Bug 1429590 - Only allow one homepage to be set by extensions r?aswan
MozReview-Commit-ID: 8DTj8ceWAr8
--- a/browser/components/extensions/schemas/chrome_settings_overrides.json
+++ b/browser/components/extensions/schemas/chrome_settings_overrides.json
@@ -7,17 +7,17 @@
"properties": {
"chrome_settings_overrides": {
"type": "object",
"optional": true,
"additionalProperties": { "$ref": "UnrecognizedProperty" },
"properties": {
"homepage": {
"type": "string",
- "format": "relativeUrl",
+ "format": "homepageUrl",
"optional": true,
"preprocess": "localize"
},
"search_provider": {
"type": "object",
"optional": true,
"additionalProperties": { "$ref": "UnrecognizedProperty" },
"properties": {
--- a/browser/components/extensions/test/browser/browser_ext_chrome_settings_overrides_home.js
+++ b/browser/components/extensions/test/browser/browser_ext_chrome_settings_overrides_home.js
@@ -264,8 +264,29 @@ add_task(async function test_local() {
await prefPromise;
let homepage = getHomePageURL();
ok((homepage.startsWith("moz-extension") && homepage.endsWith("home.html")),
"Home url should be relative to extension.");
await ext1.unload();
});
+
+add_task(async function test_multiple() {
+ let extension = ExtensionTestUtils.loadExtension({
+ manifest: {
+ chrome_settings_overrides: {
+ homepage: "https://mozilla.org/|https://developer.mozilla.org/|https://addons.mozilla.org/",
+ },
+ },
+ useAddonManager: "temporary",
+ });
+
+ let prefPromise = promisePrefChangeObserved(HOMEPAGE_URL_PREF);
+ await extension.startup();
+ await prefPromise;
+
+ is(getHomePageURL(),
+ "https://mozilla.org/%7Chttps://developer.mozilla.org/%7Chttps://addons.mozilla.org/",
+ "The homepage encodes | so only one homepage is allowed");
+
+ await extension.unload();
+});
--- a/toolkit/components/extensions/Schemas.jsm
+++ b/toolkit/components/extensions/Schemas.jsm
@@ -936,16 +936,24 @@ const FORMATS = {
} catch (e) {
return string;
}
}
throw new SyntaxError(`String ${JSON.stringify(string)} must be a relative URL`);
},
+ homepageUrl(string, context) {
+ // Pipes are used for separating homepages, but we only allow extensions to
+ // set a single homepage. Encoding any pipes makes it one URL.
+ return FORMATS.relativeUrl(
+ string.replace(new RegExp("\\|", "g"), "%7C"),
+ context);
+ },
+
imageDataOrStrictRelativeUrl(string, context) {
// Do not accept a string which resolves as an absolute URL, or any
// protocol-relative URL, except PNG or JPG data URLs
if (!string.startsWith("data:image/png;base64,") && !string.startsWith("data:image/jpeg;base64,")) {
try {
return FORMATS.strictRelativeUrl(string, context);
} catch (e) {
throw new SyntaxError(`String ${JSON.stringify(string)} must be a relative or PNG or JPG data:image URL`);