707053 - content scripts can no longer be used to inject navigator.* APIs

Status: RESOLVED FIXED

(Add-on SDK Graveyard :: General, defect, P1)

Description

[Ben Adida [:benadida]]

A content script can add properties to window, but not to navigator.

e.g.

  // works
  unsafeWindow.foo = 'bar1';

  // doesn't do any thing
  unsafeWindow.navigator.foo = 'bar2';

This makes it hard to inject APIs for Identity and Apps.

Comment 1

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Did this stop working, or did it never work?

Maybe I'm not testing it correctly, but this seems to work for me with SDK 1.2: https://builder.addons.mozilla.org/addon/1027621/latest/

Comment 2

[Ben Adida [:benadida]]

oh I've taken the (probably bad) habit of using addon-sk from master branch on github, so I think I'm using the very latest. Let me see what 1.2 does... ahah it appears to work fine in 1.2.1! Maybe I detected a rising bug in the current master branch, or maybe I wasted your time, sorry!

Comment 3

[Myk Melez [:myk] [@mykmelez]]

If it worked in 1.2, it should work on master, unless we explicitly removed support for it, which I don't remember us doing, nor can I imagine us doing.  That makes this a regression.

Comment 4

[Alexandre Poirot [:ochameau]]

For an unknown reason wrappers (most likely xraywrappers) are automatically created on anything than comes from unsafeWindow, like unsafeWindow.navigator.
So `unsafeWindow` is unwrapped and allow page values access/modification.
But `unsafeWindow.navigator`, `unsafeWindow.document` or any other attribute will be wrapped so that you won't be able to access page values, nor modify them.

I talked with Blake, the wrapper guy and it is not supposed to happen. 
Some code explicitely avoid such behavior. I'll need more time to figure this out though a gdb session.

Hopefully, there is a temporary workaround:
  unsafeWindow.navigator.wrappedJSObject.foo = true;
If you start using this workaround, please take care that this code won't work anymore if we fix this issue. `wrappedJSObject` will be undefined.

Comment 5

[Alexandre Poirot [:ochameau]]

Should have been fixed with the removal of content script proxies.
Please reopen if that's this an issue.