search

HabitRPG / habitica-chat-extension

A habitica.com Chat Client for Chrome
18 stars 13 forks source link

Firefox version not approved #49

Closed paglias closed 4 years ago

paglias commented 5 years ago

The Firefox version of the extension had been rejected and is not available in the marketplace due to the following problems

1) This version contains minified, concatenated or otherwise machine-generated code. Please provide the original sources, together with instructions on how to generate the final XPI. Source code must be provided as an archive and uploaded using the source code upload field, which can be done during submission or on the version page in the developer hub. Please read through the instructions at https://developer.mozilla.org/en-US/Add-ons/Source_Code_Submission. Here are some examples that were discovered: resources\habitica-markdown.min.js

2) Please remove all unused permissions from your manifest. Here are some examples that were discovered: https://ajax.googleapis.com/

3) Please add a privacy policy to this add-on that details which user data is being sent and to what services. The critical things to describe in the policy are how your extension collects, uses, stores, and shares or discloses information about people.If your add-on makes it apparent to websites that it is installed, this must also be mentioned. The policy should be about the extension only, not a copy of the website's privacy policy. It should also be the actual text, as opposed to a link to a privacy policy on a website. The privacy policy can be added in the add-on settings under “Manage Authors & License” on AMO. Here are some examples that were discovered: mainChat\chat_inPage.js line 55, 182, 276, 569

4) This add-on is creating DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Safely_inserting_external_content_into_a_page . Here are some examples that were discovered: mainChat\chat_inPage.js line 147, 194, 199 and possible more.