{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/addons-linter/issues/1035","repository_url":"https://api.github.com/repos/mozilla/addons-linter","labels_url":"https://api.github.com/repos/mozilla/addons-linter/issues/1035/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/addons-linter/issues/1035/comments","events_url":"https://api.github.com/repos/mozilla/addons-linter/issues/1035/events","html_url":"https://github.com/mozilla/addons-linter/issues/1035","id":187520080,"number":1035,"title":"Library blacklist blocks valid submissions","user":{"login":"Synzvato","id":2366020,"avatar_url":"https://avatars.githubusercontent.com/u/2366020?v=3","gravatar_id":"","url":"https://api.github.com/users/Synzvato","html_url":"https://github.com/Synzvato","followers_url":"https://api.github.com/users/Synzvato/followers","following_url":"https://api.github.com/users/Synzvato/following{/other_user}","gists_url":"https://api.github.com/users/Synzvato/gists{/gist_id}","starred_url":"https://api.github.com/users/Synzvato/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Synzvato/subscriptions","organizations_url":"https://api.github.com/users/Synzvato/orgs","repos_url":"https://api.github.com/users/Synzvato/repos","events_url":"https://api.github.com/users/Synzvato/events{/privacy}","received_events_url":"https://api.github.com/users/Synzvato/received_events","type":"User","site_admin":false},"labels":[{"id":266169496,"url":"https://api.github.com/repos/mozilla/addons-linter/labels/needs%20discussion","name":"needs discussion","color":"5319e7","default":false},{"id":335000562,"url":"https://api.github.com/repos/mozilla/addons-linter/labels/security","name":"security","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":16,"created_at":"2016-11-05T20:08:17Z","updated_at":"2016-11-07T15:46:16Z","closed_at":null,"body":"The new library blacklist is currently preventing me from submitting new versions of my featured add-on [Decentraleyes](https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/). It wrongly suspects that the add-on actively uses several libraries that are known to suffer from security vulnerabilities. It's a CDN emulator, and does not internally rely on said libraries.\r\n\r\nWhile I expect there to be certain measures in place to prevent add-ons from using unsafe libraries, the current implementation effectively kills my extension. There should be a way to bypass this check (e.g. by providing an explanation on submission, or by requesting specific add-ons to be whitelisted).\r\n\r\n![image](https://cloud.githubusercontent.com/assets/2366020/20033387/99e522ba-a39f-11e6-9513-6bd419726ede.png)\r\n_A screenshot of the AMO \"Add a new Version\" panel._"},"comment":{"url":"https://api.github.com/repos/mozilla/addons-linter/issues/comments/258871652","html_url":"https://github.com/mozilla/addons-linter/issues/1035#issuecomment-258871652","issue_url":"https://api.github.com/repos/mozilla/addons-linter/issues/1035","id":258871652,"user":{"login":"Synzvato","id":2366020,"avatar_url":"https://avatars.githubusercontent.com/u/2366020?v=3","gravatar_id":"","url":"https://api.github.com/users/Synzvato","html_url":"https://github.com/Synzvato","followers_url":"https://api.github.com/users/Synzvato/followers","following_url":"https://api.github.com/users/Synzvato/following{/other_user}","gists_url":"https://api.github.com/users/Synzvato/gists{/gist_id}","starred_url":"https://api.github.com/users/Synzvato/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Synzvato/subscriptions","organizations_url":"https://api.github.com/users/Synzvato/orgs","repos_url":"https://api.github.com/users/Synzvato/repos","events_url":"https://api.github.com/users/Synzvato/events{/privacy}","received_events_url":"https://api.github.com/users/Synzvato/received_events","type":"User","site_admin":false},"created_at":"2016-11-07T15:46:16Z","updated_at":"2016-11-07T15:46:16Z","body":"@Rob--W Thanks for the clarifications and suggestions!\r\n\r\n> If the add-on does not use these libraries _and_ they cannot directly be referenced, then I think that it is fine to approve your add-on.\r\n\r\nThat's great to hear. I'm convinced that once the add-on is ported to ```WebExtensions```, it'll be no longer possible for exploits to directly refer to bundled resources. My reasoning behind this, is that the identifiers within ```moz-extension://``` addresses differ per user, where ```resource://``` locations are set in stone.\r\n\r\n> A quick and easy (temporary) fix for both issues (this linter issue and the security issue) is to prepend \"@\" to all JavaScript files, and remove it before serving the file as a response to the CDNs [...].\r\n\r\nI will be sure to follow your suggestion of applying this as a quick, temporary, fix. Appreciated! However, it's important to note that I still need the ban lifted, as I'll soon submit the ```WebExtensions``` port. "}}
{"actor":{"display_login":"Synzvato"}}