1227453 - chrome.cookies API doesn't check host permissions

Status: RESOLVED DUPLICATE of bug 1210996

(WebExtensions :: Untriaged, defect)

Description

[Muneaki Nishimura]

Attachment: cookies.xpi

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36

Steps to reproduce:

The 'chrome.cookies' API for WebExtensions ignores host permissions. It allows an extension having no host permission to access all domain's cookie data in Firefox.
Attached is a sample extension that can reproduce the issue.


Actual results:

When you click the button of this extension you can see all cookies in Firefox regardless of their origin. However manifest.json of this extension declares "http://csrf.jp/*" only.



Expected results:

The same API in Chrome restricts access of cookie by both 'cookies' and host permissions (see following URL). Firefox should have the same restriction.
https://developer.chrome.com/extensions/cookies