1653636 - downloads.download in perma-private browsing mode creates a download with "incognito": false

Status: NEW

(WebExtensions :: General, defect, P3)

Description

[Rob Wu [:robwu]]

While writing a regression test for bug 1649463, I noticed that when downloads.download is used in perma-private browsing mode, that the created download is not considered private. When perma-private browsing is enabled, all requests should be private.

In contrast, when I start a download from a private browsing window, it has "incognito: true" as expected.

STR:

1. Start Firefox with browser.privatebrowsing.autostart set to true.
2. Load an extension with the downloads permission.
3. From the console, run id = await browser.downloads.download({ url: "https://example.com/", filename: "example.txt"})
4. Run browser.downloads.search({ id }).then(console.log)
5. Expand the logged result.

Expected:

• incognito property is set to true.

Actual:

• incognito property is set to false.

Comment 1

[Tomislav Jovanovic :zombie]

To check if it affects privacy.

Comment 2

[Rob Wu [:robwu]]

This doesn't affect privacy.

When I restart the browser, the downloads are gone.

The only potential negative thing that I can observe is that the item does not appear in the downloads library. I.e. with PPB enabled, at the end of the download, the downloads library will be shown, but it's empty:

await browser.downloads.download({
  filename: "test.txt",
  url: "https://example.com/",
  incognito: false, // Or not specified
})

With the following, the downloads item does show up as expected:

await browser.downloads.download({
  filename: "test.txt",
  url: "https://example.com/",
  incognito: true,
})

I think that a reasonable way to resolve this bug is to change the default, to interpret a missing options.incognito as incognito: true when PPB is enabled.

Comment 3

[Rob Wu [:robwu]]

(In reply to Rob Wu [:robwu] from comment #2)

I think that a reasonable way to resolve this bug is to change the default, to interpret a missing options.incognito as incognito: true when PPB is enabled.

To fix this, search for instances of incognito in https://searchfox.org/mozilla-central/source/toolkit/components/extensions/parent/ext-downloads.js (permalink to current version) and let it be true if context.incognito is true.

Conveniently, there are already some relevant unit tests that can be used with minimal modifications

• remove incognito from https://searchfox.org/mozilla-central/rev/165e8d8f80c02605c2f3e89c5de462abfce91c32/toolkit/components/extensions/test/xpcshell/test_ext_downloads_cookies.js#51-53
• Use assertTrue as explained in the TODO comment at https://searchfox.org/mozilla-central/rev/165e8d8f80c02605c2f3e89c5de462abfce91c32/toolkit/components/extensions/test/xpcshell/test_ext_downloads_private.js#267-272