manifest.icons[${biggest_icon_index}]
appName	string	app.manifest.name
appNameAsFilename	string	${appName} (regex applied to remove unprintables)
developerName	string	app.developer.name
shortDescription	string	app.manifest.description (unprintables regex; trimmed)
versionStr	string	(currently static value "Developer Preview")

Windows-specific

variable	type	produced from value
appNameAsFilename	string	${appNameAsFilename} (Windows filename regex applied)
installDir	nsIFile	launchURI values + ${appNameAsFilename}
XULDir	nsIFile	installDir
uninstallerFile	nsIFile	installDir + "uninstall.exe"
iconFile	nsIFile	installDir + "chrome\icons\default\" + ${appNameAsFilename} + ".ico"
installerDir	nsIFile	Unique dir name produced as "temp dir + ${appNameAsFilename}"
firefoxFile	nsIFile	Dir of current running process + "firefox.exe"
desktopShortcut	nsIFile	Desktop + ${appNameAsFilename} + ".lnk"
startMenuShortcut	nsIFile	Start Menu + ${appNameAsFilename} + ".lnk"
uninstallSubkeyStr	string	${launchURI} values

Mac-specific

variable	type	produced from value
appNameAsFilename	string	${appNameAsFilename} (Mac filename regex applied)
installDir	nsILocalFile	"~/Applications" + ${appNameAsFilename} + ".app"
XULDir	nsIFile	${installDir} + "XUL"
iconFile	nsIFile	${installDir} + "Contents\Resources\appicon.icns"

Extension sets up substitution values for file copies

subst string	produced from value
$NAME_AS_XUL_APP_PROPERTY	${appName}
$VERSION_AS_XUL_APP_PROPERTY	${versionStr}
$ORIGIN_AS_XUL_APP_PROPERTY	${launchURI}.prePath
$NAME_AS_JS_STRING	makeJSString(${appName})
$LAUNCH_PATH_AS_XML_STRING	makeXMLString(${launchURI}.spec)

Windows-specific

subst string	produced from value
$PROFILE_DIR	${installDir}.parent.leafName
$NAME_AS_XUL_APP_PROPERTY	${appName}.replace("\\", "")

Mac-specific

subst string	produced from value
$PROFILE_DIR	"Mozilla/" + ${appNameAsFilename}
$NAME_AS_FILENAME	${appNameAsFilename}
$FILENAME_AS_XML	makeXMLString(${appNameAsFilename})
$REVERSED_APPDOMAIN	createInvertedDNSIdentifier(${launchURI})

Extension clears previous installation

• Extension removes ${installDir}

Windows-specific

• Extension removes HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\${uninstallKey}
• Extension removes ${desktopShortcut}
• Extension removes ${startMenuShortcut}

Mac-specific

• (No additional steps)

Extension retrieves app icon

Windows-specific

• Extension downloads icon from ${iconURI} into memory
• Extension converts icon to image/vnd.microsoft.icon
• Extension writes icon to ${iconFile}

Mac-specific

• Extension downloads icon from ${iconURI} into temporary file (${icon})
• Extension calls "sips -s format icns ${icon} --out ${iconFile} -z 128 128

Extension copies files to disk, performs text substitutions

application.ini (renamed from newapp_template.ini)

$NAME_AS_XUL_APP_PROPERTY

$VERSION_AS_XUL_APP_PROPERTY

$ORIGIN_AS_XUL_APP_PROPERTY

$PROFILE_DIR

window.js

$NAME_AS_JS_STRING

window.xul

$NAME_AS_XML_STRING

Mac-specific

• foxlauncher is renamed to $NAME_AS_FILENAME

Info.plist

$NAME_AS_JS_STRING

$FILENAME_AS_XML

$REVERSED_APPDOMAIN

Extension performs additional install steps

Windows-specific

Extension writes registry key values

• Key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Value name	Value	Type
DisplayName	${appName}	string (REG_SZ)
ShortcutName	${appNameAsFilename}	string (REG_SZ)
DisplayIcon	${iconFile}.path	string (REG_SZ)
UninstallString	${launchURI} values	string (REG_SZ)
InstallLocation	${installDir}.path	string (REG_SZ)
NoModify	1	int (REG_DWORD)
NoRepair	1	int (REG_DWORD)
RegOwner	(Want this to be BrowserID)	string (REG_SZ)
UrlUpdateInfo	Not sure yet	string (REG_SZ)
Publisher	${developerName}	string (REG_SZ)
DisplayVersion	${versionStr}	string (REG_SZ)
InstallSource	Not sure yet (should be app store URL)	string (REG_SZ)
Comments	${shortDescription}	string (REG_SZ)
HelpLink	Not sure yet	string (REG_SZ)
URLInfoAbout	${launchURI}.prePath	string (REG_SZ)
Contact	Not sure yet	string (REG_SZ)
Readme	Not sure yet	string (REG_SZ)

Extension runs installer

• Command line:

 * ${installerDir}\install.exe
 * /S
 * /FIREFOX_PATH=
 * ${firefoxFile}.path
 * /ORIGIN_SCHEME=
 * ${launchURI}.scheme
 * /ORIGIN_HOST=
 * ${launchURI}.host
 * /ORIGIN_PORT=
 * ${launchURI}.port

• Installer reads registry values

 * InstallLocation
 * ShortcutName
 * ShortcutComment
 * DisplayIcon

• Installer creates a shortcut in InstallLocation named ShortcutName.lnk with description set to ShortcutComment and icon set to DisplayIcon
• Shortcut points to: FIREFOX_PATH -app ${path generated from origin info}\application.ini
• Installer creates an uninstaller at InstallLocation\uninstall.exe
• Uninstaller reads similar registry keys and command-line args and performs following operations

 * Delete shortcuts
 * Remove InstallLocation
 * Remove registry key