1227451 - chrome.alarms API doesn't check 'alarms' permission

Status: VERIFIED FIXED

(WebExtensions :: Untriaged, defect)

Description

[Muneaki Nishimura]

Attachment: alarms.xpi

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36

Steps to reproduce:

The 'chrome.alarms' API for WebExtensions ignores 'alarms' permission so any extensions can set alarms without user's consent.

Attached is a sample extension that can reproduce the issue.


Actual results:

When you click the button of this extension and wait for few seconds an alert dialog is opened from the chrome.alarms.onAlarm handler. However, manifest.json of this extension doesn't declare any permissions.


Expected results:

The chrome.alarms property should be invisible if an extension doesn't declare 'alarms' permission in their manifest.json.

MDN says 'alarms' permission is "currently available" but it's not implemented appropriately.
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/permissions

Comment 1

[Andy McKay]

Permissions haven't been implemented yet. Does this need to be a security bug?

Comment 2

[Daniel Veditz [:dveditz]]

Maybe the MDN documentation could mention that? Is there a bug filed on that work?

Comment 3

[Andy McKay]

The one I found 1197420 implements the permissions API which is related to the permissions in the manifest. This does raise a more interesting question of should all this structure be in place before more APIs are written. Otherwise we'll be generating security bugs all over the place.

Comment 4

[Andy McKay]

So it turns out some have been implemented, not others.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

This should be a one-line change. I didn't know about the alarms permission.

Comment 6

[Luca Greco [:rpl] [:luca] [:lgreco]]

Attachment: 0001-Bug-1227451-chrome.alarms-API-doesn-t-check-alarms-p.patch

This patch turns the "registeredAPI" alarms API into a "registeredPrivilegedAPI" and add a new test case into "test_ext_alarms.html" to check that the alarm API object is not enabled if the permission is not declared by the addon in the manifest.

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/fx-team/rev/695b6cd72017

Comment 8

[Kris Maglione [:kmag]]

https://hg.mozilla.org/integration/fx-team/rev/77417c5e122e5850aadfb362aa1ff8e118814199
Bug 1227451: Follow-up: Fix ESLint errors. r=trivial

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/695b6cd72017
https://hg.mozilla.org/mozilla-central/rev/77417c5e122e

Comment 10

[Vasilica Tamas, QA [:vtamas]]

I was able to reproduce the initial issue on Firefox 44.0a1 (2015-10-21) under Windows 10 64-bit.

The alert dialog is no longer displayed on Firefox 46.0b6 (20160328182534) and Firefox 48.0a1 (2016-03-27/28) under Windows 10 64-bit, Mac OS X 10.11.2 and Ubuntu 12.04 32-bit.