1775618 - Warn instead of failing hard when background SW declaration contains unrecognized properties

Status: NEW

(WebExtensions :: General, defect, P3)

Description

[Rob Wu [:robwu]]

Currently, when the background key of a Service worker-based extension contains an unrecognized key, the extension fails to load altogether.

To fix this, we should add "additionalProperties": { "$ref": "UnrecognizedProperty" } to https://searchfox.org/mozilla-central/rev/c30349265c87047a324a471d2f39a216b6749262/toolkit/components/extensions/schemas/manifest.json#158-164

This bug prevents extensions from loading if they specify the type: "module" property (which is not supported yet due to bug 1775574). If extensions ever want to use type: "module" when we finally add support, then the extension would be incompatible with earlier Firefox versions where this was not supported.

Comment 1

[Rob Wu [:robwu]]

The whole "background" syntax at https://searchfox.org/mozilla-central/rev/75da1dd5d4b9b991f919a41594194eab93cdef62/toolkit/components/extensions/schemas/manifest.json#129-174 needs to be rewritten.

With the service worker feature enabled, there is currently ambiguity when scripts and service_worker are present: the service_worker property is not validated and neither normalized. So, with the following manifest + extensions.backgroundServiceWorker.enabled true at startup,

{
    "name": "SW + event page",
    "version": "1",
    "manifest_version": 3,
    "background": {
        "scripts": ["bg.js"],
        "service_worker": "bg.js"
    }
}

Firefox fails to load any of them, and raises the following error:

InvalidStateError: Script URL cannot be parsed

Fortunately, this validation bypass does not result in the load of arbitrary remote scripts, because only moz-extension:-URLs are allowed by the service worker registration, at https://searchfox.org/mozilla-central/rev/75da1dd5d4b9b991f919a41594194eab93cdef62/dom/serviceworkers/ServiceWorkerUtils.cpp#159. And since the host name of moz-extension:-URLs are random and unpredictable, one cannot create an extension that loads a script from a third-party extension.

Comment 2

[Rob Wu [:robwu]]

This is a blocker before enabling service_worker support, because the bug described in comment 1 prevents a service_worker from loading altogether.