1617985 - Webpage can fetch moz-extension://fb7e288e-72c9-4b18-bd61-c297a452e942/res/gmail/0.png

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[kernp25]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0

Steps to reproduce:

1. Install https://addons.mozilla.org/firefox/addon/xnotifier-neo/
2. Open https://jsfiddle.net/tq4jym9x/

Actual results:

The icons 0.png and 1.png are loading from moz-extension://fb7e288e-72c9-4b18-bd61-c297a452e942/res/gmail/

Expected results:

The icons should not load (or are icons are allowed to load?).

If i do in console:
fetch("moz-extension://fb7e288e-72c9-4b18-bd61-c297a452e942/res/gmail/0.png");
no security error is thrown.

But, if i do
fetch("moz-extension://fb7e288e-72c9-4b18-bd61-c297a452e942/res/gmail/");
then it shows an security error.

Comment 1

[Rob Wu [:robwu]]

From its manifest.json:

   "web_accessible_resources": [
        "res/gmail/*.png"
    ]
}

It is expected to allow the load of res/gmail/0.png, because the extension opts in to it via web_accessible_resources.
res/gmail/ is not matched by any pattern in web_accessible_resources, and therefore the load is denied.