1238722 - installing add-ons from uri needs to use default user context id in origin attributes.

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, defect)

Description

[Dave Huseby [:huseby]]

in the file toolkit/mozapps/extensions/AddonManager.jsm we create a principal from an add-on URI with this code:

> 331   if (principalOrURI instanceof Ci.nsIURI) {
> 332     return Services.scriptSecurityManager.createCodebasePrincipal(principalOrURI, {
> 333       inBrowser: true
> 334     });
> 335   }

the fix here is to create a default context origin attribute object, set the inBrowser value to true and then pass the origin attr to the createCodebasePrincipal call.

Comment 1

[Dave Huseby [:huseby]]

Attachment: Bug_1238722.patch

Comment 2

[Dave Huseby [:huseby]]

Attachment: Bug_1238722.patch

updated for new API.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 8722063 [details] [diff] [review]
Bug_1238722.patch

Review of attachment 8722063 [details] [diff] [review]:
-----------------------------------------------------------------

::: toolkit/mozapps/extensions/AddonManager.jsm
@@ +331,5 @@
>    if (principalOrURI instanceof Ci.nsIURI) {
> +    let attrs = ChromeUtils.createOriginAttributesFromOrigin(principalOrURI);
> +    attrs.userContextId = 0;
> +    attrs.inBrowser = true;
> +    return Services.scriptSecurityManager.createCodebasePrincipal(principalOrURI, attrs);

o_O

Why the heck does this set inBrowser=true?!? That is unlikely to produce whatever result the author was hoping for. I talked with Mossop and it seems like it was based on a misunderstanding of what setting that actually meant.

In any case I think leaving this as the default contextid=0

Also, attrs will always be the default OAs, since principalOrURI is just a URI (as tested on line 331)

Comment 4

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

that code has been removed in Bug 1250639