1437867 - Evaluate which kind of sandbox configuration option can be allowed on the userScripts sandboxes

Status: RESOLVED WONTFIX

(WebExtensions :: General, enhancement, P3)

Description

[Luca Greco [:rpl] [:luca] [:lgreco]]

The goal of this bug is to evaluate which kind of sandbox configuration options can be allowed on the userScripts sandboxes, and which kind of concern these configuration options may arise (e.g. related to security, as well as avoiding to expose internal implementation details that may change over the time and should not be directly exposed by a WebExtensions APIs).

Comment 1

[Luca Greco [:rpl] [:luca] [:lgreco]]

As a concrete example of the kind of sandbox configuration that may be needed by the extensions that are interesting in this API:

- Greasemonkey would like to be optionally able to disable xrays between a userScript and its target webpage (because it is a common source of breakage when Greasemonkey has been ported from a legacy extension to a WebExtension)
https://bugzilla.mozilla.org/show_bug.cgi?id=1353468#c23

Comment 2

[Luca Greco [:rpl] [:luca] [:lgreco]]

The userScripts API this enhacement belongs to is the userScripts API namespace that was available only in Firefox manifest_version 2 extensions, that API namespace has been deprecated in manifest_version 3 extension where the same API namespace will be used for a different userScripts API shared with Chrome manifest_version 3 extensions (and also meant to be eventually supported by other vendors interested to support the use case that this API is meant to support). Introducing support for the new MV3 API is tracked by Bug 1875475.

Given that this bug belongs to an API already on its deprecation path, I'm closing this as wontfix.