Implement matchOriginAsFallback in the scripting.registerContentScripts API
Categories
(WebExtensions :: General, enhancement, P2)
Tracking
(firefox128 fixed)
| Tracking | Status | |
|---|---|---|
| firefox128 | --- | fixed |
People
(Reporter: robwu, Assigned: robwu)
References
(Blocks 1 open bug)
Details
(Whiteboard: [addons-jira])
Attachments
(1 file)
Once match_origin_as_fallback / matchOriginAsFallback (see https://bugzilla.mozilla.org/show_bug.cgi?id=1411641#c43) is implemented, we should expose it through the scripting API.
With that property, extensions are then able to choose whether to run content scripts in documents that inherit the origin from the content script. The current behavior is to also run scripts in about:blank / about:srcdoc (by setting matchAboutBlank to true internally); the idea behind this is that it was preferable to run scripts because extensions can always opt out (via a location / origin check in the content script) while the scripting API was going to be expanded. Unfortunately, one extra side effect of this is that top-level about:blank are also always matched (bug 1853409), which means that the default is matching too many documents.
If we don't fix bug 1853409 sooner, then we should fast-track this bug by introducing matchOriginAsFallback in the API in order to flip matchAboutBlank to false internally, and allow extensions to specify matchOriginAsFallback to revert to the original behavior (i.e. about:blank/etc. documents can match the parent).
Updated•2 years ago
|
| Assignee | ||
Comment 1•2 years ago
|
||
Note: Chrome's source code includes the intent to implement matchOriginAsFallback in the scripting API, but that seems to have fallen through the cracks: https://source.chromium.org/chromium/chromium/src/+/main:chrome/common/extensions/api/scripting.idl;l=145-148;drc=1c88d6287c95767f8411f544210981e6675ceddb
| Assignee | ||
Updated•2 years ago
|
| Assignee | ||
Comment 3•2 years ago
|
||
Adds the matchOriginAsFallback option to RegisteredContentScript, used
by registeredContentScripts, updateContentScripts and
getRegisteredContentScripts. This enables extensions to opt in to
running their content scripts on about:-documents. With this ability to
opt in, we no longer need to set the flag unconditionally, and can
revert the work-arounds from bug 1853412.
If extensions relied on automatic injection in about:blank /
about:srcdoc before, then they have to change their extension to use
matchOriginAsFallback:true. This is consistent with what Chrome
requires.
Updated•2 years ago
|
Comment 5•1 year ago
|
||
| bugherder | ||
Description
•