1717671 - Avoid the use of a persistent UUID in the public base URL of extensions

Status: NEW

(WebExtensions :: General, enhancement, P3)

Description

[Rob Wu [:robwu]]

Extension resources are currently served at a URL with a UUID as hostname (generated at install time) - moz-extension://UUID. This UUID is persistent and if leaked can cause privacy issues (e.g. bug 1405971, bug 1372288) or security issues (e.g. bug 1711361).

There are generally two ways to resolve this:

• Remove the need for leaking UUIDs. Extensions leak UUIDs when they share a file in web_accessible_resources with a website. With alternatives (e.g. bug 1712096 and bug 1340930), extensions don't need to declare an item in web_accessible_resources any more.
• Reduce the scope/lifetime of UUID.

This bug is about the latter: we should try to decouple the UUID from the extension URLs. This is far from trivial, because the UUID appears in the moz-extension:-base URL, which is also part of the principal used for permissions/storage/etc and persisted to disk. Extensions currently break when the UUID is reset (bug 1696779).

Solving this issue in general is difficult, but we can experiment with non-persistent UUID for one or more built-in extensions (e.g. webcompat).

Other browsers:

• Chrome introduces use_dynamic_url in web_accessible_resources in manifest v3 to allow extensions to opt into a non-persistent host name. Not implemented yet, but documented at https://developer.chrome.com/docs/extensions/mv3/manifest/web_accessible_resources/
• Safari extensions have a unique UUID per session.

Comment 1

[erosman [:erosman]]

Could Bug 1322304 be associated with this bug?

Comment 2

[[e-mail]]

An interesting consideration here would be CORS. Currently, servers can allow requests from only their own extensions by checking the origin header. If this change has implications for that header value, this could be a regression in that sense.

Comment 3

[erosman [:erosman]]

There is another edge case where a persistent UUID might be leaked.

Some extensions (e.g. userscript managers) use sourceURL to display the scripts in the Developer Tools Debugger. In order to display them under extension's own entry, UUID is used. (e.g. bug 1824910)

If the extension injects the script into the webpage context, the sourceURL could become visible to the webpage.