Bug 1251729 - Don't use eval for distribution.js; r=mixedpuppy

browser/components/distribution.js

@@ -351,7 +351,7 @@ DistributionCustomizer.prototype = {
     if (sections["Preferences"]) {
       for (let key of enumerate(this._ini.getKeys("Preferences"))) {
         try {
-          let value = eval(this._ini.getString("Preferences", key));
+          let value = parseValue(this._ini.getString("Preferences", key));
           switch (typeof value) {
           case "boolean":
             defaults.setBoolPref(key, value);
@@ -382,7 +382,7 @@ DistributionCustomizer.prototype = {
     if (sections["LocalizablePreferences-" + this._locale]) {
       for (let key of enumerate(this._ini.getKeys("LocalizablePreferences-" + this._locale))) {
         try {
-          let value = eval(this._ini.getString("LocalizablePreferences-" + this._locale, key));
+          let value = parseValue(this._ini.getString("LocalizablePreferences-" + this._locale, key));
           if (value !== undefined) {
             localizedStr.data = "data:text/plain," + key + "=" + value;
             defaults.setComplexValue(key, Ci.nsIPrefLocalizedString, localizedStr);
@@ -398,7 +398,7 @@ DistributionCustomizer.prototype = {
           continue;
         }
         try {
-          let value = eval(this._ini.getString("LocalizablePreferences-" + this._language, key));
+          let value = parseValue(this._ini.getString("LocalizablePreferences-" + this._language, key));
           if (value !== undefined) {
             localizedStr.data = "data:text/plain," + key + "=" + value;
             defaults.setComplexValue(key, Ci.nsIPrefLocalizedString, localizedStr);
@@ -414,7 +414,7 @@ DistributionCustomizer.prototype = {
           continue;
         }
         try {
-          let value = eval(this._ini.getString("LocalizablePreferences", key));
+          let value = parseValue(this._ini.getString("LocalizablePreferences", key));
           if (value !== undefined) {
             value = value.replace(/%LOCALE%/g, this._locale);
             value = value.replace(/%LANGUAGE%/g, this._language);
@@ -458,6 +458,19 @@ DistributionCustomizer.prototype = {
   }
 };
 
+function parseValue(value) {
+  try {
+    value = JSON.parse(value);
+  } catch (e) {
+    // JSON.parse catches numbers and booleans.
+    // Anything else, we assume is a string.
+    // Remove the quotes that aren't needed anymore.
+    value = value.replace(/^"/, "");
+    value = value.replace(/"$/, "");
+  }
+  return value;
+}
+
 function* enumerate(UTF8Enumerator) {
   while (UTF8Enumerator.hasMore())
     yield UTF8Enumerator.getNext();

browser/components/tests/unit/test_distribution.js

@@ -63,7 +63,7 @@ add_task(function* () {
   glue.observe(null, TOPIC_BROWSERGLUE_TEST, TOPICDATA_DISTRIBUTION_CUSTOMIZATION);
 
   Assert.equal(Services.prefs.getCharPref("distribution.test.string"), "Test String");
-  Assert.throws(() => Services.prefs.getCharPref("distribution.test.string.noquotes"));
+  Assert.equal(Services.prefs.getCharPref("distribution.test.string.noquotes"), "Test String");
   Assert.equal(Services.prefs.getIntPref("distribution.test.int"), 777);
   Assert.equal(Services.prefs.getBoolPref("distribution.test.bool.true"), true);
   Assert.equal(Services.prefs.getBoolPref("distribution.test.bool.false"), false);