Bug 1876924 - Accept manifest with "incognito":"split" r=rpl

Before this patch, extensions with "incognito":"split" could not be
loaded at all. With this patch, we accept such extensions, but default
to "not_allowed". This prevents users from installing the extension in
private browsing mode (including permanent private browsing mode), but
at least it enables users to use the extension in regular browsing mode.

Differential Revision: https://phabricator.services.mozilla.com/D199800

toolkit/components/extensions/Schemas.sys.mjs

@@ -316,6 +316,27 @@ const POSTPROCESSORS = {
     }
     return value;
   },
+
+  incognitoSplitUnsupportedAndFallback(value, context) {
+    if (value === "split") {
+      // incognito:split has not been implemented (bug 1380812). There are two
+      // alternatives: "spanning" and "not_allowed".
+      //
+      // "incognito":"split" is required by Chrome when extensions want to load
+      // any extension page in a tab in Chrome. In Firefox that is not required,
+      // so extensions could replace "split" with "spanning".
+      // Another (poorly documented) effect of "incognito":"split" is separation
+      // of some state between some extension APIs. Because this can in theory
+      // result in unwanted mixing of state between private and non-private
+      // browsing, we fall back to "not_allowed", which prevents the user from
+      // enabling the extension in private browsing windows.
+      value = "not_allowed";
+      context.logWarning(
+        `incognito "split" is unsupported. Falling back to incognito "${value}".`
+      );
+    }
+    return value;
+  },
 };
 
 // Parses a regular expression, with support for the Python extended

toolkit/components/extensions/schemas/manifest.json

@@ -121,7 +121,9 @@
 
           "incognito": {
             "type": "string",
-            "enum": ["not_allowed", "spanning"],
+            "description": "The 'split' value is not supported.",
+            "enum": ["not_allowed", "spanning", "split"],
+            "postprocess": "incognitoSplitUnsupportedAndFallback",
             "default": "spanning",
             "optional": true
           },

toolkit/components/extensions/test/xpcshell/test_ext_manifest_incognito.js

@@ -27,19 +27,48 @@ add_task(async function test_manifest_incognito() {
     "Should have the expected incognito string"
   );
 
+  ExtensionTestUtils.failOnSchemaWarnings(false);
   normalized = await ExtensionTestUtils.normalizeManifest({
-    incognito: "split",
+    incognito: "whatisthis",
   });
+  ExtensionTestUtils.failOnSchemaWarnings(true);
 
   equal(
     normalized.error,
-    'Error processing incognito: Invalid enumeration value "split"',
+    'Error processing incognito: Invalid enumeration value "whatisthis"',
     "Should have an error"
   );
   Assert.deepEqual(normalized.errors, [], "Should not have a warning");
+
+  // Sanity check: Default value of "incognito" is "spanning".
+  normalized = await ExtensionTestUtils.normalizeManifest({});
+  equal(normalized.error, undefined, "Should not have an error");
+  equal(normalized.errors.length, 0, "Should not have warnings");
   equal(
-    normalized.value,
+    normalized.value.incognito,
-    undefined,
+    "spanning",
-    "Invalid incognito string should be undefined"
+    "Should have the expected default value for incognito when unspecified"
+  );
+});
+
+add_task(async function test_manifest_incognito_split_fallback_not_allowed() {
+  ExtensionTestUtils.failOnSchemaWarnings(false);
+  let normalized = await ExtensionTestUtils.normalizeManifest({
+    incognito: "split",
+  });
+  ExtensionTestUtils.failOnSchemaWarnings(true);
+
+  equal(normalized.error, undefined, "Should not have an error");
+  Assert.deepEqual(
+    normalized.errors,
+    [
+      `Warning processing incognito: incognito "split" is unsupported. Falling back to incognito "not_allowed".`,
+    ],
+    "Should have a warning"
+  );
+  equal(
+    normalized.value.incognito,
+    "not_allowed",
+    "incognito:split should fall back to not_allowed by default"
   );
 });

toolkit/components/extensions/test/xpcshell/xpcshell.toml

@@ -75,6 +75,7 @@ skip-if = ["os == 'android'"] # Not shipped on Android
 ["test_ext_manifest_content_security_policy.js"]
 
 ["test_ext_manifest_incognito.js"]
+skip-if = ["condprof"] # remove in a few days - see bug 1891740
 
 ["test_ext_manifest_minimum_chrome_version.js"]