1569610 - Content scripts don't appear to use the correct node principal on <link> injected styles

Status: RESOLVED INVALID

(WebExtensions :: General, defect)

Description

[Jonathan Kingston [:jkt] he/him]

I have some code in a content script that looks like the following:

let el = document.createElement("div");
let shadow = el.attachShadow({mode: "closed"});
let contentURL = browser.runtime.getURL("content.css");
shadow.innerHTML = `<link href="${contentURL}"><some-other-code></some-other-code>`
document.appendChild(el);

I get the following extension error:

Security Error: Content at https://www.blah.com/ may not load or link to moz-extension://<extension-id>/content.css.

My understanding is content injected in this way should have an expanded node principal?

Raising as security sensitive to be over cautious but feel free to open.

Comment 1

[Jonathan Kingston [:jkt] he/him]

I guess this is a feature request to allow addons to make this not content-accessible?
IE I would like to make a content script have the ability to have it's content injected into the page unaccessible to the page, in which case I wouldn't need to make it web accessible either.

Comment 2

[Daniel Veditz [:dveditz]]

I think this behavior is expected, it's not like we have wrappers between injected content and the DOM.

Comment 3

[Andrew Swan [:aswan]]

I don't really understand the platform level issues here. Bug 1267027 may be relevant. In any case, I'm pretty sure that content-script-injected content that isn't visible to the page isn't something that Firefox (or Chrome for that matter) support. Kris has much more knowledge here, cc'ing him, perhaps he can add something.

Comment 4

[Kris Maglione [:kmag]]

This is expected. If you use DOM APIs to create the element, the stylesheet will be loaded with the content script's principal as its triggering principal, but we intentionally chose not to support that when using the fragment parser to inject content.

Comment 5

[Kris Maglione [:kmag]]

(Also, in no case do we actually change the node principal, only the triggering principal of the content that we load. Page content can always access the node. It won't be able to access stylesheets which inherit the triggering principal of the load, though.)

Comment 6

[Kris Maglione [:kmag]]

(And if you want to inject content into a page that it can't access, you need to do it by injecting an iframe.)

Comment 7

[:Gijs (he/him)]

Based on the comments, I think we can close this and unhide it. Jonathan?

Comment 8

[Jonathan Kingston [:jkt] he/him]

+1 thanks