{"warnings": 150, "compatibility_summary": {"notices": 0, "errors": 0, "warnings": 0}, "ending_tier": 5, "detected_type": "extension", "signing_summary": {"high": 8, "medium": 2, "trivial": 0, "low": 7}, "errors": 0, "success": false, "messages": [{"context": null, "editors_only": true, "description": ["Files whose names end with flagged extensions have been found in the add-on.", "The extension of these files are flagged because they usually identify binary components. Please see http://addons.mozilla.org/developers/docs/policies/reviews#section-binary for more information on the binary content review process.", "chrome/content/shareTool.swf\nchrome/content/themeSelection.swf\nchrome/content/foxTab_flash10.swf\nchrome/content/modesViewTool.swf"], "signing_help": ["Please try to avoid interacting with or bundling native binaries whenever possible. If you are bundling binaries for performance reasons, please consider alternatives such as Emscripten (http://mzl.la/1KrSUh2), JavaScript typed arrays (http://mzl.la/1Iw02sr), and Worker threads (http://mzl.la/1OGfAcc).", "Any code which bundles native binaries must submit full source code, and undergo manual code review for at least one submission."], "column": null, "type": "warning", "signing_severity": "medium", "id": ["testcases_packagelayout", "test_blacklisted_files", "disallowed_extension"], "file": "META-INF/mozilla.sf", "tier": 1, "for_appversions": null, "message": "Flagged file extensions found.", "uid": "66f066507cb2407ba9a6c8570c96d986", "line": null, "compatibility_type": null}, {"context": ["message = message.replace(/\\[br\\]/g, \"
\")", "document.getElementById(\"title\").innerHTML = title;", "document.getElementById(\"message\").innerHTML = message;"], "editors_only": false, "description": "Due to both security and performance concerns, innerHTML may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.", "column": 4, "type": "warning", "id": ["testcases_javascript_instancetypes", "set_innerHTML", "variable_assignment"], "file": "chrome/content/flashVersionMessage.html", "tier": 3, "for_appversions": null, "message": "Markup should not be passed to `innerHTML` dynamically.", "uid": "2643730ca35e4630997e3ae77ff99666", "line": 64, "compatibility_type": null}, {"context": ["document.getElementById(\"title\").innerHTML = title;", "document.getElementById(\"message\").innerHTML = message;", "document.getElementById(\"green-button-text\").textContent = green_button_text;"], "editors_only": false, "description": "Due to both security and performance concerns, innerHTML may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.", "column": 4, "type": "warning", "id": ["testcases_javascript_instancetypes", "set_innerHTML", "variable_assignment"], "file": "chrome/content/flashVersionMessage.html", "tier": 3, "for_appversions": null, "message": "Markup should not be passed to `innerHTML` dynamically.", "uid": "d04651437a09446b80c50e8b2c8a8483", "line": 65, "compatibility_type": null}, {"context": ["", " "], "editors_only": false, "description": "iframe and browser elements that lack a type attribute must always have src attributes that reference local resources.", "column": null, "type": "warning", "id": ["markup", "starttag", "iframe_type_unsafe"], "file": "chrome/content/foxTab.xul", "tier": 2, "for_appversions": null, "message": "Typeless iframes/browsers must be local.", "uid": "8074c0fcd8fd493f96abfaee0a42bd3d", "line": 71, "compatibility_type": null}, {"context": [" }", "", " "], "editors_only": false, "description": "Please store complex scripts in .js files rather than inline script nodes.", "column": null, "type": "warning", "id": ["markup", "complex_script"], "file": "chrome/content/newTabMessage.html", "tier": 2, "for_appversions": null, "message": "Long inline script", "uid": "c05dbc19938042a3b3096c99ed06d555", "line": 112, "compatibility_type": null}, {"context": ["}", "document.location = \"about:blank\"", "f.openFoxTab(f.LAUNCH_MODE_INTERACTIVE, f.MODE_NEW_TAB);"], "editors_only": false, "description": "An attempt was made to overwrite a global variable in some JavaScript code.", "column": 24, "type": "warning", "id": ["testcases_javascript_actions", "_expr_assignment", "global_overwrite"], "file": "chrome/content/newTabMessage.html", "tier": 3, "for_appversions": null, "message": "Global variable overwrite", "uid": "3db3dbb693ae4c718d9cc61f29c06583", "line": 81, "compatibility_type": null}, {"context": ["}", " document.location = \"about:blank\"", "}"], "editors_only": false, "description": "An attempt was made to overwrite a global variable in some JavaScript code.", "column": 27, "type": "warning", "id": ["testcases_javascript_actions", "_expr_assignment", "global_overwrite"], "file": "chrome/content/newTabMessage.html", "tier": 3, "for_appversions": null, "message": "Global variable overwrite", "uid": "b91bf0bdf42e45d18a8133e16c94ad15", "line": 110, "compatibility_type": null}, {"context": null, "editors_only": false, "description": "Add-ons which are already signed will be re-signed when published on AMO. This will replace any existing signatures on the add-on.", "column": null, "type": "warning", "id": ["testcases_content", "signed_xpi"], "file": "", "tier": 2, "for_appversions": null, "message": "Package already signed", "uid": "45b1005cea35483183b11dd5ec3fc03b", "line": null, "compatibility_type": null}, {"context": [" this.nextFrame();", " setTimeout(Delegate.create(this, this.onEnterFrame), 0);", "}"], "editors_only": false, "description": "In order to prevent vulnerabilities, the `setTimeout` and `setInterval` functions should be called only with function expressions as their first argument.", "signing_help": "Please do not ever call `setTimeout` or `setInterval` with string arguments. If you are passing a function which is not being correctly detected as such, please consider passing a closure or arrow function, which in turn calls the original function.", "column": 3, "type": "warning", "signing_severity": "high", "id": ["javascript", "dangerous_global", "eval"], "file": "chrome/content/tween.js", "tier": 3, "for_appversions": null, "message": "`setTimeout` called in potentially dangerous manner", "uid": "a0c10567162f4812a0b945165fff372f", "line": 155, "compatibility_type": null}, {"context": ["", "groupsHTML\t+= ''+ icoImg +''"], "editors_only": false, "description": "The use of `mousemove`, `mouseover`, and `mouseout` is discouraged. These events are dispatched with high frequency and can cause severe performance issues.", "column": null, "type": "warning", "id": ["testcases_regex", "generic", "_generated"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Mouse events may cause performance issues.", "uid": "a67c190333c64feaa6bbb6652bcd572a", "line": 529, "compatibility_type": null}, {"context": ["", "groupsHTML\t+= ''+ icoImg +''"], "editors_only": false, "description": "The use of `mousemove`, `mouseover`, and `mouseout` is discouraged. These events are dispatched with high frequency and can cause severe performance issues.", "column": null, "type": "warning", "id": ["testcases_regex", "generic", "_generated"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Mouse events may cause performance issues.", "uid": "0193988e777b4f3da6d0db58d2551717", "line": 529, "compatibility_type": null}, {"context": ["+ ''", "+ ''+ groupsHTML +''"], "editors_only": false, "description": "The use of `mousemove`, `mouseover`, and `mouseout` is discouraged. These events are dispatched with high frequency and can cause severe performance issues.", "column": null, "type": "warning", "id": ["testcases_regex", "generic", "_generated"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Mouse events may cause performance issues.", "uid": "e5262a41b22c42398b2e7b117e65d27f", "line": 545, "compatibility_type": null}, {"context": ["+ ''", "+ ''+ groupsHTML +''"], "editors_only": false, "description": "The use of `mousemove`, `mouseover`, and `mouseout` is discouraged. These events are dispatched with high frequency and can cause severe performance issues.", "column": null, "type": "warning", "id": ["testcases_regex", "generic", "_generated"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Mouse events may cause performance issues.", "uid": "b7f23923c84c4a7db93be782b8fa99be", "line": 545, "compatibility_type": null}, {"context": ["}", "document.removeEventListener('mousemove', foxTabWin.wallMouseMove, false);", "document.removeEventListener('mousedown', foxTabWin.wallMouseDown, false);"], "editors_only": false, "description": "The use of `mousemove`, `mouseover`, and `mouseout` is discouraged. These events are dispatched with high frequency and can cause severe performance issues.", "column": null, "type": "warning", "id": ["testcases_regex", "generic", "_generated"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Mouse events may cause performance issues.", "uid": "975472ce31f74520a8549efb9ef30960", "line": 1309, "compatibility_type": null}, {"context": ["document.mouseMoveInitialized = true;", "document.addEventListener('mousemove', foxTabWin.wallMouseMove, false);", "document.addEventListener('mousedown', foxTabWin.wallMouseDown, false);"], "editors_only": false, "description": "The use of `mousemove`, `mouseover`, and `mouseout` is discouraged. These events are dispatched with high frequency and can cause severe performance issues.", "column": null, "type": "warning", "id": ["testcases_regex", "generic", "_generated"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Mouse events may cause performance issues.", "uid": "455cb1cf0e384598a429fbeecb38dcd6", "line": 1629, "compatibility_type": null}, {"context": ["row.isRow = true;", "row.addEventListener(\"mouseover\" , function(e) {", " var row = e.currentTarget;"], "editors_only": false, "description": "The use of `mousemove`, `mouseover`, and `mouseout` is discouraged. These events are dispatched with high frequency and can cause severe performance issues.", "column": null, "type": "warning", "id": ["testcases_regex", "generic", "_generated"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Mouse events may cause performance issues.", "uid": "6d605486e7384a4e9f61fb01ffa3bb3d", "line": 2186, "compatibility_type": null}, {"context": [" var title = foxTabWin.wo.tabsList[tabIndex].title", " if ((title==\"\") || (title==\"about:blank\")) title=\"Blank Page\"", "} else {"], "editors_only": false, "description": ["The new tab page should be changed only by writing to the appropriate preference in the default preferences branch. Such changes may only be made after an explicit user opt-in, unless the add-on was explicitly and directly installed by the user, and changing the new tab page is its primary purpose.", "If this code does not change the behavior of the new tab page, it may be ignored."], "signing_help": "Extensions may not programmatically override the new tab page. If this code has another purpose, we nonetheless recommend against testing URLs for these values, since results can be unpredictable, and better options usually exist. If you cannot avoid making these tests, please leave this code unchanged, and it will be ignored in future submissions.", "column": null, "type": "warning", "signing_severity": "low", "id": ["testcases_regex", "generic", "_generated"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Possible attempt to override new tab page", "uid": "5ccd5839a5744938a86295b23cf7a931", "line": 177, "compatibility_type": null}, {"context": [" if (title==\"\") {", "if (currentBrowser.currentURI.spec==\"about:blank\") title=\"Blank Page\"", " } else {"], "editors_only": false, "description": ["The new tab page should be changed only by writing to the appropriate preference in the default preferences branch. Such changes may only be made after an explicit user opt-in, unless the add-on was explicitly and directly installed by the user, and changing the new tab page is its primary purpose.", "If this code does not change the behavior of the new tab page, it may be ignored."], "signing_help": "Extensions may not programmatically override the new tab page. If this code has another purpose, we nonetheless recommend against testing URLs for these values, since results can be unpredictable, and better options usually exist. If you cannot avoid making these tests, please leave this code unchanged, and it will be ignored in future submissions.", "column": null, "type": "warning", "signing_severity": "low", "id": ["testcases_regex", "generic", "_generated"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Possible attempt to override new tab page", "uid": "edc3fcd99d554ad38e952ec0c10f3d8d", "line": 184, "compatibility_type": null}, {"context": ["", "div.innerHTML = panelHTML", "div.style.display = ''"], "editors_only": false, "description": "Due to both security and performance concerns, innerHTML may not be set using dynamic values which have not been adequately sanitized. This can lead to security issues or fairly serious performance degradation.", "column": 21, "type": "warning", "id": ["testcases_javascript_instancetypes", "set_innerHTML", "variable_assignment"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Markup should not be passed to `innerHTML` dynamically.", "uid": "57cfdf71c8154f3192cbedb671f507c8", "line": 550, "compatibility_type": null}, {"context": [" }", " wbp.saveURI(uri, null, null, null, null, file);", "} catch (e) {"], "editors_only": false, "description": "Most nsIWebBrowserPersist methods have been superseded