1747055 - Support container restrictions on content scripts

Status: NEW

(WebExtensions :: General, enhancement, P5)

Description

[Rob Wu [:robwu]]

Container restrictions are currently not enforced for content scripts. We should do that.
Long-term, we need to be able to check the restrictions from C++, which depends on changes to WebExtensionPolicy as described in bug 1699481.

An intermediate step, without requiring C++ changes is to add a check right before the script would be run, at Script's injectInto at https://searchfox.org/mozilla-central/rev/b605f01915c5704a55e9f485101b7be7d20a55df/toolkit/components/extensions/ExtensionContent.jsm#440-444

Before injection, extension.canAccessContainer should be called. One blocker to this is the fact that the canAccessContainer logic is currently not available in the child, only in the parent.

• context.canAccessContainer is at https://searchfox.org/mozilla-central/rev/b605f01915c5704a55e9f485101b7be7d20a55df/toolkit/components/extensions/ExtensionCommon.jsm#508-509,
  • It is just return this.extension.canAccessContainer(userContextId);
• extension.canAccessContainer is implemented in the parent, in the Extension class at https://searchfox.org/mozilla-central/rev/b605f01915c5704a55e9f485101b7be7d20a55df/toolkit/components/extensions/Extension.jsm#2368
• extension in the child does currently not have a canAccessContainer method. It should be added to the BrowserExtensionContent class in ExtensionChild.jsm. This class is defined at https://searchfox.org/mozilla-central/rev/b605f01915c5704a55e9f485101b7be7d20a55df/toolkit/components/extensions/ExtensionChild.jsm#378-379