browser object doesn't work on privileged pages

[bovine3dom]

Steps to reproduce:

1. add this to config

glide.keymaps.set("normal", "k", async ({ tab_id }) => {
  browser.scripting.executeScript({ target: { tabId: tab_id }, func: () => console.log(document) });
});

2. press k on a new tab page

Expected behaviour:

document gets logged to web console

Actual behaviour:

permissions error

---

Extensions with the mozillaAddons permission are allowed to run everywhere, which you ask for here

glide/src/browser/extensions/glide/manifest.json

Line 14 in 74c7718

"mozillaAddons",

But Firefox has extra checks built-in to make sure random extensions (like your wrapper and Tridactyl) do not ask for this permission, e.g. https://searchfox.org/firefox-main/rev/21d3e8ab8b61715ddd39ac04c62a846fa79deddd/toolkit/components/extensions/Extension.sys.mjs#1184

Years ago I started work on a patch set for Firefox so that Tridactyl could use these permissions but I never got them working: https://github.com/tridactyl/godmode/blob/3e0fe7df81fff00715074a31255870a7114ae2ea/patches/privilegeForAll.patch#L15

It would be cool if we could solve this together :)

[RobertCraigie]

I don't have time to investigate further right now but the internal wrapper extension we use does have isPrivileged set so the issue is somewhere else.

GlideBrowser.extension.restrictSchemes also returns false.

so I think we'll have to patch somewhere else in the firefox extensions permissions system.

[bovine3dom]

:O

I never checked whether Tridactyl counted as privileged after the patch but that would make sense. The plot thickens. 🤔

[RobertCraigie]

I've tracked it down to this line https://github.com/mozilla-firefox/firefox/blob/6f3037f71baa242161ed343cdccb12c1b8e50227/toolkit/components/extensions/ExtensionContent.sys.mjs#L1472 where script.matchesWindowGlobal(wg) returns false for some reason...

This is just for the browser.scripting.executeScript() case, I haven't checked if other APIs hit this code path but I think they don't.

[RobertCraigie]

I've narrowed it down a bit more to https://github.com/mozilla-firefox/firefox/blob/6f3037f71baa242161ed343cdccb12c1b8e50227/toolkit/components/extensions/WebExtensionPolicy.cpp#L894.

I think there's probably a check higher up in the stack that should return early 🤔

[RobertCraigie]

Tempted to just use this patch, so that for our internal wrapper extension, it can always match.

diff --git a/toolkit/components/extensions/WebExtensionPolicy.cpp b/toolkit/components/extensions/WebExtensionPolicy.cpp
index 8755aa3778cf66836bf35b568e65f44f3b7ec754..198107feff370e94c86113b47f8e7b72302362d5 100644
--- a/toolkit/components/extensions/WebExtensionPolicy.cpp
+++ b/toolkit/components/extensions/WebExtensionPolicy.cpp
@@ -785,6 +785,12 @@ WebExtensionContentScript::WebExtensionContentScript(
 
 bool MozDocumentMatcher::Matches(const DocInfo& aDoc,
                                  bool aIgnorePermissions) const {
+  if (mExtension && mExtension->Id() &&
+      mExtension->Id()->Equals(
+          nsLiteralString(u"[email protected]"))) {
+    return true;
+  }
+
   if (!mFrameID.IsNull()) {
     if (aDoc.FrameID() != mFrameID.Value()) {
       return false;

feels kinda gross but...?

confirmed that works with browser.scripting.executeScript(), any other APIs you'd recommend checking?

[bovine3dom]

that is kind of unpleasant.

the benefit of making changes to .mjs is that you can patch Firefox without needing to recompile it, see here and here

I don't know how crucially important your other c++ patches are - they seem to mostly relate to branding and the caret?

Offering an omni.ja route would let people use Widevine, etc.

---

re other APIs: not sure. for Tridactyl the problem is that our content script doesn't get loaded into forbidden pages. Which could plausibly be the same check