This patch does not make some header files stop including the inline
header because fixing them require more changes.
Note that `#include "nsComponentManagerUtils.h"` is fixing a bustage
caused by "use of undeclared identifier 'do_CreateInstance'" error.
Differential Revision: https://phabricator.services.mozilla.com/D304432
This patch introduces the backend to gate file access on an internal
permission. File access to extensions is already limited, to content
scripts only. All calls of CanAccessURI that set aAllowFilePermission to
true have been audited and updated with comments as needed.
The UI to manage this internal permission is part of the next patch.
Differential Revision: https://phabricator.services.mozilla.com/D300598
When an extension resource is exposed via web_accessible_resources with
"matches" including "<all_urls>", it should be exposed to any URL.
This did not happen for sandboxed documents, because those have a null
principal that serializes to a URL with the "moz-nullprincipal" scheme.
To get this to work, permit requests from schemes unknown to
MatchPattern when `matches` contains `<all_urls>` (and `*://*/*`).
This patch also includes test coverage for requests from file:-URLs,
because that did not exist before, and a naive implementation (that
accepts any request if MatchesAllWebUrls is true) could inadvertently
permit requests from non-sandboxed file:-URLs. The unit tests ensure
that this does not and will not happen.
Differential Revision: https://phabricator.services.mozilla.com/D298074
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
It is replaced by a standard-conforming cast to (void) which is
understood the same by the compiler.
In some cases this could be replaced by `[[maybe_unused]]` but for
expression whose value is ignored, this requires storing to a temporary
variable first, so not going that way.
One notable change is that marking an object of type already_AddRefed as
unused used to implicitly leak memory. This is now made explicit.
Most of the heavy lifting was done through:
$ git grep -l '\<Unused\> <<' | xargs sed -i -e 's/Unused << /(void)/g'
$ git grep -l mozilla/Unused.h | xargs sed -i -e '/mozilla\/Unused.h/ d'
Differential Revision: https://phabricator.services.mozilla.com/D268706
And add clarifying comments in Troubleshoot.sys.mjs to help future
developers with using the lists in the correct way.
Add `extensions.backgroundServiceWorker.enabled` to `PREFS_FOR_DISPLAY`
because it may control extension behavior, currently only on Nightly.
It now shows up in `about:support` iff the pref value was changed.
Differential Revision: https://phabricator.services.mozilla.com/D241614
This patch adds the USER_SCRIPT value as a supported value in the
internal WebExtensionContentScript constructor.
This patch does not introduce a distinct USER_SCRIPT sandbox yet; that
will be done in the next patch.
Differential Revision: https://phabricator.services.mozilla.com/D228973
Previously, the WebExtension protocol used dynamic protocol flags which
were based on the WebExtension policy in order to enforce things such as
availability in private browsing and the accessibility of certain
resources.
Since the shift to MV3, these checks have required more complex checks
than what was possible to specify with protocol flags, which required
the addition of WEBEXT_URI_WEB_ACCESSIBLE - a security flag which would
trigger further checks with the EPS to determine if the URI can be
loaded.
This was somewhat inefficient, as fetching the URI flags would require
looking up the policy each time dynamic flags were looked up, as well as
when policy specifics were being checked after loading flags. In
addition, it lead to a number of flags which were very specific to
extension protocols.
This patch changes extensions to no longer have dynamic flags, instead
specifying the static `URI_IS_WEBEXTENSION_RESOURCE` security flag. When
this flag is specified, security checks are made by querying the
ExtensionPolicyService to ask if the load should be permitted, combining
the specific security checks for Extension resources into a simpler
code-path, and avoids redundant checks.
Differential Revision: https://phabricator.services.mozilla.com/D216076
The primary change of this patch is to add IsInitialDocument() to the
"is this an about blank document where I should be able to run scripts
despite it not having a matching origin" logic. This is to avoid
scheduling content scripts in top-level about:blank in the parent
process as mentioned in the bug report.
The original use case (supporting execution in top-level about:blank)
continues to be supported, which is demonstrated by the still passing
tests in test_ext_contentscript_about_blank.html. A new regression test
was added (test_toplevel_aboutblank_at_document_start) in the same file,
which fails before the fix when run with --tag=in-process-webextensions
due to unexpected extra messages like the bug, and passes with the fix.
Differential Revision: https://phabricator.services.mozilla.com/D213439
The primary change of this patch is to add IsInitialDocument() to the
"is this an about blank document where I should be able to run scripts
despite it not having a matching origin" logic. This is to avoid
scheduling content scripts in top-level about:blank in the parent
process as mentioned in the bug report.
The original use case (supporting execution in top-level about:blank)
continues to be supported, which is demonstrated by the still passing
tests in test_ext_contentscript_about_blank.html. A new regression test
was added (test_toplevel_aboutblank_at_document_start) in the same file,
which fails before the fix when run with --tag=in-process-webextensions
due to unexpected extra messages like the bug, and passes with the fix.
Differential Revision: https://phabricator.services.mozilla.com/D213439
Adds match_origin_as_fallback support to content_scripts declared
statically in manifest.json.
Support for this option in dynamic registration and execution will be
handled in the next patches.
Differential Revision: https://phabricator.services.mozilla.com/D209368
This patch adds support for matching http(s) (and file:) documents even
if they are sandboxed. Previously, there was no way for extensions to
run content scripts there.
Differential Revision: https://phabricator.services.mozilla.com/D209367
ExtensionPolicyService::InjectContentScripts has two code paths, one
with preloading and one without. The most important case, without
preloading (i.e. executing immediately) is covered extensively by unit
tests. The preloading case had zero test coverage before.
Due to existing implementation limitations (*), the actual behavior of
preloading differs logically from the non-preloading case. Before making
any changes to the area, this patch adds documentation (mainly to
DocInfo::PrincipalURL and DocInfo::Principal) and extensive test
coverage to explicitly confirm the correctness of preloading behavior.
(*) in short: with DOMWindow (non-preloading), the principal is always
known and available, whereas with LoadInfo (preloading), the principal
has to be reconstructed, but without enough information available to
tell the difference for null principals.
Differential Revision: https://phabricator.services.mozilla.com/D209366
This patch changes the behavior as follows:
- match_about_blank in content_scripts in manifest.json will now only
run in top-level about:blank if its `matches` key specifies a match
pattern set that is equivalent to all http(s) URLs.
- matchAboutBlank in tabs.executeScript requires activeTab permission
(as before), or an all-URLs host permission.
Differential Revision: https://phabricator.services.mozilla.com/D189492
Introduce `MatchPatternSet::MatchesAllWebUrls()` and
`MatchPattern::MatchesAllWebUrls()` to serve the purpose of determining
whether a match pattern is going to match any http(s) URL.
Differential Revision: https://phabricator.services.mozilla.com/D189491
Masayuki Nakano