Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-26 22:32:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1917000 - Stop injecting after "userScripts" revocation r=zombie

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D229715
This commit is contained in:
Rob Wu 2024-11-22 16:03:11 +00:00
parent ce07cca0f1
commit ea38eaf128
3 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
toolkit/components/extensions/WebExtensionPolicy.cpp
View File

@ -825,6 +825,12 @@ bool MozDocumentMatcher::Matches(const DocInfo& aDoc,
return false;
}
if (mIsUserScript && mExtension &&
!mExtension->HasPermission(nsGkAtoms::userScripts)) {
// The "userScripts" permission can be revoked after script registration.
return false;
}
// Top-level about:blank is a special case. Unlike about:blank frames/windows
// opened by web pages, these do not have an origin that could be matched by
// a match pattern (they have a null principal instead). To allow extensions

20
toolkit/components/extensions/test/xpcshell/test_ext_userScripts_mv3_injection.js
View File

@ -53,6 +53,12 @@ add_task(async function userScript_runs_in_MAIN_world() {
"6.file.js": "resultCollector.push('6.file');dump('6.file.js ran\\n');",
},
async background() {
browser.test.onMessage.addListener(async msg => {
browser.test.assertEq("revoke_permission", msg, "Expected msg");
await browser.permissions.remove({ permissions: ["userScripts"] });
browser.test.assertEq(undefined, browser.userScripts, "API gone");
browser.test.sendMessage("revoke_permission:done");
});
await browser.userScripts.register([
{
id: "basic",
@ -97,6 +103,20 @@ add_task(async function userScript_runs_in_MAIN_world() {
await contentPageAfterRegister.close();
await contentPageBeforeExtStarted.close();
// Verify that when the "userScripts" permission is revoked, that scripts
// won't be injected in new documents.
extension.sendMessage("revoke_permission");
await extension.awaitMessage("revoke_permission:done");
let contentPageAfterRevoke = await ExtensionTestUtils.loadContentPage(
"http://example.com/resultCollector"
);
Assert.deepEqual(
await collectResults(contentPageAfterRevoke),
[],
"Should not execute after permission revocation"
);
await contentPageAfterRevoke.close();
await extension.unload();
});

1
xpcom/ds/StaticAtoms.py
View File

@ -2034,6 +2034,7 @@ STATIC_ATOMS = [
Atom("privateBrowsingAllowedPermission", "internal:privateBrowsingAllowed"),
Atom("svgContextPropertiesAllowedPermission", "internal:svgContextPropertiesAllowed"),
Atom("theme", "theme"),
Atom("userScripts", "userScripts"),
# CSS Counter Styles
Atom("decimal_leading_zero", "decimal-leading-zero"),
Atom("arabic_indic", "arabic-indic"),