Closed Bug 1396017 Opened 2 years ago Closed 2 years ago

window.title exposes tab.title without "tabs" permission

Categories

(WebExtensions :: General, enhancement)

57 Branch
enhancement
Not set

Tracking

(firefox57 fixed)

RESOLVED FIXED
mozilla57
Tracking Status
firefox57 --- fixed

People

(Reporter: ke5trel, Assigned: kmag)

References

Details

Attachments

(1 file)

window.title gives the title preface, tab title and browser name all joined together. This is problematic since the "tabs" permission is normally required to read tab titles but window.title is giving access without permission. 

I'm not sure why the full window title needs to be made available anyway, since tab.title is already available and it would seem preferable to be able to read the title preface separately.
Blocks: 1333376
Assignee: nobody → kmaglione+bmo
Status: UNCONFIRMED → NEW
Ever confirmed: true
Any reason for not just simply providing window.titlePreface so it can be read separately and without permission issues?
Comment on attachment 8903739 [details]
Bug 1396017: Redact window titles without the appropriate tabs permissions.

https://reviewboard.mozilla.org/r/175502/#review180736
Attachment #8903739 - Flags: review?(mixedpuppy) → review+
https://hg.mozilla.org/mozilla-central/rev/9b9159079eea
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
Is manual testing required on this bug? If Yes, please provide some STR and the proper webextension(if required), if No set the “qe-verify-“ flag.
Flags: needinfo?(kmaglione+bmo)
Flags: needinfo?(kmaglione+bmo) → qe-verify-
Product: Toolkit → WebExtensions
You need to log in before you can comment on or make changes to this bug.