1947732 - Trusted Types policies should not apply to isolated WebExtension content scripts

Status: RESOLVED FIXED

(Core :: DOM: Security, task)

Description

[Tom Schuster (MoCo)]

We make some effort to exempt extensions from page CSPs (bug 1267027), we should consider doing the same for Trusted Types, otherwise pages could unduly restrict the functionality of extensions.

Comment 1

[Tom Schuster (MoCo)]

I verified that currently Trusted Types can prevent WebExtension content scripts from using innerHTML and other sinks to inject content into the page. This applies to both ISOLATED and MAIN world content scripts.

I have a patch that would allow us to bypass Trusted Types completely for isolated content scripts by checking the nsIPrincipal when e.g. calling the innerHTML setter. (We could use the same mechanism for UA widgets, which would be an alternative to the changes in bug 1961770)
I think for main world content scripts we can't do anything, because they just look/behave like normal scripts inside the page.

Comment 2

[Tom Schuster (MoCo)]

Attachment: Bug 1947732 - Provide nsIPrincipal to GetTrustedTypesCompliantString. r?smaug

Comment 3

[swleefers]

Thank you for working on this, Tom.

Comment 4

[Tom Schuster (MoCo)]

Attachment: Bug 1947732 - Provide nsIPrincipal to GetTrustedTypesCompliantAttributeValue. r?smaug

Comment 5

[Tom Schuster (MoCo)]

Attachment: Bug 1947732 - Exempt (isolated) WebExtension content scripts from trusted types policies. r?smaug!,#extension-reviewers!

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/627d49221806
Provide nsIPrincipal to GetTrustedTypesCompliantString. r=smaug
https://hg.mozilla.org/integration/autoland/rev/b4723229d8d0
Provide nsIPrincipal to GetTrustedTypesCompliantAttributeValue. r=smaug
https://hg.mozilla.org/integration/autoland/rev/3566d94bcda7
Exempt (isolated) WebExtension content scripts from trusted types policies. r=smaug,extension-reviewers,robwu

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/627d49221806
https://hg.mozilla.org/mozilla-central/rev/b4723229d8d0
https://hg.mozilla.org/mozilla-central/rev/3566d94bcda7