1918386 - browser.search.get() favIconUrl is a blob url instead of a data:-URL

Status: VERIFIED FIXED

(WebExtensions :: General, defect, P1)

Description

[kernp25]

Attachment: firefox_QAGnhRdFNX.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0

Steps to reproduce:

browser.search.get() returns blob:null/ec5ca2b4-0835-4997-8879-d0a6d8097d92 instead of undefined. The doc says favIconUrl is optional and only a data url.

Comment 1

[kernp25]

It must have to do with this change.

Now, favIconUrl is not undefined anymore!

Comment 2

[Rob Wu [:robwu]]

What does "should be optional but is not" mean? When a property is documented as optional, valid implementations can range from never set to always set, and every level of partial availability in between.

What I am more interested in is to know whether extensions are able to display the blob:-URL in an extension document, and/or fetch the raw data. I.e. that such loads are not blocked.

The documentation states that it is a data:-URL while it could also be a blob:-URL now. Are you asking us to make changes to Firefox, and/or the documentation?

Comment 3

[kernp25]

(In reply to Rob Wu [:robwu] from comment #2)

The documentation states that it is a data:-URL while it could also be a blob:-URL now. Are you asking us to make changes to Firefox, and/or the documentation?

Yes! The docs should be updated, to state that, it can also be a blob url now.

I tested it in an add-on and the icons are correctly displayed in the context sub-menu with the blob urls.

Comment 4

[kernp25]

Attachment: background.zip

Test add-on.

Comment 5

[Rob Wu [:robwu]]

I just tested and the image cannot be displayed in extension pages either. That means that the blob:-URL is not a sufficient replacement for data:-URLs.

With mozregression, I can identify the regression to be introduced on Nightly by bug 1885002 (Nightly 125). This went to release in bug 1900638 (Firefox 128). The root cause is the introduction of blob:-URLs by bug 1867288. To fix this, we should convert blob:-URLs of built-in engines to data URLs at https://searchfox.org/mozilla-central/rev/230b29162e6c5bc390a7bbfb7626363c1383afee/browser/components/extensions/parent/ext-search.js#50.

STR:

1. Extract the extension from comment 4 and replace the background.js content with the following snippet. Then load Firefox with the extension (e.g. at about:debugging) and view the console of the background page (or open the Browser Console and view Multiprocess logs).

browser.search.get().then(engines => {
  let img = new Image();
  img.src = engines[0].favIconUrl;
  img.decode().then(() => console.log("ok:" + img.src), err => console.error("Error" + err));
});

Expected:

• "ok: data:..." (or even "ok: blob:...")

Result:

• ErrorEncodingError: Invalid image request.
• Console: Security Error: Content at moz-extension://f505848e-bb0c-4d0e-ac10-3c5b4f13f20e/_generated_background_page.html may not load data from blob:null/c6c35690-5a41-440b-b891-38bb0281896b.

Comment 6

[Mark Banner (:standard8)]

I have a fix in progress for this.

Comment 7

[Mark Banner (:standard8)]

Attachment: Bug 1918386 - browser.search.get() should be returning data URIs for application provided search engines. r?#extension-reviewers!

Comment 8

[Rob Wu [:robwu]]

Please request uplift to ESR128 after landing the patch.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/62a94f7c2b67
browser.search.get() should be returning data URIs for application provided search engines. r=extension-reviewers,robwu

Comment 10

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/62a94f7c2b67

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:standard8, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox131 to wontfix.

For more information, please visit BugBot documentation.

Comment 12

[Mark Banner (:standard8)]

Attachment: Bug 1918386 - browser.search.get() should be returning data URIs for application provided search engines.

Original Revision: https://phabricator.services.mozilla.com/D222264

Comment 13

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: Add-ons attempting to use the browser.search.get() APIs won't be able to access icons for app-provided engines
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: See comment 5
• Risk associated with taking this patch: Low
• Explanation of risk level: Minor change to turn blob URLs into data URIs using existing code paths
• String changes made/needed: None
• Is Android affected?: no

Comment 14

[Mark Banner (:standard8)]

Attachment: Bug 1918386 - browser.search.get() should be returning data URIs for application provided search engines.

Original Revision: https://phabricator.services.mozilla.com/D222264

Comment 15

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: Add-ons attempting to use the browser.search.get() APIs won't be able to access icons for app-provided engines
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: See comment 5
• Risk associated with taking this patch: Low
• Explanation of risk level: Minor change to turn blob URLs into data URIs using existing code paths
• String changes made/needed: None
• Is Android affected?: no

Comment 16

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/d52f607a4d41

Comment 17

[Alex Cornestean]

Verified as Fixed. Tested on the latest Nightly (132.0a1/20240917213026) and Beta (131.0b8/20240918025307 from https://treeherder.mozilla.org/jobs?repo=mozilla-beta&revision=d52f607a4d413649af0f848114822f0398974d27) under Windows 10 x64 and macOS 11.3.1, using the STR from Comment 5.

Checking the console of the background page reveals content along the lines of ok:data:image/x-icon;base64,AAABAAIAEBAAAAEAIABoBAAAJgAAACAgAAABACAAqBAAAI4EAAAoAAAAEAAAACAAAAABACAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///zD9/f2W/f392P39/fn9/f35/f391/39/ZT+/v4uAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/v7+Cf39/ etc.
and NO Security Error: Content at moz-extension://4834b3ee-7a86-446e-8076-30714eef2ac3/_generated_background_page.html may not load data from blob:null/b09e4741-5f12-41ff-8509-e842e22e5462. or ErrorEncodingError: Invalid image request. errors are thrown.

Comment 18

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/59438e8b69e8

Comment 19

[Dianna Smith [:diannaS]]

Backed out from esr128 for causing perma failures
TEST-UNEXPECTED-FAIL | browser/components/extensions/test/browser/browser_ext_search_favicon.js | Test timed out -

Backout push : https://treeherder.mozilla.org/jobs?repo=mozilla-esr128&revision=c29a5d66a558da7d9e576a043937f798525c4fc0

Comment 20

[Mark Banner (:standard8)]

(In reply to Dianna Smith [:diannaS] from comment #19)

Backed out from esr128 for causing perma failures
TEST-UNEXPECTED-FAIL | browser/components/extensions/test/browser/browser_ext_search_favicon.js | Test timed out -

Backout push : https://treeherder.mozilla.org/jobs?repo=mozilla-esr128&revision=c29a5d66a558da7d9e576a043937f798525c4fc0

I've just updated the patch so it should work better now. I'd missed that we don't have all the new search test infrastructure on 128.

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/a88b1dd6546f

Comment 22

[Alex Cornestean]

Verified as Fixed. Tested on the latest ESR (128.3.0esr/20240919152112 from https://treeherder.mozilla.org/jobs?repo=mozilla-esr128&revision=a88b1dd6546fdc70299a6794f4a42e4b0a5618ed) under Windows 10 x64 and macOS 11.3.1, using the STR from Comment 5.

Checking the console of the background page reveals content along the lines of ok:data:image/x-icon;base64,AAABAAIAEBAAAAEAIABoBAAAJgAAACAgAAABACAAqBAAAI4EAAAoAAAAEAAAACAAAAABACAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///zD9/f2W/f392P39/fn9/f35/f391/39/ZT+/v4uAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/v7+Cf39/Zn///////////////////////////////////////////39 etc.
and NO Security Error: Content at moz-extension://4834b3ee-7a86-446e-8076-30714eef2ac3/_generated_background_page.html may not load data from blob:null/b09e4741-5f12-41ff-8509-e842e22e5462. or ErrorEncodingError: Invalid image request. errors are thrown.