1864284 - Allow localhost in MV3 CSP to allow connecting to local dev servers

Status: VERIFIED FIXED

(WebExtensions :: General, enhancement, P2)

Description

[aaronklinker1]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:120.0) Gecko/20100101 Firefox/120.0

Steps to reproduce:

Create a manifest.json with the following content:

{
  "manifest_version": 3,
  "name": "example",
  "version": "1.0.0",
  "content_security_policy": {
    "extension_pages": "script-src 'self' 'wasm-unsafe-eval' http://localhost:3000; object-src 'self';"
  }
}

Then load the extension into Firefox.

Actual results:

After loading the the extension, a warning showed up:

"Reading manifest: Error processing content_security_policy.extension_pages: ‘script-src’ directive contains a forbidden http: protocol source"

Expected results:

Firefox should allow adding localhost and 127.0.0.1 to CSPs for temporary extensions.

For security reasons, MV3 is originally blocked all sources not included in your extension. However, Chrome added support for allowing localhost and 127.0.0.1 for unpacked extensions in v110 so dev servers like Vite and Webpack can host JS files during development, enabling features like HMR.

• Original discussion for Chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=1247690
• Patch allowing localhost and 127.0.0.1: https://chromium.googlesource.com/chromium/src/+/b81d6dcb2f2a89075b2bd8619b59bbf00994a01d

Firefox should allow the same for temporary extensions. It seems to have been explicitly removed from firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1789751

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Security' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Alex Cornestean]

Hello,

I reproduced the issue on the latest Nightly (121.0a1/20231115214519), Beta (120.0/20231113165053) and Release (119.0.1/20231106151204) under Windows 10 x64 and Ubuntu 22.04 LTS.

Since it seems this feature has been explicitly and intentionally removed, I’ll mark this report as an Enhancement and not a defect.

Comment 3

[Rob Wu [:robwu]]

Given the amount of feedback (this bug, bug 1789751, bug 1790236, and other places), I'm leaning towards supporting the request here., by allowing localhost and 127.0.0.1 for temporarily loaded add-ons only. That would be consistent with Chrome, where I provided input that lead to their current implementation (https://github.com/w3c/webextensions/issues/98#issuecomment-1298964372).

I originally wanted to any remote URL, to allow blocking of http(s) loads in the extension process (bug 1767798). I think that it would still be acceptable to have the check, with an exception for localhost only (when there are any temporarily loaded add-ons).

Comment 4

[Alexander]

Any news on this?

It's practically impossible to develop extensions on firefox due to this issue. I have to use Chromium browser to develop. And manually building and loading is a pain.

Even Chrome is supporting this officially. Can this be fixed asap?

Comment 5

[Rob Wu [:robwu]]

This is a good-first-bug for people with JavaScript and a little C++ skills.

The task here is to partially restore the functionality from bug 1789751, restricted to temporarily added add-ons.

The relevant C++ code to touch is here:

• https://searchfox.org/mozilla-central/rev/1eb4f27ece7cb96ac94b635ad0dc95c00d1443db/toolkit/components/extensions/WebExtensionPolicy.cpp#191,206-208
  • With #define DEFAULT_BASE_CSP_V3 "script-src 'self' 'wasm-unsafe-eval';" (source)
  • We will need a new constant, e.g. DEFAULT_BASE_CSP_V3_WITH_LOCALHOST that is allowed to be granted when mTemporarilyInstalled is true (and a similar preference).
• The CSP validator for the manifest.json file needs to accept localhost when loaded temporarily.
  • The logic is at https://searchfox.org/mozilla-central/rev/1eb4f27ece7cb96ac94b635ad0dc95c00d1443db/toolkit/components/extensions/Schemas.sys.mjs#1266-1273
    • When an error occurs, we should fall back to validating with the CSP_ALLOW_LOCALHOST flag included. If the validation passes at that point, we should customize the error, by mentioning that localhost in the CSP is only is invalid and only permitted during development with temporarily loaded add-ons.
• The unit tests to change are referenced in bug 1789751, https://hg-edge.mozilla.org/mozilla-central/rev/9bee44dbde20
  • There is also a test on manifest validation at https://searchfox.org/mozilla-central/source/toolkit/components/extensions/test/xpcshell/test_ext_manifest_content_security_policy.js
  • To run tests, ./mach test toolkit/components/extensions/test/xpcshell/test_csp_custom_policies.js toolkit/components/extensions/test/xpcshell/test_csp_validator.js toolkit/components/extensions/test/xpcshell/test_ext_content_security_policy.js toolkit/components/extensions/test/xpcshell/test_ext_manifest_content_security_policy.js --log-mach-verbose --verbose

Comment 6

[Destroy666]

Firefox already has way fewer extensions than Chromium. Leaving this untouched for so long certainly doesn't help. I just encountered this issue while trying to develop MV3 extension for both Chromium and Firefox using WXT. It's a serious limitation.

