1902635 - Drop support for top-level data: through match_about_blank

Status: NEW

(WebExtensions :: General, task, P3)

Description

[Rob Wu [:robwu]]

In bug 1451463, as part of migrating the Quitter extension to a WebExtension, top-level data:-URLs were supported by allowing them to match when match_about_blank:true. was specified This was never documented and is not supported by Chrome. Moreover, the web cannot perform top-level navigations to data:-URLs (unless security.data_uri.block_toplevel_data_uri_navigation is changed to false), so there is no way for web content to see this kind of document. Typical sources of data:-URLs are when the user manually opens a data:-URL.

Now that we have "first-class" support for matching data:-URLs through match_origin_as_fallback (bug 1475831), we should drop the hack for match_about_blank matching data:-URLs, and update Quitter to use match_origin_as_fallback instead.

To resolve this bug:

• Update the test that was added as part of bug 1475831: https://searchfox.org/mozilla-central/rev/d31f750ad9e5b6c8f7b62d387dbea3f804044350/toolkit/components/extensions/test/mochitest/test_ext_contentscript_data_url.html#25-35
• Remove the data: condition from https://searchfox.org/mozilla-central/rev/d31f750ad9e5b6c8f7b62d387dbea3f804044350/toolkit/components/extensions/WebExtensionPolicy.cpp#822
  • Or at the very least put it behind a pref, and remove that pref in a few releases.
  • This code is being refactored in bug 1901894, so once that patch lands the actual code will have been moved to a separate helper.

Comment 1

[Rob Wu [:robwu]]

Pull request to update Quitter is at https://github.com/mozilla-extensions/quitter/pull/6
The updated quitter will become part of the tree in bug 1795750.

Comment 2

[Rob Wu [:robwu]]

The last remaining reliance on the Quitter extension from data:-URLs is dropped by https://phabricator.services.mozilla.com/D274022 as part of bug 1895528. There build/pgo/profileserver.py replaced data:text/html,<script>Quitter.quit()</script> with a localhost page that calls Quitter.quit().

We don't need to depend on that dependency to be removed, since the in-tree Quitter extension was already updated a while ago.

What bug 1895528 aims to do (and is not completed yet) is to drop support for the security.data_uri.block_toplevel_data_uri_navigation preference. After the removal of the preference, the only data:-URLs in top level documents are when the user manually navigates there (with the system principal).