Complete themes are less security-sensitive than other add-ons, but they still need to be implemented with great care so they don't break the way Firefox looks.
There's also the special case of multi-package installers, which are generally used to bundle a theme and a configuration extension. In this case both an extension review and a theme review are necessary.
Testing should be done on a new profile. The code validator doesn't have many useful tests for themes, but it should flag if there's any code in the theme. Reject if that's the case. If you see the "No em:type found" or "Unrecognized element <em:internalName>" warnings, they are worth bringing up to the developer as a note so they can fix it in the next version.
While reviewing themes, watch the Browser Console console for any CSS warnings that are flagged for chrome paths containing the word "skin". Warnings should be copied from the error console and pasted into review notes for the developer to investigate. Generally, warnings about CSS issues should not be grounds for withholding a review of a theme. However, providing notes to developers about CSS issues can be tremendously helpful to theme development.
|Text and/or buttons are difficult to read.||Reject|
|Theme has an inconsistent look.||Add note||You should avoid judging a theme for thinking it looks ugly, since it is a very subjective metric. However, themes should be consistent about their look.|
|UI elements don't fit within their boundaries and appear "clipped".||Add note||This is relevant for menus and dialogs. If anything's clipped and/or if resizing is required to see it completely, make a note of it and request the author to address the issue.|
|No preview image or unsuitable preview image.||Add note|
|Feature||Action on failure||What to test|
|Tab Strip||Add note||Tab through tab strip using Ctrl+Tab. Active tab should be visually different from other tabs.|
|Pinned tabs||Add note||Pin a tab and make sure it's visually different from other tabs.|
|Group tabs||Add note||Activate group tabs using Ctrl+Shift+E. The highlighted tab should be visually different from other tabs. Use the up/down/left/right arrows to navigate from tab to tab and then press enter to open the desired tab.|
|Menu Bar||Add note||Activate the file menu using Alt+F and then use keyboard to navigate through menus and sub-menus. The selected menu item must be visually different and the highlighted text must be legible.|
|Edit > Find||Reject||Make sure find toolbar is styled appropriately and functions correctly.|
|View > Toolbars > Customize||Reject||Make sure the customization UI is formatted reasonably.|
|RSS button||Add note||Place RSS button on toolbar and make sure its appearance is different for pages that have RSS feeds (like AMO) from those that don't. Test looking at the feed and subscribing to it.|
|View > Toolbars > Bookmarks Toolbar||Reject||Make sure toolbar is formatted reasonably.|
|View > Sidebar > Bookmarks and View > Sidebar > History||Reject||Make sure sidebar is formatted appropriately.|
|Bookmark Star button||Reject||Clicking on it once will show an animation and bookmark the page. The star button should change state. Clicking on it again shows a "door hanger" dialog. Make sure they are all formatted reasonably.|
|History > Show All History||Reject||Make sure history/bookmarks library is formatted appropriately. Drill in to a specific bookmark/history item. Test drop down menus and forward/back buttons.|
|Tools > Set Up Sync||Reject||Work through the sync dialog as if you are creating a new account and connecting to a device (completion of account creation and connecting not necessary). Make sure Sync is formatted appropriately and things seem to work.|
|Preferences / Options window||Reject||Make sure all tabs are formatted and functioning correctly. Make sure you can navigate around the options panel and that you know what has focus. You must be able to change tabs and settings from the keyboard.|
|Help > About||Reject||Make sure it is styled appropriately and must use an appropriate Firefox logo.|
|View > Enter Full Screen||Reject||Make sure it is formatted reasonably and functions correctly.|
|Web Developer Tools||Add note||Make sure the all tools open correctly and their UI is usable. Note that the developer tools aren't required to be styled by a theme.|
Identity boxes are an important user facing security feature that must be carefully inspected to make sure they function properly. For each style of identity box, make sure to click on the identity box icon to make sure the drop down door hanger is styled reasonably and contains the appropriate icons. Failing any of these tests means the theme needs to be rejected.
|Security Level||What to test|
|HTTPS Extended Identity||
|HTTPS Basic Identity||
|HTTP Unsecured Connection||
All of the following URLs should be tested.
|URL||Policy on failure||What to test|
|about:addons||Reject||Make sure formatting is reasonable. Add-on type tabs need distinct icons. Make sure there is a significant difference between enabled and disabled add-ons.|
|about:config||Add note||Make sure it is formatted correctly.|
|about:permissions||Add note||Make sure it is formatted correctly.|
|AMO||Reject||Log in to AMO, making sure the save password panel is formatted reasonably and includes an appropriate key icon.|
|Mozilla's Mission||Reject||Use video controls in embedded HTML5 video to make sure they look reasonable and function correctly. Press play button for video and make sure the play icon is replaced with a pause icon.|
|Non-AMO extension install||Reject||Click on the install link and make sure a prompt appears in the identity box verifying whether or not to install extension.|
|Mozilla geolocation Test||Reject||Click on link labeled "Give it a try" and then the "where am I" button to activate geolocation alert. Make sure it displays correctly.|
|Mozilla phishing test page||Reject||Phishing warning test page. Check notification strip after ignoring phishing warning. To reset warning go to history menu and open "show all history" then right mouse click on this page's entry and select "forget about this site".|
|Mozilla malware test page||Reject||Malware warning page. Check notification strip after ignoring malware warning. To reset warning go to history menu and open "show all history" then right mouse click on this page's entry and select "forget about this site".|
|Mozilla unwanted software test page (new in Firefox 39)||Reject||Warning about downloads containing unwanted software (e.g. bundled with toolbars) test page. Check notification strip after ignoring warning. To reset warning go to history menu and open "show all history" then right mouse click on this page's entry and select "forget about this site".|
|https://22.214.171.124/||Reject||Untrusted connection alert. Click on identity box to test drop down details.|
|jar:https://bugzilla.mozilla.org/attachment.cgi?id=288634!/||Reject||Unsafe Remote File Type. Access denied. Make sure it is formatted reasonably.|
|Mozilla FTP Archive||Reject||FTP. Make sure it is formatted reasonably.|
|chrome://global/content/bindings/textbox.xml||Add note||Unformatted XML Preview. Make sure it is formatted reasonably.|
|Additional "about" pages.||Add note|| Make sure the following "about" pages are formatted reasonably:
OS Specific Issues
- Unstyled Firefox button: improperly or totally unstyled Firefox button, and/or the Firefox button not changing styling when in private browsing mode.
- Strong black borders around URL Bar doorhangers (drop down panels): many Windows-based themes make use of the box-shadow style rule, however, it is not supported on Linux Firefox and resulting in the strong black border.