by simpler methods in Downloads.jsm, namely `Downloads.fetch` and `Downloads.createDownload`. See http://mzl.la/downloads-jsm for more information.", "column": 4, "type": "warning", "id": ["testcases_javascript_call_definititions", "webbrowserpersist"], "file": "chrome/content/window.js", "tier": 4, "for_appversions": null, "message": "nsIWebBrowserPersist should no longer be used", "uid": "b43435fc968f41c4a8f4e7f6b3b2c9b5", "line": 1123, "compatibility_type": null}, {"context": ["document.removeEventListener('mousedown', foxTabWin.wallMouseDown, false);", "document.mouseMoveInitialized = null;", ""], "editors_only": false, "description": "An attempt was made to overwrite a global variable in some JavaScript code.", "column": 34, "type": "warning", "id": ["testcases_javascript_actions", "_expr_assignment", "global_overwrite"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Global variable overwrite", "uid": "636b346f15b249c0aa3b8c49a4b2a979", "line": 1311, "compatibility_type": null}, {"context": ["if (document.mouseMoveInitialized==null) {", " document.mouseMoveInitialized = true;", " document.addEventListener('mousemove', foxTabWin.wallMouseMove, false);"], "editors_only": false, "description": "An attempt was made to overwrite a global variable in some JavaScript code.", "column": 35, "type": "warning", "id": ["testcases_javascript_actions", "_expr_assignment", "global_overwrite"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Global variable overwrite", "uid": "8204f932289749a6aa7f5768cc184824", "line": 1628, "compatibility_type": null}, {"context": ["foxTabWin.setPref(\"foxTab.general.showNTHomePageLink\", \"showNTHomePageLink\", false);", "foxTabWin.setPref(\"browser.startup.homepage\", null, \"chrome://foxtab/content/homepage.html\", true);", " foxTabWin.wo.callURL(\"h=1\");"], "editors_only": false, "description": ["Extensions must not alter user preferences such as the current home page, new tab page, or search engine, without explicit user consent, in which a user takes a non-default action. Such changes must also be reverted when the extension is disabled or uninstalled.", "In nearly all cases, new values for these preferences should be set in the default preference branch, rather than the user branch.", "If you are reading, but not writing, this preference, please consider passing a string literal directly to `Preferences.get()` or `nsIPrefBranch.get*Pref`."], "signing_help": ["Add-ons which directly change these preferences must undergo at manual code review for at least one submission. We are currently working to provide libraries and APIs to allow extensions to modify these settings in ways that we can guarantee are in-policy. In the interim, we recommend that you avoid changing these settings altogether, if at all possible.", "If you are reading, but not writing, this preference, please consider passing a string literal directly to `Preferences.get()` or `nsIPrefBranch.get*Pref`."], "column": 24, "type": "warning", "signing_severity": "high", "id": ["testcases_regex", "string", "preference"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "Potentially unsafe preference branch referenced", "uid": "75f3661678ae46bb8ca2c1174874b406", "line": 1576, "compatibility_type": null}, {"context": ["resizeTimeOut : function(newSize) {", " setTimeout(foxTabWin.wo.resize, 250, newSize);", "},"], "editors_only": false, "description": "In order to prevent vulnerabilities, the `setTimeout` and `setInterval` functions should be called only with function expressions as their first argument.", "signing_help": "Please do not ever call `setTimeout` or `setInterval` with string arguments. If you are passing a function which is not being correctly detected as such, please consider passing a closure or arrow function, which in turn calls the original function.", "column": 2, "type": "warning", "signing_severity": "high", "id": ["javascript", "dangerous_global", "eval"], "file": "chrome/content/window.js", "tier": 3, "for_appversions": null, "message": "`setTimeout` called in potentially dangerous manner", "uid": "3d68a439b919403c9007455608843552", "line": 1862, "compatibility_type": null}, {"context": ["if ((!foxTab.isFlashPlayerInstalled) || (!f.isFlash10)) {", " document.getElementById(\"main_div\").innerHTML = \""], "signing_help": ["Please avoid including JavaScript fragments in HTML stored in JavaScript strings. Event listeners should be added via `addEventListener` after the HTML has been injected.", "Injecting