1773115 - MV3 - specifying resource in "web_accessible_resources" prevents it's usage inside addon pages

Status: VERIFIED FIXED

(WebExtensions :: Untriaged, defect, P2)

Description

[juraj.masiar]

Attachment: broken_web_accessible_resources.zip

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0

Steps to reproduce:

1. using Nightly with allowed MV3 extensions
2. extract and load attached extension.
   If you have web-ext installed, you can use this command:

web-ext run --firefox=firefoxdeveloperedition --pref=extensions.manifestV3.enabled=true

3. open popup

Actual results:

Only one image is visible.

Expected results:

There should be two images.
Somehow, by specifying image "128.png" in the web_accessible_resources list will break it's usage in the addon:

  "web_accessible_resources": [
    {
      "resources": [
        "128.png"
      ],
      "matches": [ "*://*/*" ]
    }
  ],

Comment 1

[Alex Cornestean]

Hello,

I reproduced the issue on the latest Nightly (103.0a1/20220608214824), Beta (102.0b5/20220607212916) and Release (101.0/20220526203855) under Windows 10 x64 and Ubuntu 16.04 LTS.

After loading the extension and opening the add-on pop-up, only one image is visible, as described in Comment 0.

For more details, see the attached screenshot.

Comment 2

[Alex Cornestean]

Attachment: 2022-06-09_10h19_57.png

Comment 3

[Rob Wu [:robwu]]

We should probably skip the web-accessible check if the requesting principal represents the same extension at the matched WebExtensionPolicy.

E.g. checking if aURI is a moz-extension:-URL and its host name is the same as mHostname in https://searchfox.org/mozilla-central/rev/28ed523a3ed5dbf5f6b008cf1e28a9e8a8597b5e/toolkit/components/extensions/WebExtensionPolicy.h#119-129

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1697334

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1697334

Comment 6

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1773115 ensure extension access to its own web accessible resources

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/703c909eb009
ensure extension access to its own web accessible resources r=rpl

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1aa5ec22f47a
ensure extension access to its own web accessible resources r=rpl

Comment 9

[Tom S [:evilpie]]

I am not sure, but I think this https://hg.mozilla.org/integration/autoland/rev/1aa5ec22f47a1aeccb4b0a1ff678d03b3cf26185#l1.12 might be wrong. To me this reads like any URL can access the resource. I think we first need to verify if aURI is an extension by looking up the policy.

Comment 10

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/1aa5ec22f47a

Comment 11

[Alex Cornestean]

Verified the fix on the latest Nightly (105.0a1/20220802214455) under Windows 10 x64 and Ubuntu 16.04 LTS.

After loading the extension and opening the add-on pop-up, both images are visible, confirming the fix.

For a second confirmation of the issue being fixed on Nightly 105, the same STR have been performed on the latest Beta (104.0b5/20220802185803), the issue still occurring there.

For more details, see the attached screenshot.

Comment 12

[Alex Cornestean]

Attachment: 2022-08-03_10h09_45.png

Comment 13

[Shane Caraveo (:mixedpuppy)]

Reopening for a followup patch

Comment 14

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1773115 fix extension global matching for web accessible resources

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/46e636e428ea
fix extension global matching for web accessible resources r=rpl

Comment 16

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/46e636e428ea

Comment 17

[Alex Cornestean]

Re-verified the fix on the latest Nightly (105.0a1/20220809213127) using the original STR and example extension.

Opening the add-on pop-up still reveals both images as visible, as in the previous verification. No negative impact due to the follow up patch.