We don't validate version numbers extracted from extension manifest. We use that number to form a file name: using meta characters in version number can lead to weird (or dangerous) results. This is not as severe as bug #298756, because patch of that bug (attachment #187287) prevents uploading of files that are not xpi nor jars. Nevertheless, there's potential for directory traversal which may be exploited e.g. to overwrite already approval extensions skipping review.

Comment on attachment 188056 [details] [diff] [review] Version number validation I'd like it if the die message told the user how to make the version number valid. r=cst

(In reply to comment #2) > (From update of attachment 188056 [details] [diff] [review] [edit]) > I'd like it if the die message told the user how to make the version number > valid. I wouldn't, because I don't trust an extension developer which doesn't read the relevant documentation and know how a version number should be ;)

how did it end?

Isn't this fixed?

Comment on attachment 188295 [details] [diff] [review] Better indentation + link to reference doc man, I could bitch about style, but its AMO 1.0, style is irrelevant here.

Comment on attachment 188295 [details] [diff] [review] Better indentation + link to reference doc This patch is no longer valid, this section of code was rewritten.

The regex and link in the patch have been added in Remora.

I think that this should be made public by now.