Grant access to Tab url and title through host permissions



11 months ago
11 months ago


(Reporter: ihvarfner, Unassigned)


(Blocks 1 bug)

61 Branch
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)



(1 attachment)

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0
Build ID: 20180808222917

Steps to reproduce:

## Method
1. Add the "*" host permission.
2. Load in a tab
3. (await browser.tabs.query({})).some(tab => "url" in tab || "title" in tab)

## Event
1. Add the "*" host permission.
2. browser.tabs.onUpdated.addListener(() => {}, {urls: ["*"]});

Actual results:

## Method

## Event
Error: Url filtering in tabs.onUpdated requires "tabs" or "activeTab" permission.

Expected results:

## Method

## Event
Should add a listener that fires for any update to a tab which matches that URL pattern.

# Why is this expected?

1. Chrome does it.
2. The extension already has access to this data:

const [{url, title}] = await browser.tabs.executeScript(id, {code: `({url: location.href, title: document.title})`, runAt: "document_start"});

3. The code above actually needs to catch errors.
4. Non-network URL updates cannot be detected without replacing history.pushState at document_start in a page script (injected via a script tag from content script).
5. The "tabs" permission is one of the scariest.
(In reply to Isak from comment #0)

> 1. Chrome does it.

Chrome doesn't have url filtering, so you need to provide and example of what chrome *does* do.
Flags: needinfo?(ihvarfner)
I made a mistake. I initially didn't include events in the bug and when I did I confused it with another API.

While Chrome doesn't have a declarative event filter for `tabs` at all, it can be done in the listener with only host permissions:

browser.tabs.onUpdated.addListener(tab => {
    if(!(url && url.startsWith(""))) return;
    console.log("Bugzilla tab updated");
Flags: needinfo?(ihvarfner)
`tab` in the above example should be replaced with `({url})`
Rob, can you verify this please?
Flags: needinfo?(rob)
Priority: -- → P2
Firefox only exposes tab.url, tab.title and tab.faviconUrl if the extension has the tabs URL.
Chrome also exposes this information if the extension has the explicit permission to access the URL (so not if the origin is set in content_scripts[*].matches).
Flags: needinfo?(rob)
Ever confirmed: true
You need to log in before you can comment on or make changes to this bug.