2020773 - userScripts in MV2 sandbox does not have a fix for the structuredClone regression

Status: RESOLVED FIXED

(WebExtensions :: General, defect, P1)

Description

[Rob Wu [:robwu]]

bug 2017797 fixed the regression for structuredClone in content scripts and the sandbox of user scripts registered through the MV3 userScripts API.

But the fix was not applied to the sandbox of userScripts API from MV2.

For completeness and future reference, here is an overview of Cu.Sandbox instances in extensions that interact with content:

• content script sandbox: https://searchfox.org/firefox-main/rev/0894e095dfb46b6dac785365432791a54861fe09/toolkit/components/extensions/ExtensionContent.sys.mjs#1045,1070
  • created when a page loads and content_scripts is used (the order does not matter) - the most common sandbox, most extensions interacting with content use this.
• MV2 userScripts sandbox: https://searchfox.org/firefox-main/rev/0894e095dfb46b6dac785365432791a54861fe09/toolkit/components/extensions/ExtensionContent.sys.mjs#954
  • created when a page loads, after api_scripts is defined in a manifest with manifest_version: 2 and userScripts.register() is called.
• MV3 userScripts sandbox: https://searchfox.org/firefox-main/rev/0894e095dfb46b6dac785365432791a54861fe09/toolkit/components/extensions/ExtensionUserScriptsContent.sys.mjs#264
  • created when a page loads, after the "userScripts" permission is granted to an extension with manifest_version: 3 and userScripts.register() is called.

Examples of unit tests that trigger the creation of such sandboxes and verify the execution within can be seen in the patch to bug 1912587 at https://phabricator.services.mozilla.com/D219142

• test_Document_parseHTML_and_parseHTMLUnsafe tests content scripts
• test_Document_parseHTML_in_mv2_userscript_sandbox tests MV2 user script sandbox.
• test_Document_parseHTML_in_mv3_userscript_sandbox tests MV3 user script sandbox.

Comment 1

[Rob Wu [:robwu]]

The original regression was introduced in Firefox 149 by bug 2013389, setting status flags accordingly.

Comment 2

[Rob Wu [:robwu]]

P1 because we want to get the fix in the same release as the other fix (uplift to beta).

The number of extensions using the MV2 user scripts API is relatively low (especially in comparison to content scripts), but nevertheless for sanity the behaviors should be identical.

Comment 3

[Luca Greco [:rpl] [:luca] [:lgreco]]

Attachment: Bug 2020773 - Add structuredClone to the MV2 userScripts Sandbox wantGlobalProperties. r?robwu!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ecfe56da0fc4
https://hg.mozilla.org/integration/autoland/rev/184a3fef4319
Add structuredClone to the MV2 userScripts Sandbox wantGlobalProperties. r=robwu

Comment 5

[rperta]

https://hg.mozilla.org/mozilla-central/rev/184a3fef4319

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:rpl, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox149 to wontfix.

For more information, please visit BugBot documentation.

Comment 7

[Rob Wu [:robwu]]

Attachment: Bug 2020773 - Add structuredClone to the MV2 userScripts Sandbox wantGlobalProperties.

Original Revision: https://phabricator.services.mozilla.com/D287444

Comment 8

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: Fixes regression from bug 2013389 and bug 2017797 affecting extensions using MV2 userScripts API. Not fixing can break user scripts run through the MV2 userScripts extension API that rely on structuredClone.
• Code covered by automated testing?: no
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Fix is obvious and restores the original behavior of version 148 (before the regression was introduced). This only affects users of the MV2 userScripts extension API.
• String changes made/needed?: No
• Is Android affected?: yes

Comment 9

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/40dc21bb69e7
https://hg.mozilla.org/releases/mozilla-beta/rev/85b7085d4afb