Bug 1491272 - Lock experimental userScripts API behind a pref and make it enabled by default on Nightly. r=mixedpuppy

Depends on D6146

Differential Revision: https://phabricator.services.mozilla.com/D6147

--HG--
extra : moz-landing-system : lando

modules/libpref/init/all.js

@@ -5019,6 +5019,14 @@ pref("extensions.webextensions.protocol.remote", true);
 // Enable tab hiding API by default.
 pref("extensions.webextensions.tabhide.enabled", true);
 
+#ifdef NIGHTLY_BUILD
+// Enable userScripts API by default on Nightly.
+pref("extensions.webextensions.userScripts.enabled", true);
+#else
+// Disable userScripts API by default on all other channels.
+pref("extensions.webextensions.userScripts.enabled", false);
+#endif
+
 pref("extensions.webextensions.background-delayed-startup", false);
 
 // Whether or not the installed extensions should be migrated to the storage.local IndexedDB backend.

toolkit/components/extensions/child/ext-userScripts.js

@@ -2,6 +2,11 @@
 /* vim: set sts=2 sw=2 et tw=80: */
 "use strict";
 
+const USERSCRIPT_PREFNAME = "extensions.webextensions.userScripts.enabled";
+const USERSCRIPT_DISABLED_ERRORMSG = `userScripts APIs are currently experimental and must be enabled with the ${USERSCRIPT_PREFNAME} preference.`;
+
+XPCOMUtils.defineLazyPreferenceGetter(this, "userScriptsEnabled", USERSCRIPT_PREFNAME, false);
+
 Cu.importGlobalProperties(["crypto", "TextEncoder"]);
 
 var {
@@ -143,6 +148,10 @@ this.userScripts = class extends ExtensionAPI {
     return {
       userScripts: {
         register(options) {
+          if (!userScriptsEnabled) {
+            throw new ExtensionError(USERSCRIPT_DISABLED_ERRORMSG);
+          }
+
           let scriptId = getUniqueId();
           return context.cloneScope.Promise.resolve().then(async () => {
             options.scriptId = scriptId;
@@ -156,6 +165,10 @@ this.userScripts = class extends ExtensionAPI {
           });
         },
         setScriptAPIs(exportedAPIMethods) {
+          if (!userScriptsEnabled) {
+            throw new ExtensionError(USERSCRIPT_DISABLED_ERRORMSG);
+          }
+
           context.setUserScriptAPIs(exportedAPIMethods);
         },
       },

toolkit/components/extensions/test/xpcshell/test_ext_userScripts.js

@@ -13,7 +13,7 @@ server.registerDirectory("/data/", do_get_file("data"));
 
 const BASE_URL = `http://localhost:${server.identity.primaryPort}/data`;
 
-add_task(async function setup_optional_permission_observer() {
+add_task(async function setup_test_environment() {
   // Grant the optional permissions requested.
   function permissionObserver(subject, topic, data) {
     if (topic == "webextension-optional-permission-prompt") {
@@ -25,6 +25,12 @@ add_task(async function setup_optional_permission_observer() {
   registerCleanupFunction(() => {
     Services.obs.removeObserver(permissionObserver, "webextension-optional-permission-prompt");
   });
+
+  // Turn on the userScripts API using the related pref.
+  Services.prefs.setBoolPref("extensions.webextensions.userScripts.enabled", true);
+  registerCleanupFunction(() => {
+    Services.prefs.clearUserPref("extensions.webextensions.userScripts.enabled");
+  });
 });
 
 // Test that there is no userScripts API namespace when the manifest doesn't include a user_scripts
@@ -514,3 +520,73 @@ add_task(async function test_cached_userScript_on_document_start() {
   await contentPage.close();
   await extension.unload();
 });
+
+add_task(async function test_userScripts_pref_disabled() {
+  async function run_userScript_on_pref_disabled_test() {
+    async function background() {
+      let promise = (async () => {
+        await browser.userScripts.register({
+          js: [
+            {code: "throw new Error('This userScripts should not be registered')"},
+          ],
+          runAt: "document_start",
+          matches: ["<all_urls>"],
+        });
+      })();
+
+      await browser.test.assertRejects(
+        promise,
+        /userScripts APIs are currently experimental/,
+        "Got the expected error from userScripts.register when the userScripts API is disabled");
+
+      browser.test.sendMessage("background-page:done");
+    }
+
+    async function contentScript() {
+      let promise = (async () => {
+        browser.userScripts.setScriptAPIs({
+          GM_apiMethod() {},
+        });
+      })();
+      await browser.test.assertRejects(
+        promise,
+        /userScripts APIs are currently experimental/,
+        "Got the expected error from userScripts.setScriptAPIs when the userScripts API is disabled");
+
+      browser.test.sendMessage("content-script:done");
+    }
+
+    let extension = ExtensionTestUtils.loadExtension({
+      background,
+      manifest: {
+        permissions: ["http://*/*/file_sample.html"],
+        user_scripts: {},
+        content_scripts: [
+          {
+            matches:  ["http://*/*/file_sample.html"],
+            js: ["content_script.js"],
+            run_at: "document_start",
+          },
+        ],
+      },
+      files: {
+        "content_script.js": contentScript,
+      },
+    });
+
+    await extension.startup();
+
+    await extension.awaitMessage("background-page:done");
+
+    let url = `${BASE_URL}/file_sample.html`;
+    let contentPage = await ExtensionTestUtils.loadContentPage(url);
+
+    await extension.awaitMessage("content-script:done");
+
+    await extension.unload();
+    await contentPage.close();
+  }
+
+  await runWithPrefs([["extensions.webextensions.userScripts.enabled", false]],
+                     run_userScript_on_pref_disabled_test);
+});

toolkit/components/extensions/test/xpcshell/test_ext_userScripts_telemetry.js

@@ -10,7 +10,7 @@ server.registerDirectory("/data/", do_get_file("data"));
 
 const BASE_URL = `http://localhost:${server.identity.primaryPort}/data`;
 
-add_task(async function test_userScripts_telemetry() {
+async function run_userScripts_telemetry_test() {
   function apiScript() {
     browser.userScripts.setScriptAPIs({
       US_test_sendMessage([msg, data], scriptMetadata, scriptGlobal) {
@@ -120,4 +120,9 @@ add_task(async function test_userScripts_telemetry() {
 
   await contentPage.close();
   await extension2.unload();
+}
+
+add_task(async function test_userScripts_telemetry() {
+  await runWithPrefs([["extensions.webextensions.userScripts.enabled", true]],
+                     run_userScripts_telemetry_test);
 });