Bug 1429590 - Only allow one homepage to be set by extensions r?aswan draft
authorMark Striemer <mstriemer@mozilla.com>
Wed, 31 Jan 2018 20:21:32 -0600
changeset 753393 c2638d4ce4b7deaf93bf5dbbccaaeb822f19490a
parent 749892 95e07a79f4b21c5e9981393e9d0255a8787fa1ef
push id98554
push userbmo:mstriemer@mozilla.com
push dateFri, 09 Feb 2018 23:56:21 +0000
reviewersaswan
bugs1429590
milestone60.0a1
Bug 1429590 - Only allow one homepage to be set by extensions r?aswan MozReview-Commit-ID: 8DTj8ceWAr8
browser/components/extensions/schemas/chrome_settings_overrides.json
browser/components/extensions/test/browser/browser_ext_chrome_settings_overrides_home.js
toolkit/components/extensions/Schemas.jsm
--- a/browser/components/extensions/schemas/chrome_settings_overrides.json
+++ b/browser/components/extensions/schemas/chrome_settings_overrides.json
@@ -7,17 +7,17 @@
         "properties": {
           "chrome_settings_overrides": {
             "type": "object",
             "optional": true,
             "additionalProperties": { "$ref": "UnrecognizedProperty" },
             "properties": {
               "homepage": {
                 "type": "string",
-                "format": "relativeUrl",
+                "format": "homepageUrl",
                 "optional": true,
                 "preprocess": "localize"
               },
              "search_provider": {
                 "type": "object",
                 "optional": true,
                 "additionalProperties": { "$ref": "UnrecognizedProperty" },
                 "properties": {
--- a/browser/components/extensions/test/browser/browser_ext_chrome_settings_overrides_home.js
+++ b/browser/components/extensions/test/browser/browser_ext_chrome_settings_overrides_home.js
@@ -264,8 +264,29 @@ add_task(async function test_local() {
   await prefPromise;
 
   let homepage = getHomePageURL();
   ok((homepage.startsWith("moz-extension") && homepage.endsWith("home.html")),
      "Home url should be relative to extension.");
 
   await ext1.unload();
 });
+
+add_task(async function test_multiple() {
+  let extension = ExtensionTestUtils.loadExtension({
+    manifest: {
+      chrome_settings_overrides: {
+        homepage: "https://mozilla.org/|https://developer.mozilla.org/|https://addons.mozilla.org/",
+      },
+    },
+    useAddonManager: "temporary",
+  });
+
+  let prefPromise = promisePrefChangeObserved(HOMEPAGE_URL_PREF);
+  await extension.startup();
+  await prefPromise;
+
+  is(getHomePageURL(),
+     "https://mozilla.org/%7Chttps://developer.mozilla.org/%7Chttps://addons.mozilla.org/",
+     "The homepage encodes | so only one homepage is allowed");
+
+  await extension.unload();
+});
--- a/toolkit/components/extensions/Schemas.jsm
+++ b/toolkit/components/extensions/Schemas.jsm
@@ -936,16 +936,24 @@ const FORMATS = {
       } catch (e) {
         return string;
       }
     }
 
     throw new SyntaxError(`String ${JSON.stringify(string)} must be a relative URL`);
   },
 
+  homepageUrl(string, context) {
+    // Pipes are used for separating homepages, but we only allow extensions to
+    // set a single homepage. Encoding any pipes makes it one URL.
+    return FORMATS.relativeUrl(
+      string.replace(new RegExp("\\|", "g"), "%7C"),
+      context);
+  },
+
   imageDataOrStrictRelativeUrl(string, context) {
     // Do not accept a string which resolves as an absolute URL, or any
     // protocol-relative URL, except PNG or JPG data URLs
     if (!string.startsWith("data:image/png;base64,") && !string.startsWith("data:image/jpeg;base64,")) {
       try {
         return FORMATS.strictRelativeUrl(string, context);
       } catch (e) {
         throw new SyntaxError(`String ${JSON.stringify(string)} must be a relative or PNG or JPG data:image URL`);