1363859 - Allow WebExtensions to disable JavaScript

Status: RESOLVED WONTFIX

(WebExtensions :: General, enhancement, P2)

Description

[Bob Silverberg [:bsilverberg]]

This will use browserSetting [1] to manage which extension has control over the pref. This does not really belong in privacy so will go into the browserSettings API.

[1] https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/privacy/BrowserSetting

Comment 1

[Kris Maglione [:kmag]]

This is no longer a supported configuration. Allowing add-ons to change this on a per-site basis is one thing, but changing it for the entire browser is a different matter.

Comment 2

[Bob Silverberg [:bsilverberg]]

Updating the title to describe the use case, rather than the implementation. 

Kris, if this is no longer supported is there something else we can do to support this requirement, or are you saying we just need to WONTFIX this?

Comment 3

[Bob Silverberg [:bsilverberg]]

Oops, I realize that changing the title removed any reference to the pref that was being proposed for this purpose. The pref to flip is proposed as `javascript.enabled`.

Comment 4

[Tomislav Jovanovic :zombie]

(In reply to Bob Silverberg [:bsilverberg] from comment #2)
> Kris, if this is no longer supported is there something else we can do to
> support this requirement, or are you saying we just need to WONTFIX this?

I think we don't want to allow extensions to disable javascript globally, so we don't wanna be flipping the pref in this bug.

As for disabling on a per-domain or page basis, that would require additional support code, so this bug should probably go through triage.

Comment 5

[Bob Silverberg [:bsilverberg]]

(In reply to Tomislav Jovanovic :zombie from comment #4)
> 
> I think we don't want to allow extensions to disable javascript globally, so
> we don't wanna be flipping the pref in this bug.
> 
> As for disabling on a per-domain or page basis, that would require
> additional support code, so this bug should probably go through triage.

Well, right now we are only looking at settings which control the browser globally. Settings which will apply on a per-domain basis is something we may look at down the road, so I don't think we need to keep this bug open for that. A separate bug can be opened for disabling JS on a per-domain basis if that is something that is needed in the future.

Comment 6

[Andy McKay]

I was thinking about this on the weekend and I'm a bit worried about this one too. Basically in a modern web this means "make my browser almost unusable". A large amount of the internet won't work anymore. It feels like JS is a required component of the browser and if you don't want this, perhaps you a different browser or a different build of this browser. Or perhaps you go to about:config.

Looking in the add-ons DXR tree, there a few add-ons that read it (seems legit use case), a few old add-ons that change it and a few "quick config flip" style add-ons.

This kinda retreads arguments from bug 851702. I'll note that this setting is in devtools and is something like "Disable JavaScript: Current session only, reloads the page". Perhaps our API should allow us quick access to whatever devtools such. Or perhaps this should be moved into content settings.

Comment 7

[Bob Silverberg [:bsilverberg]]

Caitlin, can you please add this to the next design-decision-needed triage? It sounds like we need to make a group decision about this.

Comment 8

[Caitlin Neiman [:caitmuenster]]

Hi all, this has been added to the agenda for the May 23 WebExtension APIs triage. Looking forward to discussing this! 

Wiki: https://wiki.mozilla.org/Add-ons/Contribute/Triage

Agenda: https://docs.google.com/document/d/1-j08Zo4sbwAuRZndNNtdIRlDM8TblddDA-PAeRgYMWU/edit#

Comment 9

[Bob Silverberg [:bsilverberg]]

We will not be providing at API to disable JavaScript globally. If there is a desire for an API to disable JavaScript on a site-by-site basis, a new bug can be opened for that.

Comment 10

[Geoffrey De Belie (Smile4ever)]

"Allow WebExtensions to disable JavaScript for a specific domain" filed as bug 1367161