1423966 - Add API-Control to tabs.executeScript()

Status: RESOLVED DUPLICATE of bug 1437098

(WebExtensions :: General, enhancement, P5)

Description

[erosman]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Build ID: 20171115220414

Steps to reproduce:

I believe a little API addition can have a GREAT impact on the security (and simplicity, performance) of user content scripts where script is not controlled by the add-on. 

A prime example would be GreaseMonkey type scripts but there are other instances where user can enter script to be parsed by the add-on.

Currently, Content scripts in addition to being in the page content scope, have access to some or all APIs in extension, runtime, i18n & storage.

For example, an added "permissions" property to details, which defaults to all ie normal

eg:
var executing = browser.tabs.executeScript({
  file: "/content-script.js",
  allFrames: true,
  permission: ['extension', 'runtime', 'i18n', 'storage']
});

Or even just a blocking property eg:

var executing = browser.tabs.executeScript({
  file: "/content-script.js",
  allFrames: true,
  sandboxed: true // no API access
});




Actual results:

Comment 1

[Luca Greco [:rpl] [:luca] [:lgreco]]

Hi erosman,
we like the idea of optionally sandboxing the content scripts and we were evaluating something similar.

In the meantime I'm moving this issue into a different bugzilla component (it doesn't seem something that belongs to "WebExtensions: Developer Tools")

Comment 2

[erosman]

Has there been any development on this issue?

Comment 3

[Luca Greco [:rpl] [:luca] [:lgreco]]

(In reply to erosman from comment #2)
> Has there been any development on this issue?

Yes, we are working on a type of scripts that are sandboxed and isolated from the APIs available to the rest of the extension as part of the userScripts API (Bug 1437098).

The proposal as it was described in comment 0 isn't unfortunately a viable option, because all the extension content scripts
(the one registered from the manifest, as well as the one registered at runtime using contentScripts.register and the code injected using tabs.executeScript) are all going to be executed in the same sandbox (1 per matched window global), and the APIs are actually made available to the content scripts by injecting them into the shared "content scripts" sandbox, and not to just a particular js url or js string.

I'm marking this bug as a dupe of the userScript meta (Bug 1437098), because it is the feature that we are actually working on to allow an extension to control if and which APIs should be available to third-party scripts executed by that extension in the content processes.