Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Firefox version not approved #49

Closed
1 task
paglias opened this issue Sep 12, 2019 · 0 comments · Fixed by #50
Closed
1 task

Firefox version not approved #49

paglias opened this issue Sep 12, 2019 · 0 comments · Fixed by #50

Comments

@paglias
Copy link
Contributor

paglias commented Sep 12, 2019

The Firefox version of the extension had been rejected and is not available in the marketplace due to the following problems

  1. This version contains minified, concatenated or otherwise machine-generated code. Please provide the original sources, together with instructions on how to generate the final XPI. Source code must be provided as an archive and uploaded using the source code upload field, which can be done during submission or on the version page in the developer hub.
    Please read through the instructions at https://developer.mozilla.org/en-US/Add-ons/Source_Code_Submission.
    Here are some examples that were discovered:
    resources\habitica-markdown.min.js
  1. Please remove all unused permissions from your manifest.
    Here are some examples that were discovered:
    https://ajax.googleapis.com/
  1. Please add a privacy policy to this add-on that details which user data is being sent and to what services. The critical things to describe in the policy are how your extension collects, uses, stores, and shares or discloses information about people.If your add-on makes it apparent to websites that it is installed, this must also be mentioned. The policy should be about the extension only, not a copy of the website's privacy policy. It should also be the actual text, as opposed to a link to a privacy policy on a website. The privacy policy can be added in the add-on settings under “Manage Authors & License” on AMO.
    Here are some examples that were discovered:
    mainChat\chat_inPage.js line 55, 182, 276, 569
  • ^ this one will have to be handled by the Habitica staff
  1. This add-on is creating DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Safely_inserting_external_content_into_a_page .
    Here are some examples that were discovered:
    mainChat\chat_inPage.js line 147, 194, 199 and possible more.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant