Closed Bug 1237822 Opened 4 years ago Closed 4 years ago

"tabs" permission is needed to query by URL

Categories

(WebExtensions :: Untriaged, defect, P4)

defect

Tracking

(firefox48 verified, firefox52 verified)

VERIFIED FIXED
mozilla48
Tracking Status
firefox48 --- verified
firefox52 --- verified

People

(Reporter: wbamberg, Assigned: tofumatt)

Details

(Whiteboard: [permissions][berlin][good first bug] triaged)

Attachments

(2 files)

Attached file query.xpi
I've attached an extension that adds a browser action: when you click the browser action the extension runs code like this:

function query() {
   chrome.tabs.query({'url': "http://www.bbc.com/"},
                     (tabs) => {console.log(tabs.length);}); 
 }

This fails, because in the code here: https://dxr.mozilla.org/mozilla-central/source/browser/components/extensions/ext-tabs.js#431, tab.url is undefined.

If I give the extension the "tabs" permission, it works.

The same extension works in Chrome without needing the "tabs" permission.
Flags: blocking-webextensions?
Whiteboard: [permissions]
Honestly, I think our behavior is closer to correct. It definitely shouldn't throw, but if you're not meant to be able to access tab URLs, you also shouldn't be able to do things that let you probe for them.
I agree with you, I think, but we should be clear that correctness is worth introducing the incompatibility.

Anyway, I've noted this in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Chrome_incompatibilities and https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/permissions.
Priority: -- → P4
Whiteboard: [permissions] → [permissions] triaged
Flags: blocking-webextensions? → blocking-webextensions+
Whiteboard: [permissions] triaged → [permissions][berlin] triaged
Whiteboard: [permissions][berlin] triaged → [permissions][berlin][good first bug] triaged
Do we agree to WONTFIX this?
No, we still need to handle it properly. We should probably just throw if an extension without "tabs" permissions tries to query based on these properties.
Assignee: nobody → tofumatt
Comment on attachment 8730735 [details]
MozReview Request: bug 1237822: Throw error if tabs.query is used without "tabs" permission with url param r?kmag

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/40129/diff/1-2/
Comment on attachment 8730735 [details]
MozReview Request: bug 1237822: Throw error if tabs.query is used without "tabs" permission with url param r?kmag

https://reviewboard.mozilla.org/r/40129/#review36657

Thanks

::: browser/components/extensions/ext-tabs.js:557
(Diff revision 2)
>  
>        query: function(queryInfo) {
>          let pattern = null;
>          if (queryInfo.url !== null) {
> +          if (!extension.hasPermission("tabs")) {
> +            return Promise.reject({message: 'The "tabs" permission is required to use the query API'});

It's only required to query by URL.
Attachment #8730735 - Flags: review?(kmaglione+bmo) → review+
Comment on attachment 8730735 [details]
MozReview Request: bug 1237822: Throw error if tabs.query is used without "tabs" permission with url param r?kmag

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/40129/diff/2-3/
Attachment #8730735 - Attachment description: MozReview Request: bug 1237822: Throw error if tabs.query is used without "tabs" permission r?kmag → MozReview Request: bug 1237822: Throw error if tabs.query is used without "tabs" permission with url param r?kmag
https://reviewboard.mozilla.org/r/40129/#review36657

> It's only required to query by URL.

Thanks, updated the error message to explicitly mention the "url" param.
Tests seem good, how do I get this merged?
Just add the checkin-needed keyword.
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/76d23219d38e
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
I could reproduce this issue on Firefox 48.0a1 (20160321030217), here is a video: https://www.dropbox.com/s/xyz7liol0d6f4cw/error1.gif?dl=0

This issues is verified as fixed on Firefox 48.0a1 (20160324154036)and Firefox 52.0a1 (20160922030437) under Windows 7 64-bit, the error message: “ 'The "tabs" permission is required to use the query API with the "url" parameter “ is displayed in the browser console, here is a video: https://www.dropbox.com/s/av3r5rf7fs1uvj1/error2.gif?dl=0
Status: RESOLVED → VERIFIED
Product: Toolkit → WebExtensions
You need to log in before you can comment on or make changes to this bug.