1664513 - Extensions shouldn't get access to topsites.services.mozilla.com

Status: RESOLVED INVALID

(WebExtensions :: Request Handling, enhancement)

Description

[Mike de Boer [:mikedeboer]]

Currently WebExtensions can attach content scripts to topsites.services.mozilla.com and listen to traffic using the webRequest API. That means an extension could intercept your user name and password for that site.

We should add this domain to the extensions.webextensions.restrictedDomains pref.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Andreas Wagner [:TheOne] [use NI]]

How is that different from any other website that has a login form?

I don't think we should add more sites to that pref. Data can be retrieved using other ways, and legitimate add-ons (like password managers) don't work, which is an inconvenience for user that can also impact their safety, if they have to type/fill credentials manually.

Comment 3

[Mike de Boer [:mikedeboer]]

topsites.services.mozilla.com is a service internal to Mozilla that is essential in making sure we monetize clicks on sponsored Top Site tiles and sponsored searches.
Anything we allow to tamper with these request will have an impact on our revenue.

Comment 4

[Andreas Wagner [:TheOne] [use NI]]

I don't think that warrants a blank ban of that domain for webextensions. Domains like google.com also affect our revenue and we don't restrict those either.

Are there any add-ons that tamper with requests to the topsites domain? We should evaluate them and see what their use case is. We could also look into flagging add-ons for review that request access to that domain.

Comment 5

[Tomislav Jovanovic :zombie]

It is not exactly clear from this bug what topsites is, and how it functions with regards to usernames, passwords and cookies.

(In reply to Mike de Boer [:mikedeboer] from comment #0)

That means an extension could intercept your user name and password for that site.

Who is expected to have a username/password on this website? Is this a significant portion of our users?

Comment 6

[Tomislav Jovanovic :zombie]

Clearing priority because we never saw this bug in our triage.

Comment 7

[Shane Caraveo (:mixedpuppy)]

Why isn't this just a system request? I only see XHR/Fetch requests in JSM files, I don't understand how a content script could be attached to those requests. This needs more information.

Comment 8

[Mike de Boer [:mikedeboer]]

Yeah, I think we can resolve this as invalid, since we can turn this into a system request.