Bug 1518486 - Disable extension devtools_page for private tabs when not allowed by users. r=mixedpuppy

This patch applies the following changes:

- make sure that the WebExtensions internals do not create any devtools_page related to a private tabs' toolbox
  if the extension is not allowed to access the private browsing windows

- define a new mochitest to verify the expended behaviors on the private windows when the extension is
  allowed and not allowed

Depends on D15948

Differential Revision: https://phabricator.services.mozilla.com/D15949

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Luca Greco 2019-01-31 19:43:44 +00:00
Родитель e048fc8ac0
Коммит 0bc32af010
3 изменённых файлов: 102 добавлений и 5 удалений

Просмотреть файл

@ -232,6 +232,12 @@ class DevToolsPageDefinition {
}
buildForToolbox(toolbox) {
if (!this.extension.canAccessWindow(toolbox.target.tab.ownerGlobal)) {
// We should never create a devtools page for a toolbox related to a private browsing window
// if the extension is not allowed to access it.
return;
}
if (this.devtoolsPageForTarget.has(toolbox.target)) {
return Promise.reject(new Error("DevtoolsPage has been already created for this toolbox"));
}
@ -279,8 +285,10 @@ class DevToolsPageDefinition {
// Iterate over the existing toolboxes and create the devtools page for them
// (if the toolbox target is supported).
for (let toolbox of DevToolsShim.getToolboxes()) {
if (!toolbox.target.isLocalTab) {
// Skip any non-local tab.
if (!toolbox.target.isLocalTab ||
!this.extension.canAccessWindow(toolbox.target.tab.ownerGlobal)) {
// Skip any non-local tab and private browsing windows if the extension
// is not allowed to access them.
continue;
}
@ -371,9 +379,11 @@ this.devtools = class extends ExtensionAPI {
}
onToolboxCreated(toolbox) {
if (!toolbox.target.isLocalTab) {
// Only local tabs are currently supported (See Bug 1304378 for additional details
// related to remote targets support).
if (!toolbox.target.isLocalTab ||
!this.extension.canAccessWindow(toolbox.target.tab.ownerGlobal)) {
// Skip any non-local (as remote tabs are not yet supported, see Bug 1304378 for additional details
// related to remote targets support), and private browsing windows if the extension
// is not allowed to access them.
return;
}

Просмотреть файл

@ -99,6 +99,7 @@ support-files = !/browser/components/places/tests/browser/head.js
[browser_ext_devtools_inspectedWindow_reload.js]
[browser_ext_devtools_network.js]
[browser_ext_devtools_page.js]
[browser_ext_devtools_page_incognito.js]
[browser_ext_devtools_panel.js]
[browser_ext_devtools_panels_elements.js]
[browser_ext_devtools_panels_elements_sidebar.js]

Просмотреть файл

@ -0,0 +1,86 @@
/* -*- Mode: indent-tabs-mode: nil; js-indent-level: 2 -*- */
/* vim: set sts=2 sw=2 et tw=80: */
"use strict";
loadTestSubscript("head_devtools.js");
add_task(async function setup() {
await SpecialPowers.pushPrefEnv({set: [
["extensions.allowPrivateBrowsingByDefault", false],
]});
});
async function testIncognito(incognitoOverride) {
let privateAllowed = incognitoOverride == "spanning";
function devtools_page(privateAllowed) {
if (!privateAllowed) {
browser.test.fail("Extension devtools_page should not be created on private tabs if not allowed");
}
browser.test.sendMessage("devtools_page:loaded");
}
let extension = ExtensionTestUtils.loadExtension({
manifest: {
"devtools_page": "devtools_page.html",
},
incognitoOverride,
files: {
"devtools_page.html": `
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<script src="devtools_page.js"></script>
</head>
</html>
`,
"devtools_page.js": `(${devtools_page})(${privateAllowed})`,
},
});
let existingPrivateWindow = await BrowserTestUtils.openNewBrowserWindow({private: true});
await extension.startup();
await openToolboxForTab(existingPrivateWindow.gBrowser.selectedTab);
if (privateAllowed) {
// Wait the devtools_page to be loaded if it is allowed.
await extension.awaitMessage("devtools_page:loaded");
}
// If the devtools_page is created for a not allowed extension, the devtools page will
// trigger a test failure, but let's make an explicit assertion otherwise mochitest will
// complain because there was no assertion in the test.
ok(true, `Opened toolbox on an existing private window (extension ${incognitoOverride})`);
let newPrivateWindow = await BrowserTestUtils.openNewBrowserWindow({private: true});
await openToolboxForTab(newPrivateWindow.gBrowser.selectedTab);
if (privateAllowed) {
await extension.awaitMessage("devtools_page:loaded");
}
// If the devtools_page is created for a not allowed extension, the devtools page will
// trigger a test failure.
ok(true, `Opened toolbox on a newprivate window (extension ${incognitoOverride})`);
// Close opened toolboxes and private windows.
await closeToolboxForTab(existingPrivateWindow.gBrowser.selectedTab);
await closeToolboxForTab(newPrivateWindow.gBrowser.selectedTab);
await BrowserTestUtils.closeWindow(existingPrivateWindow);
await BrowserTestUtils.closeWindow(newPrivateWindow);
await extension.unload();
}
add_task(async function test_devtools_page_not_allowed() {
await testIncognito();
});
add_task(async function test_devtools_page_allowed() {
await testIncognito("spanning");
});