Bug 1909298 - Confirm permission in webRequest r=rpl

Differential Revision: https://phabricator.services.mozilla.com/D217449

Author: Rob--W

toolkit/components/extensions/webrequest/ChannelWrapper.cpp

@@ -180,7 +180,7 @@ already_AddRefed<ChannelWrapper> ChannelWrapper::GetRegisteredChannel(
   auto& webreq = WebRequestService::GetSingleton();
 
   nsCOMPtr<nsITraceableChannel> channel =
-      webreq.GetTraceableChannel(aChannelId, aAddon.Id(), contentParent);
+      webreq.GetTraceableChannel(aChannelId, aAddon, contentParent);
   if (!channel) {
     return nullptr;
   }
@@ -814,9 +814,14 @@ void ChannelWrapper::RegisterTraceableChannel(const WebExtensionPolicy& aAddon,
 }
 
 already_AddRefed<nsITraceableChannel> ChannelWrapper::GetTraceableChannel(
-    nsAtom* aAddonId, dom::ContentParent* aContentParent) const {
+    const WebExtensionPolicy& aAddon,
+    dom::ContentParent* aContentParent) const {
   nsCOMPtr<nsIRemoteTab> remoteTab;
-  if (mAddonEntries.Get(aAddonId, getter_AddRefs(remoteTab))) {
+  if (mAddonEntries.Get(aAddon.Id(), getter_AddRefs(remoteTab))) {
+    if (!aAddon.CanAccessURI(FinalURLInfo(), false, true, true)) {
+      return nullptr;
+    }
+
     ContentParent* contentParent = nullptr;
     if (remoteTab) {
       contentParent =

toolkit/components/extensions/webrequest/ChannelWrapper.h

@@ -150,7 +150,8 @@ class ChannelWrapper final : public DOMEventTargetHelper,
                                 nsIRemoteTab* aBrowserParent);
 
   already_AddRefed<nsITraceableChannel> GetTraceableChannel(
-      nsAtom* aAddonId, dom::ContentParent* aContentParent) const;
+      const WebExtensionPolicy& aAddon,
+      dom::ContentParent* aContentParent) const;
 
   void GetMethod(nsCString& aRetVal) const;
 

toolkit/components/extensions/webrequest/StreamFilterParent.cpp

@@ -120,9 +120,15 @@ auto StreamFilterParent::Create(dom::ContentParent* aContentParent,
 
   auto& webreq = WebRequestService::GetSingleton();
 
-  RefPtr<nsAtom> addonId = NS_Atomize(aAddonId);
+  RefPtr<extensions::WebExtensionPolicy> addonPolicy =
+      ExtensionPolicyService::GetSingleton().GetByID(aAddonId);
+
+  if (!addonPolicy) {
+    return ChildEndpointPromise::CreateAndReject(false, __func__);
+  }
+
   nsCOMPtr<nsITraceableChannel> channel =
-      webreq.GetTraceableChannel(aChannelId, addonId, aContentParent);
+      webreq.GetTraceableChannel(aChannelId, *addonPolicy, aContentParent);
 
   RefPtr<mozilla::net::nsHttpChannel> chan = do_QueryObject(channel);
   if (!chan) {
@@ -131,15 +137,10 @@ auto StreamFilterParent::Create(dom::ContentParent* aContentParent,
 
   nsCOMPtr<nsIChannel> genChan(do_QueryInterface(channel));
   if (!StaticPrefs::extensions_filterResponseServiceWorkerScript_disabled() &&
-      ChannelWrapper::IsServiceWorkerScript(genChan)) {
-    RefPtr<extensions::WebExtensionPolicy> addonPolicy =
-        ExtensionPolicyService::GetSingleton().GetByID(aAddonId);
-
-    if (!addonPolicy ||
-        !addonPolicy->HasPermission(
-            nsGkAtoms::webRequestFilterResponse_serviceWorkerScript)) {
-      return ChildEndpointPromise::CreateAndReject(false, __func__);
-    }
+      ChannelWrapper::IsServiceWorkerScript(genChan) &&
+      !addonPolicy->HasPermission(
+          nsGkAtoms::webRequestFilterResponse_serviceWorkerScript)) {
+    return ChildEndpointPromise::CreateAndReject(false, __func__);
   }
 
   // Disable alt-data for extension stream listeners.

toolkit/components/extensions/webrequest/WebRequestService.cpp

@@ -36,10 +36,11 @@ UniquePtr<WebRequestChannelEntry> WebRequestService::RegisterChannel(
 }
 
 already_AddRefed<nsITraceableChannel> WebRequestService::GetTraceableChannel(
-    uint64_t aChannelId, nsAtom* aAddonId, ContentParent* aContentParent) {
+    uint64_t aChannelId, const WebExtensionPolicy& aAddon,
+    ContentParent* aContentParent) {
   if (auto entry = mChannelEntries.Get(aChannelId)) {
     if (entry->mChannel) {
-      return entry->mChannel->GetTraceableChannel(aAddonId, aContentParent);
+      return entry->mChannel->GetTraceableChannel(aAddon, aContentParent);
     }
   }
   return nullptr;

toolkit/components/extensions/webrequest/WebRequestService.h

@@ -16,7 +16,6 @@
 #include "nsHashKeys.h"
 #include "nsTHashMap.h"
 
-class nsAtom;
 class nsIRemoteTab;
 class nsITraceableChannel;
 
@@ -62,7 +61,7 @@ class WebRequestService final {
   void UnregisterTraceableChannel(uint64_t aChannelId);
 
   already_AddRefed<nsITraceableChannel> GetTraceableChannel(
-      uint64_t aChannelId, nsAtom* aAddonId,
+      uint64_t aChannelId, const WebExtensionPolicy& aAddon,
       dom::ContentParent* aContentParent);
 
  private: