ubuntu-appstore-developers team mailing list archive

[Jamie Strandboge <jamie@xxxxxxxxxxxxx>]

On 07/18/2013 12:31 PM, Colin Watson wrote:
> On Thu, Jul 18, 2013 at 12:23:21PM -0500, Jamie Strandboge wrote:
> +
> + * An "application ID" is a string unique to each application instance: it
> +   is made up of the Click package name, the application name, and the Click
> +   package version joined by underscores, e.g.
> +   ``com.ubuntu.clock_alarm_0.1``.

Since '_' is the delimiter, we need to make sure that package name, application
name and package version do not allow underscores to prevent abuse. IIRC, click
is using Debian package conventions for name and version-- can you do the same
for application name?

(As an aside, either click or the app review process is going to have to make
sure we are doing proper input sanitization for embedded '\0' and all kinds of
other stuff -- not saying we haven't been, just saying :)

-- 
Jamie Strandboge                 http://www.ubuntu.com/

Attachment: signature.asc
Description: OpenPGP digital signature