1612013 - [webext] Can't add search provider with http only (without https) even for localhost URL

Status: RESOLVED FIXED

(WebExtensions :: General, defect, P5)

Description

[actionless.loveless]

Attachment: manifest.json

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0

Steps to reproduce:

1. Create webextesion with only chrome_settings_overrides:

	"chrome_settings_overrides": {
	  "search_provider": {
		"name": "Search Jackett",
		"search_url": "http://127.0.0.1:9117/UI/Dashboard#search={searchTerms}&tracker=&category=",
		"keyword": "j",
		"favicon_url": "http://127.0.0.1:9117/favicon.ico?"
	  }
	}

2. Try to load it into Firefox

Actual results:

Can't install the extension:

Extension is invalid

Reading manifest: Error processing chrome_settings_overrides.search_provider.search_url: String "http://127.0.0.1:9117/UI/Dashboard#search={searchTerms}&tracker=&category=" must match /^https:\/\/.*$/

Expected results:

It should be installed successfully, it's more than reasonless to require https for localhost communications (and generally demanding it against the user will).

Comment 1

[actionless.loveless]

Attachment: search_jackett.xpi

Comment 2

[actionless.loveless]

Attachment: 2020-01-29--1580254984_1040x336_scrot.png

Comment 3

[Alex Cornestean]

Hello,

I have managed to reproduce the issue using the provided STR and attached extension on the latest Nightly (74.0a1/20200131013147), Beta (73.0b11/20200128001646) and Release (72.0.2/20200117190643) under Windows 10 Pro 64-bit and macOS High Sierra 10.15.

Attempting to load the extension in about:debugging will produce the error from Comment 2 and the installation fails.

Comment 4

[Shane Caraveo (:mixedpuppy)]

Mike, do you have any issue with opening http on localhost for search?

Comment 5

[Shane Caraveo (:mixedpuppy)]

IMO it's fine to loosen the https restriction for localhost.

Comment 6

[actionless.loveless]

commit 69b79b5b524c6592692a84f2c6e503ea1a3670e4
Author: actionless <[e-mail]>
Date:   Thu Mar 12 21:29:11 2020 +0100

    1612013 extensions: schemas: allow http for localhost

diff --git a/browser/components/extensions/schemas/chrome_settings_overrides.json b/browser/components/extensions/schemas/chrome_settings_overrides.json
index 8aa9b3e5dd..e38fdfa588 100644
--- a/browser/components/extensions/schemas/chrome_settings_overrides.json
+++ b/browser/components/extensions/schemas/chrome_settings_overrides.json
@@ -33,7 +33,7 @@
                   "search_url": {
                     "type": "string",
                     "format": "url",
-                    "pattern": "^https://.*$",
+                    "pattern": "^(https:\/\/|http:\/\/(localhost|127\.0\.0\.1)).*$",
                     "preprocess": "localize"
                   },
                   "favicon_url": {
@@ -45,7 +45,7 @@
                   "suggest_url": {
                     "type": "string",
                     "optional": true,
-                    "pattern": "^https://.*$|^$",
+                    "pattern": "^(https:\/\/|http:\/\/(localhost|127\.0\.0\.1)).*$",
                     "preprocess": "localize"
                   },
                   "instant_url": {
@@ -102,7 +102,7 @@
                     "type": "string",
                     "optional": true,
                     "format": "url",
-                    "pattern": "^https://.*$",
+                    "pattern": "^(https:\/\/|http:\/\/(localhost|127\.0\.0\.1)).*$",
                     "preprocess": "localize"
                   },
                   "alternate_urls": {

Comment 7

[Caitlin Neiman [:caitmuenster]]

If this is your first contribution, please refer to https://wiki.mozilla.org/WebExtensions/Contribution_Onramp on how to get started.

Mentor: :mixedpuppy

Comment 8

[Caitlin Neiman [:caitmuenster]]

Hey actionless.loveless! Just saw that you added a patch to the comment! \o/ Can you go ahead and make that change on Phabricator? Check the documentation in comment 7 for instructions. :)

Comment 9

[actionless.loveless]

Attachment: 1612013 extensions: schemas: allow http for localhost

extensions: schemas: allow http for localhost

Comment 10

[Caitlin Neiman [:caitmuenster]]

Hey actionless.loveless! Just wanted to check in on this bug since it's been a few weeks and it looks like you're close to finishing this bug off. :) Are you interested in getting this over the finish line?

Comment 11

[actionless.loveless]

hi :caitmuenste! it would be better if somebody would pick my patch off to bring it to the finish line

Comment 12

[Caitlin Neiman [:caitmuenster]]

Thanks for the update, actionless.loveless! We'll unassign you from the bug for now; please know that you can come back and finish it off in the future if you would like.

Comment 13

[Myeongjun Go]

Attachment: Bug 1612013 - add search provider with http for localhost URL r=mixedpuppy

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/48dbf3178e91
add search provider with http for localhost URL r=mixedpuppy

Comment 15

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/48dbf3178e91