1356568 - A WebExtension background script should be able to bless a blob for access by content

Status: RESOLVED WONTFIX

(WebExtensions :: Request Handling, defect)

Description

[Anthony Lieuallen]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20170329150849

Steps to reproduce:

I want to be able to create/save a blob (e.g. to IndexedDB) in my background script, then later load it and pass it to content.  I want to be able to `URL.createObjectURL()` on that blob, pass that URL to content and (among other things) then use that URL as the src for an image or the href for a (style) link.


Actual results:

My background script downloaded a file, saved it to IndexedDB as a blob, and generated a URL for that blob.  It generated a content script, and executed it via tabs.executeScript().  The content script included source like:

    console.log('My resource image URL is:', GM_info.script.resources.img);
    let img = document.createElement('img');
    img.src = GM_info.script.resources.img;
    document.body.appendChild(img);
  
And it logged:

    My resource image URL is: blob:moz-extension://d86e22c2-171d-4610-92de-138824a098d5/1bdc5572-228f-457d-8424-58442578c71c

And I got an img tag in my body, with that src, but it has 0x0 size and is not visible.  If I paste that URL into the address bar, it loads and is a visible image.


Expected results:

As a WebExtension, I should have been able to bless that generated blob URL for loading by content.  I can do this for resources included in the XPI with manifest key web_accessible_resources, but I want to be able to do the same for dynamic content.

Comment 1

[Anthony Lieuallen]

If I had bug 1271553 I could instead provide my own "protocol" to do the same; this is how XPCOM based Greasemonkey provides this feature today.

Comment 2

[Rob Wu [:robwu]]

I was thinking of an API to allow extensions to create blob:-URLs for a specific origin (or even multiple). An add-on for which this could be useful is Decentraleyes. I am not sure if that is viable though.

WebExtensions in Firefox use the structured cloning algorithm [1] for messages passed from the background page to content scripts (unlike Chrome, where messages must be JSON-serializable). Consequently, objects such as Blob can be passed around. For your use case, is it an option to send blob handles via the browser.tabs.sendMessage API?

[1]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm

Comment 3

[Anthony Lieuallen]

I can confirm that messaging the Blob to content and doing createObjectURL in content creates a content-accessible URL.

That makes this request lower priority.  But long term I'm hoping for capabilities that will work in the synchronous case, so that user scripts can be run at document_start time.

Comment 4

[Caitlin Neiman [:caitmuenster]]

Hi Anthony, this has been added to the agenda for the May 16 WebExtensions APIs triage. Would you be able to join us? 

Wiki: https://wiki.mozilla.org/Add-ons/Contribute/Triage

Agenda: https://docs.google.com/document/d/1vrhHNOelBty4hXcjQ8VbFk-azHRFFDVyGka7H0VpEa8/edit#

Comment 5

[Anthony Lieuallen]

Yes.  I'll try to figure out your video conferencing thing and otherwise join by phone.  Starting at 10:30 AM Pacific?

Comment 6

[Caitlin Neiman [:caitmuenster]]

Exactly. If you would like to test Vidyo, I'd be happy to help with that.

Comment 7

[Luca Greco [:rpl] [:luca] [:lgreco]]

During the last WebExtensions APIs triage we have discussed about this and it has been mentioned that

- passing the Blob from a background page to the content script using the extension messaging API
  allow an extension to cover every scenario besides one: being able to load a Blob while
  the page is still loading, "document_start" in the content script terminology).

- to be able to cover the "document_start" scenario, we have a different proposal 
  on Bug 1332273, where there is an ongoing discussion and an attached patch with an implementation proposal,
  "extend the webextension API to support programmatically registered content scripts" and
  support dynamically generated CSS files and JS files coming from extensions Blob urls (or by allowing
  this parameters to be Blob instances) in that API. 

based on this, we agreed that we can deny this "bless blob generated from an extension page" API request 
in favor of the workaround from Comment 2 and the "programmatically registered content script" API proposed
as part of Bug 1332273.