1280279 - moz-extension:blob cannot load on content script

Status: RESOLVED WONTFIX

(WebExtensions :: Untriaged, defect)

Description

[pasta0915]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36

Steps to reproduce:

Get a file from internet via XHR (xhr.responsetype='arraybuffer') on Background script and send this blob object url to content script. Then, get this blob object via XHR for avoid CSP.


Actual results:

On Chrome Extension, content script can load blob and inject it onto html But Firefox throw exception on content script.

Comment 1

[pasta0915]

Exception type is `NS_ERROR_DOM_BAD_URI`

Comment 2

[pasta0915]

I upload sample: https://github.com/pastak/moz-bug-1280279

Comment 3

[pasta0915]

Attachment: Sample xpi

Comment 4

[Kris Maglione [:kmag]]

Anything you can XHR from the background script,you can also XHR from the content script (blob URLs excluded). And if you want to send data to the content script, just send the ArrayBuffer directly.

Comment 5

[Nancy Grossman]

Send it how, exactly? `ArrayBuffer` isn't JSON-serialiazable.

Comment 6

[pasta0915]

Thanks. I noticed I can send ArrayBuffer encoded as Base64.  I successed.

Comment 7

[Kris Maglione [:kmag]]

Message passing uses structured clone, not JSON. You can send ArrayBuffers directly.

Comment 8

[Nancy Grossman]

(In reply to Kris Maglione [:kmag] from comment #7)
> Message passing uses structured clone, not JSON. You can send ArrayBuffers
> directly.

So it does. Don't think I'm not pleased, but Chrome messaging uses JSON, not structured clone, so WONTFIX means new code is needed to pass `Blob`s in Firefox. Both incompatibilities should be documented.
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Chrome_incompatibilities

(In reply to Kris Maglione [:kmag] from comment #4)
> Anything you can XHR from the background script,you can also XHR from the content script

In FF47 the content script is only able to load images from the page origin. If that has been fixed (has it?), then why can't this be fixed? If the content script can have a different CSP than the corresponding page, then this is only a question of adding an origin, so why WONTFIX?