Package: amo-validator
[![Updates](https://pyup.io/repos/github/mozilla/amo-validator/shield.svg)](https://pyup.io/repos/github/mozilla/amo-validator/)# addons.mozilla.org Validator:warning: :warning: :fire: This tool is being deprecated and going away eventually. :warning: :warning: :fire:It is still used on addons.mozilla.org for legacy add-ons but once support for updates for legacy add-ons goes away from AMO this tool will be archived.The AMO Validator is a tool designed to scan Mozilla add-on packages forproblems such as security vulnerabilities, exploits, spamware and badware,and lots of other gunk. By using a combination of various techniques anddetection mechanisms, the validator is capable of being both efficient as wellas thorough.## Setup### PrerequisitesYou can install everything you need for running and testing with```bashpip install -r requirements.txt```### SubmodulesThe validator may require some submodules to work. Make sure to run```bashgit clone --recursive git://github.com/mozilla/amo-validator.git```so that you get all of the goodies inside.### SpidermonkeyA working copy of Spidermonkey (debug or non-debug is fine) is required.  Theeasiest way to do this is to just [download the binary](https://archive.mozilla.org/pub/firefox/nightly/latest-mozilla-central/jsshell-linux-x86_64.zip).If you want to build it from scratch, [clone](http://hg.mozilla.org/mozilla-central/)the mozilla-central repo or[download the tip](http://hg.mozilla.org/mozilla-central/archive/tip.tar.bz2)(which is faster). Then build it from source like this```bashcd mozilla-centralcd js/srcautoconf2.13./configuremakesudo cp dist/bin/js /usr/local/bin/js```You must use autoconf at *exactly* 2.13 or else it won't work. If you're using`brew`_ on Mac OS X you can get autoconf2.13 with thisbrew install autoconf213If you don't want to put the `js` executable in your `$PATH` or you want itin a custom path, you can define it as `$SPIDERMONKEY_INSTALLATION` inyour environment.### Using amo-validator as a contained app using dockerCheck this instructions from [marceloandrader](https://github.com/marceloandrader/dockerfiles/blob/master/amo-validator/README.md)## RunningRun the validator as follows```./addon-validator <path to xpi> [-t <expected type>] [-o <output type>] [-v][--boring] [--selfhosted] [--determined]```The path to the XPI should point to an XPI file.<dl><dt>-t<dd>The type that you expect your add-on to be detected as. The list oftypes is listed below.<dt>-o<dd>The type of output to generate. Types are listed below.<dt>-v<dd>Enable verbose mode. Extra information will be displayed in verbose mode,namely notices (informational messages), Jetpack information ifavailable, extra error info (like contexts, file data, etc.), and errordescriptions. This only applies to `-o text`.<dt>--selfhosted<dd>Disables messages that are specific to add-ons hosted on AMO.<dt>--boring<dd>Disables colorful shell output.<dt>--determined<dd>Continue validating the remaining tiers of an add-on if one tier hasfailed. Certain high-tiered tests may inadvertently fail when this optionis enabled for badly malformed add-ons.<dt>--target-maxversion<dd>Accepts a JSON string containing an object whose keys are GUIDs andvalues are version strings. This will override the max version that theadd-on supports for the corresponding application GUID. E.g.:`{"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}": "6.*"}`<dt>--target-minversion<dd>Identical to `--target-maxversion`, except overrides the min versioninstead of the max.<dt>--for-appversions<dd>Accepts a JSON string containing an object whose keys are GUIDs andvalues are lists of version strings. If this list is specified,non-inlinecompatibility tests will only be run if they specificallytarget the applications and veresions in this parameter. E.g.:`{"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}": ["6.*"]}`</dl>### Expected Type:The expected type should be one of the following values:<dl><dt>any (default)<dd>Accepts any extension<dt>extension<dd>Accepts only extensions<dt>theme<dd>Accepts only themes<dt>dictionary<dd>Accepts only dictionaries<dt>languagepack<dd>Accepts only language packs<dt>search<dd>Accepts only OpenSearch XML files (unpackaged)<dt>multi<dd>Accepts only multi-item XPI packages</dl>Specifying an expected type will throw an error if the validatordoes not detect that particular type when scanning. All addon typedetection mechanisms are used to make this determination.### Output Type:The output type may be either of the following:<dl><dt>text (default)<dd>Outputs a textual summary of the addo-on analysis. Supports verbose mode.<dt>json<dd>Outputs a JSON snippet representing a full summary of the add-on analysis.</dl>## Output### Text Output Mode (default; `text`)In `text` output mode, output is structured in the format of onemessage per line. The messages are prefixed by their priority level(i.e.: "Warning: This is the message").At the head of the text output is a block describing what theadd-on type was determined to be.### JSON Output Mode (`json`)In `JSON` output mode, output is formatted as a JSON snippetcontaining all messages. The format for the JSON output is that of thesample document below.