Bug 1213919 - Need to use a 'permitted-list' for handling certificates when opening signed packages for reviewers r=ferjm

b2g/app/b2g.js

@@ -1065,6 +1065,7 @@ pref("dom.wakelock.enabled", true);
 
 // Enable webapps add-ons
 pref("dom.apps.customization.enabled", true);
+pref("dom.apps.reviewer_paths", "/reviewers/,/content/addon/review/");
 
 // New implementation to unify touch-caret and selection-carets.
 pref("layout.accessiblecaret.enabled", true);

dom/apps/Webapps.jsm

@@ -3747,7 +3747,15 @@ this.DOMApplicationRegistry = {
           break;
 
         case "https://marketplace-dev.allizom.org":
-          root = manifestPath.startsWith("/reviewers/")
+          // There are different reviewer paths for apps & addons so we keep
+          // them in a comma separated preference.
+          bool isReviewer = false;
+          try {
+            let reviewerPaths =
+              Services.prefs.getCharPref("dom.apps.reviewer_paths").split(",");
+            isReviewer = reviewerPaths.some(path => { return manifestPath.startsWith(path); });
+          } catch(e) {}
+          root = isReviewer
                ? Ci.nsIX509CertDB.AppMarketplaceDevReviewersRoot
                : Ci.nsIX509CertDB.AppMarketplaceDevPublicRoot;
           break;