1443285 - WebExtensions: Please make browser.sidebarAction accessible from content scripts

Status: RESOLVED DUPLICATE of bug 1392624

(WebExtensions :: General, defect)

Description

[Jacob Barkdull]

Attachment: An example extension that demonstrates the issue.

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
Build ID: 20180206200532

Steps to reproduce:

1. Create a content script which attaches click event listeners to various elements, in this click event listener call `browser.sidebarAction.open ()`.


Actual results:

I have attached an example extension that demonstrates the issue.

It loads Wikipedia and adds two icons after every link on the page, one red icon, one blue icon. The blue icon calls `browser.sidebarAction.open ()` and gets an undefined error, the red icon sends a message to the background page script to open the sidebar, however, because of the user input handler restriction this also fails.


Expected results:

Ideally, the sidebar would open.

I think because `browser.sidebarAction.open ()` has the user input handler restriction it should be safe to expose the sidebarAction API to content scripts. This way developers could create elements on the page and attach click event handlers to them that open the sidebar.

Comment 2

[Jacob Barkdull]

This bug is completely unrelated to 1408129, as that bug is about downloads, sidebarAction, and browserAction, all of which are inaccessible from a content script. This bug is a request to make sidebarAction available to content scripts, given the fact that a user input restriction is already implemented.

Comment 3

[Kris Maglione [:kmag]]

Content scripts intentionally have access to a very limited set of APIs for security reasons. If you want to interact with a sidebar action as a result of something that happens in a content script, you'll need to send a message to your background script.

Comment 4

[Jacob Barkdull]

(In reply to Kris Maglione [:kmag] (long backlog; ping on IRC if you're blocked) from comment #3)
> Content scripts intentionally have access to a very limited set of APIs for
> security reasons. If you want to interact with a sidebar action as a result
> of something that happens in a content script, you'll need to send a message
> to your background script.

Yes, theoretically that would work. If that were possible I would not have filed this bug. As shown in the example extension, sending a message to the background script destroys the "user input" event, and therefore the background script cannot open the sidebar.

How else are we supposed to open the sidebar from a content script?

I know content scripts only have access to a limited set of API, so the question is "Which APIs should be accessible from content scripts?". I think it's fair to discuss making more APIs available to content scripts where they make sense. In this case, the sidebarAction has the user input handler requirement, so the sidebar would only be able to be opened from an event handler added to the page by the extension. Therefore, it should be safe to give content scripts access to sidebarAction.

What arguments are there against this?

Comment 5

[Andrew Swan [:aswan]]

(In reply to Jacob Barkdull from comment #4)
> What arguments are there against this?

In short, content scripts run in web content processes along side web content, so for a variety of reasons (including privacy, performance, and stability among others) we only expose the minimal set of things needed there.
I've updated this to be a duplicate of the issue that covers how this should work.