1794427 - MV2 extensions might already have access to a page via <all_urls> content scripts

Status: RESOLVED FIXED

(WebExtensions :: General, defect, P1)

Description

[William Durand [:willdurand]]

From https://phabricator.services.mozilla.com/D158826:

In this concrete case though, we have a bug. This extension has a <all_urls> content script, which means it already "has access" to every page, but we don't reflect it because we only check host permissions. This is an MV2-only bug because for MV3 we turn all content script match patterns into optional permissions.

We would have to specifically check all content script match patterns to see if an extension "has access" to the current page, but only for MV2 extensions.

Comment 1

[Kazumasa Hasegawa (Kazz)]

For a note.
Maybe you should also check for
"*://*/*"
"file:///*"
Ignore if <all_urls> checks for these.

Comment 2

[Tomislav Jovanovic :zombie]

Attachment: Bug 1794427 - Origin Controls reflect implicit access through content scripts r=willdurand

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/247863b6c995
Origin Controls reflect implicit access through content scripts r=willdurand

Comment 4

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/247863b6c995