Closed nvdaes closed 2 months ago
Tested with a valid add-on:
https://github.com/nvdaes/addon-datastore/actions/runs/9250658201
Test simulating that customNotifications is a malicious add-on, hard-coding the sha256 of a flagged add-on (here we see the VirusTotal failure):
https://github.com/nvdaes/addon-datastore/actions/runs/9251468377
Last test: after merging the manualApproval PR, simulating that NV Access accepted this add-on as a false positive:
https://github.com/nvdaes/addon-datastore/actions/runs/9251719545
@seanbudd , this is ready for review.
Sorry, I remembered that codeQl analysis workflow needs to be updated so that reviewedAddons.json can be used for codeQl and virusTotal, and the manualApproval pull request considers both analysis. I'll submit tests now.
Test: virusTotal success, codeQl excluding warnings fails:
https://github.com/nvdaes/addon-datastore/actions/runs/9259669099/job/25472099153
Test: maualApproval PR merged after analysis failure. The submission issue is closed as completed via its PR:
https://github.com/nvdaes/addon-datastore/actions/runs/9259808380
Test: making VirusTotal and codeQL analysis fail, to see how a unique pull request for manual approval is created, and just an issue comment requesting to keep the submission issue opened. readFeeeds 24.0.0 and the same issue testing just codeQl failure is ised:
https://github.com/nvdaes/addon-datastore/actions/runs/9260026346
I think that all changes are tested. The submission issue for readFeeds 24.0.0 can be found at
Si I think this is ready for review, @seanbudd
@seanbudd , I think all your suggestions are applied.
note it seems I am unable to commit/push to your fork
I've applied your last suggestion about sender. I'll try to grant you access to my fork.
@seanbudd , I have send you an invitation as an admin of my fork. Please accept it.
@coderabbitai review
Issue number
Fixes issue nvaccess/addon-datastore#3246
Summary of the issue
VirusTotal may catch malware bundled with add-ons. Also, knowing the sha256 of scanned add-ons, the URL to see results at different datetimes maybe built, allowing users to see this information even before installing an add-on if this was included in the NVDA store in the future.
Development strategy
Testing performed
https://github.com/nvdaes/addon-datastore/issues/1299