How to solve "We dont allow add-ons to use remote APIs"

Add-ons Development
1

Hello :slight_smile:

I got this Feedback from a reviewer:

  1. We don’t allow add-ons to use remote APIs because they can create serious security vulnerabilities. Please insert those APIs locally from your add-on code.

I do not understand the last sentence…

How to solve it? How to get data from remote sites (like to insert in local plugin database)?

I am wondering about this, because other toolbar also fetch data via API and they are not declined.

If here is a reviewer in forum, I can give extension name.

Thank you.
Best regards,
Sven

2

Which addon is it?

Remote scripts are not allowed. Some scripts can be included in the addon.

3

Yes, but the reviewer wrote remote API. I think its a write error. Its the addon with that UUID

{60361262-f72d-484e-b047-a231a277c1de}

You checked the addon before and we resolved all open issues. Then another reviewer denied it with that confusing message…

Thank you for checking :slight_smile:

4

Only Admin can find addons by their ID. I need a normal URL or at least a name.

5

Name is: CASHCOW - Das CashBack-Tool
Account Username: wonderunited

6

store.min.js is still minified and requires unminified source uploaded and then it goes into the admin queue.

There are 73 JS files. Do you need to use JQuery localisation with 58 minified JS files?

Where do you get a remote script?

7

I dont know where to upload unmified source. But here is the github project with full sources:


I removed unused localisation files … Uploaded that in new version 0.1.7
What do you mean with last question? I dont use any remote script …

8

That was the reason for rejection… remote script/API

So where does it happen so I can check?

9

user.js Line 270 (Ajax Request)
user.js Line 343 (XMLHttpRequest)

10

Depending on how the data is used, it can be OK.

  • Addon needs a privacy policy.
  • Data must be sent with user consent (opt-in or from user action e.g. login)
  • The received data (JSON), if inserted in a document, must be inserted as text (not html./innerHTML etc)
11

Thank you for your reply.

(1) I can add privacy policy text under Login form?
(2) I add sentence to login form, that data will sent to login remote
(3) do you know a quote/secure function? I have to do something like this:
element.html(’[p]’+securefunc(rawdatafromjson)+’[/p]’)
Can I do that? Because I also must add static html + received raw data

I found that jQuery way:

‘[p]’+$(rawremotedata).text()+’[/p]’

12

No… Privacy Policy for the addon.
We require add-ons which send potentially private or personally identifiable information to provide a Privacy Policy detailing what information is sent, and how that information is used and protected.

Privacy Policy should be an actual text, not just a link to a website.

Please go to Edit your addon

Manage Authors & License
Privacy Policy

Also mention in Addon’s description

No… that would get rejected

If you are using JQuery, something like this; (I dont use JQuery)

$('#box').append(
  $('<div/>')
    .attr("id", "newDiv1")
    .addClass("newDiv purple bloated")
    .append("<span/>")
      .text("hello world")
);

The important part is the remote data must be added as TEXT eg .text(rawdatafromjson)

13

Thank you for the feedback. I resolved all issues with new version 0.1.9. Please check …