1484754 - Grant access to Tab url and title through host permissions

Status: RESOLVED DUPLICATE of bug 1679688

(WebExtensions :: Compatibility, defect, P3)

Description

[Isak]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Build ID: 20180808222917

Steps to reproduce:

## Method
1. Add the "https://bugzilla.mozilla.org/*" host permission.
2. Load https://bugzilla.mozilla.org in a tab
3. (await browser.tabs.query({})).some(tab => "url" in tab || "title" in tab)

## Event
1. Add the "https://bugzilla.mozilla.org/*" host permission.
2. browser.tabs.onUpdated.addListener(() => {}, {urls: ["https://bugzilla.mozilla.org/*"]});



Actual results:

## Method
false

## Event
Error: Url filtering in tabs.onUpdated requires "tabs" or "activeTab" permission.


Expected results:

## Method
true

## Event
Should add a listener that fires for any update to a tab which matches that URL pattern.


# Why is this expected?

1. Chrome does it.
2. The extension already has access to this data:

const [{url, title}] = await browser.tabs.executeScript(id, {code: `({url: location.href, title: document.title})`, runAt: "document_start"});

3. The code above actually needs to catch errors.
4. Non-network URL updates cannot be detected without replacing history.pushState at document_start in a page script (injected via a script tag from content script).
5. The "tabs" permission is one of the scariest.

Comment 1

[Shane Caraveo (:mixedpuppy)]

(In reply to Isak from comment #0)

> 1. Chrome does it.

Chrome doesn't have url filtering, so you need to provide and example of what chrome *does* do.

Comment 2

[Isak]

I made a mistake. I initially didn't include events in the bug and when I did I confused it with another API.

While Chrome doesn't have a declarative event filter for `tabs` at all, it can be done in the listener with only host permissions:

browser.tabs.onUpdated.addListener(tab => {
    if(!(url && url.startsWith("bugzilla.mozilla.org"))) return;
    console.log("Bugzilla tab updated");
});

Comment 3

[Isak]

`tab` in the above example should be replaced with `({url})`

Comment 4

[David Durst [:ddurst]]

Rob, can you verify this please?

Comment 5

[Rob Wu [:robwu]]

Attachment: logTabsOnUpdated.zip

Firefox only exposes tab.url, tab.title and tab.faviconUrl if the extension has the tabs permission.
Chrome also exposes this information if the extension has the explicit permission to access the URL (so not if the origin is set in content_scripts[*].matches).

Comment 6

[Shane Caraveo (:mixedpuppy)]

Didn't this get done already? If so can you dup it?