Bug 1380597 - Ensure the url can be loaded by the extension. r=kmag

MozReview-Commit-ID: GH31FlHxpVu

browser/components/extensions/ext-browserAction.js

@@ -648,6 +648,9 @@ this.browserAction = class extends ExtensionAPI {
           // For internal consistency, we currently resolve both relative to the
           // calling context.
           let url = details.popup && context.uri.resolve(details.popup);
+          if (url && !context.checkLoadURL(url)) {
+            return Promise.reject({message: `Access denied for URL ${url}`});
+          }
           browserAction.setProperty(tab, "popup", url);
         },
 

browser/components/extensions/ext-pageAction.js

@@ -329,6 +329,9 @@ this.pageAction = class extends ExtensionAPI {
           // For internal consistency, we currently resolve both relative to the
           // calling context.
           let url = details.popup && context.uri.resolve(details.popup);
+          if (url && !context.checkLoadURL(url)) {
+            return Promise.reject({message: `Access denied for URL ${url}`});
+          }
           pageAction.setProperty(tab, "popup", url);
         },
 

browser/components/extensions/ext-sidebarAction.js

@@ -417,6 +417,9 @@ this.sidebarAction = class extends ExtensionAPI {
             url = null;
           } else if (details.panel !== "") {
             url = context.uri.resolve(details.panel);
+            if (!context.checkLoadURL(url)) {
+              return Promise.reject({message: `Access denied for URL ${url}`});
+            }
           } else {
             throw new ExtensionError("Invalid url for sidebar panel.");
           }

browser/components/extensions/schemas/page_action.json

@@ -177,6 +177,7 @@
       {
         "name": "setPopup",
         "type": "function",
+        "async": true,
         "description": "Sets the html document to be opened as a popup when the user clicks on the page action's icon.",
         "parameters": [
           {

browser/components/extensions/test/browser/browser_ext_browserAction_context.js

@@ -391,6 +391,15 @@ add_task(async function testDefaultTitle() {
           browser.test.log("Set default title to null string. Expect null string from API, extension title in UI.");
           browser.browserAction.setTitle({title: ""});
 
+          await expectDefaults(details[3]);
+          expect(details[3]);
+        },
+        async expect => {
+          browser.test.assertRejects(
+            browser.browserAction.setPopup({popup: "about:addons"}),
+            /Access denied for URL about:addons/,
+            "unable to set popup to about:addons");
+
           await expectDefaults(details[3]);
           expect(details[3]);
         },

browser/components/extensions/test/browser/browser_ext_pageAction_context.js

@@ -170,6 +170,14 @@ add_task(async function testTabSwitchContext() {
           await browser.pageAction.hide(tabs[0]);
           expect(null);
         },
+        async expect => {
+          browser.test.assertRejects(
+            browser.pageAction.setPopup({tabId: tabs[0], popup: "about:addons"}),
+            /Access denied for URL about:addons/,
+            "unable to set popup to about:addons");
+
+          expect(null);
+        },
       ];
     },
   });

browser/components/extensions/test/browser/browser_ext_sidebarAction_context.js

@@ -372,6 +372,15 @@ add_task(async function testDefaultTitle() {
           browser.test.log("Set default title to null string. Expect null string from API, extension title in UI.");
           browser.sidebarAction.setTitle({title: ""});
 
+          await expectDefaults(details[3]);
+          expect(details[3]);
+        },
+        async expect => {
+          browser.test.assertRejects(
+            browser.sidebarAction.setPanel({panel: "about:addons"}),
+            /Access denied for URL about:addons/,
+            "unable to set panel to about:addons");
+
           await expectDefaults(details[3]);
           expect(details[3]);
         },