Regard extension generated blob as normal page

RESOLVED DUPLICATE of bug 1378636

Status

()

Toolkit
WebExtensions: General
RESOLVED DUPLICATE of bug 1378636
a month ago
a month ago

People

(Reporter: Danny Lin, Unassigned)

Tracking

55 Branch
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

a month ago
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Build ID: 20170824053622

Steps to reproduce:

Generate a web page via blob from an extension page, like:

var html = `Some dynamic content`;
var url = URL.createObjectURL(new Blob([html], {type: "text/html;charset=UTF-8"}));
tabs.create({url: url});


Actual results:

A blob page generated by extension page is considered an extension page and extension APIs are allowed and extension CSPs are applied.


Expected results:

A blob page generated by extension page should be considered a normal page so that extension APIs are not allowed and extension CSPs are not applied.

Sometimes an addon may generate dynamic content via blob URLs. Extension APIs are generally not needed in the blob page since the developer can fill dynamic content in the blob directly at first. And the extension CSP, which are unlikely to cause a security risk if the blob URLs cannot access extension APIs, will prevent many dynamic content from working.

The current behavior is different from Chromium and causes an incompatibility for certain extensions/addons. I think it would be better to make it work as in Chrome for better flexibility compatibility.

Updated

a month ago
Component: Untriaged → WebExtensions: General
Product: Firefox → Toolkit
Status: UNCONFIRMED → RESOLVED
Last Resolved: a month ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1378636
You need to log in before you can comment on or make changes to this bug.