1866999 - WebExtensions permissions.onAdded <all_urls> returns invalid permission object

Status: RESOLVED FIXED

(WebExtensions :: General, defect, P3)

Description

[Clemens MM]

Attachment: onaddedpermissionbug.jpg

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15

Steps to reproduce:

1. Request and grant:
   chrome.permissions.request({ permissions: [], origins ["<all_urls>"]}, (granted) => {});

2. Add Listener:
   chrome.permissions.onAdded.addListener( (perm) => { console.log(perm); });

3. Listener receives invalid permission object after granted:
   { permissions: ["<all_urls>"], origins ["<all_urls>"]}.

4. "<all_urls>" inside permissions.permissions array is invalid.

Actual results:

If you request the <all_urls> host_permission the onAdded listener also adds <all_urls> to the permissions array instead of only the origins array.

If you add any other URLs the listener receives the expected permissions object.

Expected results:

The onAdded listener should receive the same permission object as requested.

You may also wanna test if the onRemoved listener has the same bug.

Comment 1

[Clemens MM]

Some kind of workaround for now is to request ":///*" instead of "<all_urls>".

Comment 2

[Clemens MM]

"*://*/*"

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Site Permissions' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 4

[Alex Cornestean]

Hello,

Could you please attach an example extension with the behavior you mentioned in Comment 0? Thank you!

Comment 5

[Rob Wu [:robwu]]

This issue is caused by the logic introduced in bug 1624513, specifically the _fixupAllUrlsPerms part.

We could fix this by stripping <all_urls> from permissions in normalizePermissions at https://searchfox.org/mozilla-central/rev/413b88689f3ca2a30b3c49465730c0e7d40f9188/toolkit/components/extensions/parent/ext-permissions.js#19-25

Interestingly, the internal implementation is somewhat messy, because we also strip the moz-extension:-permission at another layer: https://searchfox.org/mozilla-central/rev/413b88689f3ca2a30b3c49465730c0e7d40f9188/toolkit/components/extensions/Extension.sys.mjs#1226-1228

Comment 6

[Tomislav Jovanovic :zombie]

Attachment: Bug 1866999 - <all_urls> is not an api for permission.onAdded r?robwu

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/67fd3eae6ce3
<all_urls> is not an api for permission.onAdded r=robwu

Comment 8

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/67fd3eae6ce3