1853411 - Implement matchOriginAsFallback in the scripting.registerContentScripts API

Status: RESOLVED FIXED

(WebExtensions :: General, enhancement, P2)

Description

[Rob Wu [:robwu]]

Once match_origin_as_fallback / matchOriginAsFallback (see https://bugzilla.mozilla.org/show_bug.cgi?id=1411641#c43) is implemented, we should expose it through the scripting API.

With that property, extensions are then able to choose whether to run content scripts in documents that inherit the origin from the content script. The current behavior is to also run scripts in about:blank / about:srcdoc (by setting matchAboutBlank to true internally); the idea behind this is that it was preferable to run scripts because extensions can always opt out (via a location / origin check in the content script) while the scripting API was going to be expanded. Unfortunately, one extra side effect of this is that top-level about:blank are also always matched (bug 1853409), which means that the default is matching too many documents.

If we don't fix bug 1853409 sooner, then we should fast-track this bug by introducing matchOriginAsFallback in the API in order to flip matchAboutBlank to false internally, and allow extensions to specify matchOriginAsFallback to revert to the original behavior (i.e. about:blank/etc. documents can match the parent).

Comment 1

[Rob Wu [:robwu]]

Note: Chrome's source code includes the intent to implement matchOriginAsFallback in the scripting API, but that seems to have fallen through the cracks: https://source.chromium.org/chromium/chromium/src/+/main:chrome/common/extensions/api/scripting.idl;l=145-148;drc=1c88d6287c95767f8411f544210981e6675ceddb

Comment 3

[Rob Wu [:robwu]]

Attachment: Bug 1853411 - Add matchOriginAsFallback to scripting.RegisteredContentScript

Adds the matchOriginAsFallback option to RegisteredContentScript, used
by registeredContentScripts, updateContentScripts and
getRegisteredContentScripts. This enables extensions to opt in to
running their content scripts on about:-documents. With this ability to
opt in, we no longer need to set the flag unconditionally, and can
revert the work-arounds from bug 1853412.

If extensions relied on automatic injection in about:blank /
about:srcdoc before, then they have to change their extension to use
matchOriginAsFallback:true. This is consistent with what Chrome
requires.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9686b196c284
Add matchOriginAsFallback to scripting.RegisteredContentScript r=willdurand

Comment 5

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/9686b196c284