1391669 - FR: Different permissions for background and content scripts

Status: RESOLVED DUPLICATE of bug 1332273

(WebExtensions :: General, enhancement, P5)

Description

[Anthony Lieuallen]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0
Build ID: 20170612122443

Steps to reproduce:

For my WebExtension, I want the <all_urls> permission for my background script.  I want it to then tabs.executeScript() a content script which does _not_ have the <all_urls> permission.

This is the one case I know of for sure; I probably have a few similar things I'd like to do like this.  In general I want runtime-generated content scripts to not have privileges that "my extension" does.

Comment 1

[The 8472]

I think this could also be achieved with bug 1353468. Since the content script instantiating the sandbox would have the same privileges as the background script but the sandbox would not.

Comment 2

[Anthony Lieuallen]

Yes, if I could construct/control a sandbox as per bug 1353468 I'd actually have exactly what I want.  Then for my needs I'd consider this bug obsolete.

Comment 3

[Caitlin Neiman [:caitmuenster]]

Hi Anthony, this has been added to the agenda for the September 5 WebExtensions APIs triage meeting. Would you be able to join us? 

Wiki: https://wiki.mozilla.org/Add-ons/Contribute/Triage#Next_Meeting

Agenda: https://docs.google.com/document/d/13gmYyN0qCjzV7YAsqGpbeeHr3al0yiWP7ayqKJPLS2w/edit#

Comment 4

[Anthony Lieuallen]

Sorry for slow response, yes I should be able to make it.

Comment 5

[Andy McKay]

I believe this is being replaced by the user script support in bug 1332273, although there might be more bugs. Based on what we talked about in the design-decision meeting, I think this one is not going anywhere awaiting the outcome of that bug.

Closing for now.

Comment 6

[The 8472]

This one should be orthogonal to 1332273 since it is about permissions available to the content script, such as the XHRs being more powerful than the page content's.

userscript extension requires <all_urls> permission -> content scripts have cross-domain XHR -> user scripts inherit that. Additionally they also inherit access to the content script APIs such as storage, which could also pose a security issue.

Although personally I believe that problem is better solved with bug 1353468 since that one also solves all those problems, including shared globals and shared xray wrappers.