Comment 7

[James Hay]

Attachment: Bug 1864284 - Allow localhost origins in temporary MV3 add-ons. r=#extension-reviewers

Comment 8

[James Hay]

Attachment: Bug 1864284 - Allow localhost origins in temporary MV3 add-ons. r=#extension-reviewers

Comment 9

[James Hay]

Hello,

I have created a patch to allow localhost scripts in MV3 extensions when they are temporarily installed. I believe that I have covered the test cases correctly, but as this is my first attempt at a contribution to Firefox, I may be missing the mark on some of the conventions used.

I'm also not sure who to set as the reviewer, I used the whole extension-reviewers group, but I'm not sure if that's a good idea or not. Please take a look when you're free and let me know what I should change.

Comment 10

[Rob Wu [:robwu]]

Thanks for your patch! I'm assigned as the mentor to this bug, so I'll take a look soon. I am traveling this week, so it might take until next week before you get a full review.

Have you managed to build with the changes and run the tests locally?

Comment 11

[James Hay]

Thanks!

I have built Firefox and updated the tests you listed. They all pass locally. I have also manually tested with a minimal reproducible example, similar to the reporters and verified that it does allow localhost scripts when installed temporarily, and that the current release of Firefox does not.

I would say that the part I'm most unsure about is the tests. They all pass, and I think that they cover the new cases correctly, but testing is quite project dependant, so I'm not sure if I've exposed too much, or if there's better ways of utilizing some of the test infrastructure.

Anyway, let me know once you get around to reviewing it

Comment 12

[James Hay]

(In reply to Rob Wu [:robwu] from comment #10)

Thanks for your patch! I'm assigned as the mentor to this bug, so I'll take a look soon. I am traveling this week, so it might take until next week before you get a full review.

Have you managed to build with the changes and run the tests locally?

Hey Rob, did you get a chance to look at this, any updates?

Comment 13

[Rob Wu [:robwu]]

I posted a review at https://phabricator.services.mozilla.com/D269149#9371144

FYI: I have more travel coming up after next week. I can get back to you rather quickly this week, but my availability and responsiveness is reduced after that.

Comment 14

[James Hay]

Thanks, I've had a quick skim of the changes requested. Unfortunately I am travelling this week, so I won't have much time to address anything. I should be back again next week.

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/a6dee5b53d67
https://hg.mozilla.org/integration/autoland/rev/9f87c36ef896
Allow localhost origins in temporary MV3 add-ons. r=robwu

Comment 16

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/9f87c36ef896

Comment 17

[Alex Cornestean]

Verified as Fixed. Tested on the latest Nightly (147.0a1/20251124094751) under Windows 11 and Ubuntu 24.10.

Using the STR from Comment 0, temporarily loading the manifest.json file will show a warning stating - Reading manifest: Warning processing content_security_policy.extension_pages: Warning processing content_security_policy.extension_pages: Using localhost in the Content Security Policy is invalid, and is only permitted during development with temporarily loaded add-ons

as opposed to an error, as before - Reading manifest: Error processing content_security_policy.extension_pages: ‘script-src’ directive contains a forbidden http: protocol source.

Comment 18

[Ryan VanderMeulen [:RyanVM]]

Is this something we should call out in the Fx147 relnotes?

Comment 19

[Rob Wu [:robwu]]

Not in the regular release notes, but we should document it on MDN. Here is more context for our tech writer (Richard):

• https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/147#changes_for_add-on_developers
• https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy#location_of_script_and_object_resources
  • Mention in a note that for development purposes, localhost scripts can be loaded during development only; in Firefox 147+ in temporarily loaded extensions, in Chrome 110+ in unpacked extensions.
  • Side note: the section mentions ", in Manifest V3, the content_scripts property ..."; this should be deleted as that comment is inaccurate/obsolete.
• In the BCD of the content_security_policy key, add a note about localhost support (referencing the documentation for the specific conditions). https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy#browser_compatibility
  • On that same page, also include an example of allowing localhost (referencing the documentation for the conditions).

Comment 20

[rbloor]

Documentation updates available in:

• (content) Bug-1864284 Allow localhost access for temporary MV3 add-ons #42410
• (BCD) Bug-1864284-Allow-localhost-access-for-temporary-MV3-add-on #28683