2022704 - Cannot revoke host permission that had been removed from manifest.json (and was not cleaned up by migration)

Status: NEW

(WebExtensions :: General, defect, P3)

Description

[Rob Wu [:robwu]]

STR:

1. Create a MV3 extension whose manifest.json file contains https://example.com/* (or any other host permission including <all_urls>) in host_permissions.
2. Load the extension via about:debugging or with web-ext run
3. Edit manifest.json and remove that permission.
4. Visit about:addons and try to uncheck the permission in "Permissions and data".

Expected:

• Permission should be revoked.

Actual:

• Although the checkbox is toggled, the permission is not revoked.
• The Browser Console shows: "Uncaught (in promise) Error: https://example.com/* was not declared in the manifest", thrown from normalizeOptional, called by setAddonPermission in aboutaddons.js.

This is one of the consequences of bug 1766915.

I also tried an artificial reproduction with a non-temporary add-on, by installing a MV3 extension, editing extension-preferences.json to manually add a permission, clearing the startup cache and then running the STR from about:addons. The results are still the same. But this may be too artificial, there is clearly logic in the tree to drop obsolete permissions on extension updates (migratePermissions).