<rant>
I use Zotero, a “free, easy-to-use tool to help you collect, organize, annotate, cite, and share research” (from their website). Zotero is based on Firefox and users can install addons from XPI files. I looking to install a DOM-Inspector to Zotero and I subsequently found zotero-inspector on Github. Upon going to the releases page, I clicked on the xpi file only to see an alert pop up in Firefox:
“The add-on downloaded from this site could not be installed because it appears to be corrupt.”
Needless to say, this alert unsettled me. I didn’t like that some code ran to to check whether an add-on was install-able when I didn’t ask for it. If I really wanted to install an addon, I should be able to install add-on from file via an option in Firefox’s settings. Another possibility would be to let users decide what they wish to do with xpi files. In Firefox Settings > General > Files and Applications, users have the ability to “choose how firefox handle the files (they) download from the web”. Right underneath, the choice “what should firefox do with other files” has the option “ask whether to open or save files”. Considering that an xpi file is, well, a file, perhaps Firefox should have a special pop-up asking whether users wish to save the file or install the file.
To ‘disable’ this, you should create xpinstall.enabled in about:config and
set it to false — from: https://support.mozilla.org/en-US/questions/888009.
Note that this disables adding xpi files as a whole.
With that being said, here’s a way you can test it yourself.
WARNING: Do this ONLY if you wish to do so! Firefox will automatically try to install/parse dipdip.xpi (to check if it’s valid) but will see a corrupted file. The xpi file itself it a txt file with very little content so it should do no harm. You have been warned! I’ve only tested this on Firefox 122.0.1 on Linux (snap) so it may vary on other versions & OS’.
Download: dipdip.xpi
I… don’t know if this should be allowed. It just feels wrong.
</rant>
In order to get dipdip.xpi to auto-install instead of downloading, I set these HTTP headers in my web server for the dipdip.xpi resource:
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Content-Type: application/x-xpinstall (only this is important)