```js{"detected_type": "extension","errors": 2,"warnings": 1,"notices": 1,"success": false,"compatibility_summary": {"errors": 1,"warnings": 0,"notices": 0},"ending_tier": 4,"messages": [{"uid": "123456789","id": ["module", "function", "error"],"type": "error","message": "This is the error message text.","description": ["Description of the error message.","Additional description text"],"file": ["chrome/foo.jar", "bar/zap.js"],"line": 12,"column": 50,"context": ["   if(foo = bar())","       an_error_is_somewhere_on_this_line.prototy.eval(\"whatever\");",null],"compatibility_type": "error","for_appversions": {"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}": ["5.0a2", "6.0a1"]},"tier": 2}],"metadata": {"name": "Best Add-on Evar","version": "9000","guid": "foo@bar.com"}}```#### JSON Notes:##### File HierarchyWhen a subpackage exists, an angle bracket will delimit the subpackagename and the message text.If no applicable file is available (i.e.: when a file is missing), the`file` value will be empty. If a `file` value is available within asubpackage, then the `file` attribute will be a list containing thename of the outermost subpackage's name, followed by each successiveconcentric subpackage's name, followed by the name of the file that themessage was generated in. If no applicable file is available within asubpackage, the `file` attribute is identical, except the last elementof the list in the `file` attribute is an empty string.For instance, this tree would generate the following messages:```package_to_test.xpi||-install.rdf|-chrome.manifest|-subpackage.xpi|  ||  |-subsubpackage.xpi|     ||     |-chrome.manifest|     |-install.rdf||-subpackage.jar||-install.rdf``````js[{"type": "notice","message": "<em:type> not found in install.rdf","description": " ... ","file": "install.rdf","line": 0},{"type": "error","message": "Invalid chrome.manifest subject: override","description": " ... ","file": "chrome.manifest","line": 7},{"type": "error","message": "subpackage.xpi > install.rdf missing from theme","description": " ... ","file": ["subpackage.xpi", ""],"line": 0},{"type": "error","message": "subpackage.xpi > subsubpackage.xpi > Invalid chrome.manifest subject: sytle","description": " ... ","file": ["subpackage.xpi", "subsubpackage.xpi", "chrome.manifest"],"line": 5}]```##### Line Numbers and ColumnsLine numbers are 1-based. Column numbers are 0-based. This can beconfusing from a programmatic standpoint, but makes literal sense. "Lineone" would obviously refer to the first line of a file.##### ContextsThe context attribute of messages will either be a list or null. Nullcontexts represent the validator's inability to determine surroundingcode. As a list, there will always be three elements. Each elementrepresents a line surrounding the message's location.The middle element of the context list represents the line of interest. Ifan element of the context list is null, that line does not exist. Forinstance, if an error is on the first line of a file, the context mightlook like:```js[null,"This is the line with the error","This is the second line of the file"]```The same rule applies for the end of a file and for files with only one line.## TestingTests can be run with```bashpy.test tests/```Functional tests, which take longer, can be run with```bashpy.test functional_tests/```Then make a cup of tea while all of those tests run. It takes a while. If youhave more than two cores on your machine or you don't mind pwnage, you can tryto increase the number of parallel processes used for testing.## ReleasingFollow these steps to release a new version of the `amo-validator` Python package:1. Increment the `__version__` attribute at the top of`./validator/__init__.py`.2. Commit your change to the master branch and run `git push`.3. Tag master with the new version number, such as `git tag 1.9.8`.4. Push the new tag with `git push --tags`5. TravisCI will build and release a new version of `amo-validator`to PyPI from your tag commit.[Here is an example](https://travis-ci.org/mozilla/amo-validator/builds/90333989).## UpdatingSome regular maintenance needs to be performed on the validator in order tomake sure that the results are accurate.### App VersionsA list of Mozilla `<em:targetApplication>` values is stored in the`validator/app_versions.json` file. This must be updated to include the latestapplication versions. This information can be found on AMO:https://addons.mozilla.org/en-US/firefox/pages/appversions/### JS LibrariesLists of JS library hashes are kept to allow for whitelisting or warning. Thesemust be regenerated with each new library version. To update:```bashpython extras/update_hashes.py```To add new libraries to the mix, edit `extras/jslibfetcher.py` and add theversion number to the appropriate tuple.### JetpackIn order to maintain Jetpack compatibility, the whitelist hashes need to beregenerated with each successive Jetpack version. To rebuild the hash library,simply run:```bashcd jetpack./generate_jp_whitelist.sh```That's it!### Language PacksWith every version of every app that's released, the language pack referencesneed to be updated.We now have an automated tool to ease this tedious process. It is currentlydesigned to work on OS X with the OS X versions of Mozilla applications, thoughit could conceivably run on any \*NIX platform against the OS X applicationpackages.To run the tool, first create a new directory: `extras/language_controls/`Put the `.app` packages for each updated product into this directory. Oncethis is ready, simply run:```bashcd extraspython update_langpacks.py```That should be it. Note that this tool will fail horribly if any of the teamschange the locations that the various language files are stored in.Also note that this tool should only be run against the en-US versions of theseapplications.