Issue #1909 - Guard against empty update manifest URL

When installing an incompatible add-on, the add-ons manager checks first if a newer and compatible version of that add-on is available by sending a request either to the AUS or the provided update URL in the manifest.

If there's no update URL in the manifest and if the application does not provide an add-on update URL via preferences, the add-ons manager will error out and fail to notify that the said add-on is incompatible.

This commit addresses that by:
(a) preventing substitutions on the update manifest URL - this throws an error if it's empty; and
(b) failing early in the add-on update checker if the update manifest URL is empty and sends out an error notification

1 files changed, 8 insertions, 0 deletions

diff --git a/toolkit/mozapps/extensions/internal/AddonUpdateChecker.jsm b/toolkit/mozapps/extensions/internal/AddonUpdateChecker.jsm
index 0dfb7cd109..7eb8c9b9d5 100644
--- a/toolkit/mozapps/extensions/internal/AddonUpdateChecker.jsm
+++ b/toolkit/mozapps/extensions/internal/AddonUpdateChecker.jsm
@@ -611,6 +611,14 @@ function UpdateParser(aId, aUpdateKey, aUrl, aObserver) {
   let requireBuiltIn = Services.prefs.getBoolPref(PREF_UPDATE_REQUIREBUILTINCERTS, true);
 
   logger.debug("Requesting " + aUrl);
+
+  if (!aUrl) {
+    logger.warn("Request failed: empty update manifest URL");
+    this._doneAt = new Error("UP_emptyManifestURL");
+    this.notifyError(AddonUpdateChecker.ERROR_DOWNLOAD_ERROR);
+    return;
+  }
+
   try {
     this.request = new ServiceRequest();
     this.request.open("GET", this.url, true);