Open
Bug 1417975
Opened 7 years ago
Updated 2 years ago
webextension content scripts should support data: URIs of html types (from object tag, frameset frames, embed tag)
Categories
(WebExtensions :: General, enhancement, P5)
Tracking
(Not tracked)
UNCONFIRMED
People
(Reporter: ubbiurro, Unassigned)
References
Details
data: URIs are currently not supported by webextension content scripts, which means e.g. text/html and application/xhtml+xml type data: URIs aren't altered in the way an extension developer and user would hope. this also makes it possible for websites to intentionally subvert protections and other customizations intended by the user and developer of an extension.
|
||
Updated•7 years ago
|
Severity: normal → enhancement
Component: Untriaged → WebExtensions: General
Product: Firefox → Toolkit
|
||
Comment 1•7 years ago
|
||
data: URIs are supported for content scripts using the (poorly named) `match_about_blank` option:
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/content_scripts#match_about_blank
Or if you are already using that, what specifically doesn't work?
yes, I set match_about_blank to true ...
the following works on normal pages, but not on data: URI page ...
alert("hello from content script!");
here's the data: URI i tested with (entered into location bar):
data:text/html;charset=utf-8;base64,PGh0bWw+PGJvZHk+aGVsbG8sIHdvcmxkITwvYm9keT48L2h0bWw+
(<html><body>hello, world!</body></html>)
it seems however that this works when placed e.g. in iframe src.
Summary: webextension content scripts should support data: URIs of html types → webextension content scripts should support data: URIs of html types entered into location bar
also doesn't work with object tag:
<object type="text/html" data="data:text/html;charset=utf-8;base64,PGh0bWw+PGJvZHk+aGVsbG8sIHdvcmxkITwvYm9keT48L2h0bWw+"></object>
Summary: webextension content scripts should support data: URIs of html types entered into location bar → webextension content scripts should support data: URIs of html types (from location bar, object tag)
doesn't work from frameset frame tags, either. are there any other ways to include html content i've missed?
Summary: webextension content scripts should support data: URIs of html types (from location bar, object tag) → webextension content scripts should support data: URIs of html types (from location bar, object tag, frameset frames)
|
||
Updated•7 years ago
|
Priority: -- → P5
|
||
Updated•7 years ago
|
Product: Toolkit → WebExtensions
|
|
||
Updated•2 years ago
|
Severity: normal → S3
current version of Firefox partially addresses this issue - content scripts are injected into data: URIs that are navigated to through the location bar now
work correctly:
iframe
location bar
still do not work:
object tag
embed tag
frameset frames
Summary: webextension content scripts should support data: URIs of html types (from location bar, object tag, frameset frames) → webextension content scripts should support data: URIs of html types (from object tag, frameset frames, embed tag)
You need to log in
before you can comment on or make changes to this bug.
Description
•