Closed Bug 1988419 Opened 3 months ago Closed 2 months ago

`import()` halts forever in content script in `iframe[sandbox]:not([sandbox~="allow-script"])`

Categories

(WebExtensions :: General, defect, P2)

Product:
WebExtensions
Component:
General
Version:
Firefox 142
Type:
defect

Tracking

(firefox146 fixed)

Status:
RESOLVED FIXED
Milestone:
146 Branch
Tracking Flags:
Tracking Status
firefox146 --- fixed

People

(Reporter: danny0838, Assigned: allstars.chh)

Details

Attachments

(1 file)

Bug 1988419 - No need to check document's CSP for WebExtensions.
48 bytes, text/x-phabricator-request
Details | Review

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0

Steps to reproduce:

  1. Create an extension with following files:

    {
  "name": "Test import from content script MV2",
  "version": "0.1",
  "manifest_version": 2,
  "background": {
    "scripts": ["background.js"]
  },
  "content_scripts": [
    {
     "all_frames": true,
     "matches": ["<all_urls>"],
     "js": ["content.js"]
    }
  ],
  "web_accessible_resources": [
    "*.mjs"
  ],
  "browser_action": {}
}

    /* content.js */
console.log("content", location.href);
(async () => {
  await import(browser.runtime.getURL("module.mjs"));
})();


    /* module.mjs */
console.log("module imported", location.href);

  2. Load the extension.

  3. Host a website with following files (either with local server or with config security.fileuri.strict_origin_policy = false):

    <!-- index.html -->
<!DOCTYPE html>
<iframe src="frame.html" sandbox="allow-same-origin"></iframe>

    <!-- frame.html -->
<!DOCTYPE html>
frame content

  4. Open the website and visit index.html.

  5. Visit the inspector.

Actual results:

The log has content and module imported for index.html while only content in frame.html.

Expected results:

The log should have content and module imported for index.html and frame.html.

The previous message had some extraneous data, especially for manifest.json. Here is the revised one:

  • manifest.json

    {
  "name": "Test import from content script MV2",
  "version": "0.1",
  "manifest_version": 2,
  "content_scripts": [
    {
     "all_frames": true,
     "matches": ["<all_urls>"],
     "js": ["content.js"]
    }
  ],
  "web_accessible_resources": [
    "*.mjs"
  ]
}

  • content.js

    console.log("content", location.href);
(async () => {
  await import(browser.runtime.getURL("module.mjs"));
})();

  • module.mjs

    console.log("module imported", location.href);

  • index.html

    <!DOCTYPE html>
<iframe src="frame.html" sandbox="allow-same-origin"></iframe>

  • frame.html

    <!DOCTYPE html>
frame content

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Product: Firefox → WebExtensions

When I open the global Browser Console or Browser Toolbox and set it to Multiprocess mode, opening index.html in the STR results in the following error:

TypeError: error loading dynamically imported module: moz-extension://486e628d-81a2-499e-abec-77bd6b1cabd9/module.mjs

If I change index.html by adding an iframe with allow-scripts in its sandbox, the script runs as expected. The log output in the Browser Console (Multiprocess) is as follows:

TypeError: error loading dynamically imported module: moz-extension://486e628d-81a2-499e-abec-77bd6b1cabd9/module.mjs
content http://localhost:8000/ content.js:1:9
module imported http://localhost:8000/ module.mjs:1:9
content http://localhost:8000/frame.html content.js:1:9
content http://localhost:8000/frame.html?with-allow-scripts content.js:1:9
module imported http://localhost:8000/frame.html?with-allow-scripts module.mjs:1:9
Unable to find target with innerWindowId:25769803797 3 watcher.js:196:13

(all of these logs, except for the error are also shown in the tab's console.)

Tom, any ideas on what to do here? There are two bugs here:

  1. The error is not associated with the devtools of that window (maybe a separate bug?)..
  2. Dynamic import fails in a content script running in a frame that is sandboxed without the allow-scripts directive.
Status: UNCONFIRMED → NEW
Component: Untriaged → General
Ever confirmed: true
Flags: needinfo?(tschuster)
Summary: `import()` halts forever in content script in `iframe[sandbox=allow-same-origin]` → `import()` halts forever in content script in `iframe[sandbox=allow-same-origin]` (without allow-scripts)
Summary: `import()` halts forever in content script in `iframe[sandbox=allow-same-origin]` (without allow-scripts) → `import()` halts forever in content script in iframe[sandbox]:not([sandbox~="allow-script"])`
Summary: `import()` halts forever in content script in iframe[sandbox]:not([sandbox~="allow-script"])` → `import()` halts forever in content script in `iframe[sandbox]:not([sandbox~="allow-script"])`

(In reply to Rob Wu [:robwu] from comment #3)

Thank you for the feedback. The allow-same-origin was initially used for script-modified iframe related behavior, while it proves to be unrelated and this issue also applies to a simplar case like sandbox="".

Updated the title to better reflect the problem.

Flags: needinfo?(tschuster) → needinfo?(allstars.chh)

Since CanStartLoad() is invoked from JavaScript, the caller can already
execute JS code, making the allow-script check redundant.

Assignee: nobody → allstars.chh
Status: NEW → ASSIGNED
Flags: needinfo?(allstars.chh)
Attachment #9513951 - Attachment description: Bug 1988419 - Remove unnecessary 'allow-script' CSP check. → Bug 1988419 - Relax the 'allow-scripts' CSP check for WebExtensions.
Attachment #9513951 - Attachment description: Bug 1988419 - Relax the 'allow-scripts' CSP check for WebExtensions. → Bug 1988419 - No need to check document's CSP for WebExtensions.

The severity field is not set for this bug.
:willdurand, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(wdurand)
Severity: -- → S3
Priority: -- → P2
Flags: needinfo?(wdurand)

https://hg.mozilla.org/mozilla-central/rev/225543b1bd63

Status: ASSIGNED → RESOLVED
Closed: 2 months ago
status-firefox146: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 146 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: