1355213 - Don't allow WebExtensions to inject HTTP resources in HTTPS pages

Status: RESOLVED DUPLICATE of bug 1581611

(WebExtensions :: General, enhancement, P2)

Description

[Jorge Villalobos [:jorgev] (he/him)]

Injecting plain HTTP images or scripts to HTTPS pages degrades their security and makes them show up as "mixed content" in Firefox. It's a reason for rejection during add-on code review. Filing this to see if it's something that can be blocked at the add-ons platform level.

Comment 1

[:shell escalante]

will depend on bugs for applying CSP to content scripts - Kris comment

Comment 2

[Kris Maglione [:kmag]]

This depends on fixing bug 1267027. That would allow us to apply a different CSP depending on the principal that injected the content. We'd just need to add this restriction to that CSP for extension content scripts in HTTPS pages.

Comment 3

[Kris Maglione [:kmag]]

Sorry, mid-aired.

Comment 4

[Firefox Bug Husbandry Bot]

Bulk move of bugs per https://bugzilla.mozilla.org/show_bug.cgi?id=1483958

Comment 5

[Luca Greco [:rpl] [:luca] [:lgreco]]

Hey Shane, this seems something that could be part of what we want to look into as part of the extension content script CSP for manifest v3, would you mind to link it to the right meta?

Comment 6

[Shane Caraveo (:mixedpuppy)]

This probably just needs to be closed, it should be handled by the content script csp. Also bug 1594234 will generally prevent remote resources.