Bug 1375485 - Validate permission types in permissions.request. r?aswan draft
authorIan Moody <moz-ian@perix.co.uk>
Wed, 20 Sep 2017 22:54:03 +0100
changeset 667943 d14773ff802d70380460c87c52ae89ce8e51627b
parent 667942 61fe57e45ae43a11fb9f772b7b51f551a91974c9
child 732546 6ae4117957e0e8ec377ba9535ae2cc2bdb94228c
push id80883
push usermoz-ian@perix.co.uk
push dateWed, 20 Sep 2017 22:06:47 +0000
reviewersaswan
bugs1375485
milestone57.0a1
Bug 1375485 - Validate permission types in permissions.request. r?aswan MozReview-Commit-ID: 2K1vLyiNFMY
toolkit/components/extensions/ext-permissions.js
--- a/toolkit/components/extensions/ext-permissions.js
+++ b/toolkit/components/extensions/ext-permissions.js
@@ -16,23 +16,30 @@ this.permissions = class extends Extensi
   getAPI(context) {
     return {
       permissions: {
         async request(perms) {
           let {permissions, origins} = perms;
 
           let manifestPermissions = context.extension.manifest.optional_permissions;
           for (let perm of permissions) {
+            if (!context.extension.classifyPermission(perm).permission &&
+                !context.extension.classifyPermission(perm).api) {
+              throw new ExtensionError(`The requested permission ${perm} is not valid`);
+            }
             if (!manifestPermissions.includes(perm)) {
               throw new ExtensionError(`Cannot request permission ${perm} since it was not declared in optional_permissions`);
             }
           }
 
           let optionalOrigins = context.extension.optionalOrigins;
           for (let origin of origins) {
+            if (!context.extension.classifyPermission(origin).origin) {
+              throw new ExtensionError(`The requested origin ${origin} is not valid`);
+            }
             if (!optionalOrigins.subsumes(new MatchPattern(origin))) {
               throw new ExtensionError(`Cannot request origin permission for ${origin} since it was not declared in optional_permissions`);
             }
           }
 
           if (promptsEnabled) {
             permissions = permissions.filter(perm => !context.extension.hasPermission(perm));
             origins = origins.filter(origin => !context.extension.whiteListedHosts.subsumes(new MatchPattern(origin)));