1897113 - Content scripts should only run in blob:-URLs if match_origin_as_fallback is true

Status: RESOLVED FIXED

(WebExtensions :: General, enhancement)

Description

[Rob Wu [:robwu]]

Currently, we run content scripts in blob:-URLs if the document that created it matches the matches pattern of a content script. This behavior is undocumented, and was not covered by unit tests until I added them in https://hg.mozilla.org/mozilla-central/rev/1eabe598552b (part of bug 1853411).

In contrast, Chrome only permits it if match_origin_as_fallback is also set to true. In Firefox we implemented this feature recently in bug 1853411, so we should also lock blob:-scripting to extensions that specify match_origin_as_fallback.

Because this change may affect compatibility, we should add a pref to enable us or users to revert the feature. If there are no significant regressions, we should eventually remove the preference.

Comment 1

[Rob Wu [:robwu]]

Attachment: Bug 1897113 - Require match_origin_as_fallback for blob:-URLs

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/998822f95cec
Require match_origin_as_fallback for blob:-URLs r=rpl

Comment 3

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/998822f95cec