# HG changeset patch
# User Andrew Swan <aswan@mozilla.com>
# Date 1510212203 28800
#      Wed Nov 08 23:23:23 2017 -0800
# Node ID e1a156fb6726b9f4d2b691f860b45e970b203edc
# Parent  5faab9e619901b1513fd4ca137747231be550def
Bug 1396399 Test for content scripts and activeTab permission

MozReview-Commit-ID: DyVtSuA9voI

diff --git a/testing/specialpowers/content/SpecialPowersObserver.jsm b/testing/specialpowers/content/SpecialPowersObserver.jsm
--- a/testing/specialpowers/content/SpecialPowersObserver.jsm
+++ b/testing/specialpowers/content/SpecialPowersObserver.jsm
@@ -83,16 +83,17 @@ SpecialPowersObserver.prototype._loadFra
     this._messageManager.addMessageListener("SPImportInMainProcess", this);
     this._messageManager.addMessageListener("SPChromeScriptMessage", this);
     this._messageManager.addMessageListener("SPQuotaManager", this);
     this._messageManager.addMessageListener("SPSetTestPluginEnabledState", this);
     this._messageManager.addMessageListener("SPLoadExtension", this);
     this._messageManager.addMessageListener("SPStartupExtension", this);
     this._messageManager.addMessageListener("SPUnloadExtension", this);
     this._messageManager.addMessageListener("SPExtensionMessage", this);
+    this._messageManager.addMessageListener("SPExtensionGrantActiveTab", this);
     this._messageManager.addMessageListener("SPCleanUpSTSData", this);
     this._messageManager.addMessageListener("SPRequestDumpCoverageCounters", this);
     this._messageManager.addMessageListener("SPRequestResetCoverageCounters", this);
 
     this._messageManager.loadFrameScript(CHILD_LOGGER_SCRIPT, true);
     this._messageManager.loadFrameScript(CHILD_SCRIPT_API, true);
     this._messageManager.loadFrameScript(CHILD_SCRIPT, true);
     this._isFrameScriptLoaded = true;
@@ -154,16 +155,17 @@ SpecialPowersObserver.prototype.uninit =
     this._messageManager.removeMessageListener("SPImportInMainProcess", this);
     this._messageManager.removeMessageListener("SPChromeScriptMessage", this);
     this._messageManager.removeMessageListener("SPQuotaManager", this);
     this._messageManager.removeMessageListener("SPSetTestPluginEnabledState", this);
     this._messageManager.removeMessageListener("SPLoadExtension", this);
     this._messageManager.removeMessageListener("SPStartupExtension", this);
     this._messageManager.removeMessageListener("SPUnloadExtension", this);
     this._messageManager.removeMessageListener("SPExtensionMessage", this);
+    this._messageManager.removeMessageListener("SPExtensionGrantActiveTab", this);
     this._messageManager.removeMessageListener("SPCleanUpSTSData", this);
     this._messageManager.removeMessageListener("SPRequestDumpCoverageCounters", this);
     this._messageManager.removeMessageListener("SPRequestResetCoverageCounters", this);
 
     this._messageManager.removeDelayedFrameScript(CHILD_LOGGER_SCRIPT);
     this._messageManager.removeDelayedFrameScript(CHILD_SCRIPT_API);
     this._messageManager.removeDelayedFrameScript(CHILD_SCRIPT);
     this._isFrameScriptLoaded = false;
diff --git a/testing/specialpowers/content/SpecialPowersObserverAPI.js b/testing/specialpowers/content/SpecialPowersObserverAPI.js
--- a/testing/specialpowers/content/SpecialPowersObserverAPI.js
+++ b/testing/specialpowers/content/SpecialPowersObserverAPI.js
@@ -641,16 +641,23 @@ SpecialPowersObserverAPI.prototype = {
 
       case "SPExtensionMessage": {
         let id = aMessage.data.id;
         let extension = this._extensions.get(id);
         extension.testMessage(...aMessage.data.args);
         return undefined;
       }
 
+      case "SPExtensionGrantActiveTab": {
+        let {id, tabId} = aMessage.data;
+        let {tabManager} = this._extensions.get(id);
+        tabManager.addActiveTabPermission(tabManager.get(tabId).nativeTab);
+        return undefined;
+      }
+
       case "SPUnloadExtension": {
         let id = aMessage.data.id;
         let extension = this._extensions.get(id);
         this._extensions.delete(id);
         let done = () => this._sendReply(aMessage, "SPExtensionMessage", {id, type: "extensionUnloaded", args: []});
         extension.shutdown().then(done, done);
         return undefined;
       }
diff --git a/testing/specialpowers/content/specialpowers.js b/testing/specialpowers/content/specialpowers.js
--- a/testing/specialpowers/content/specialpowers.js
+++ b/testing/specialpowers/content/specialpowers.js
@@ -47,17 +47,18 @@ function SpecialPowers(window) {
                             "SpecialPowers.Quit",
                             "SpecialPowers.CreateFiles",
                             "SpecialPowers.RemoveFiles",
                             "SPPingService",
                             "SPLoadExtension",
                             "SPProcessCrashManagerWait",
                             "SPStartupExtension",
                             "SPUnloadExtension",
-                            "SPExtensionMessage"];
+                            "SPExtensionMessage",
+                            "SPExtensionGrantActiveTab"];
   addMessageListener("SPPingService", this._messageListener);
   addMessageListener("SpecialPowers.FilesCreated", this._messageListener);
   addMessageListener("SpecialPowers.FilesError", this._messageListener);
   let self = this;
   Services.obs.addObserver(function onInnerWindowDestroyed(subject, topic, data) {
     var id = subject.QueryInterface(Components.interfaces.nsISupportsPRUint64).data;
     if (self._windowID === id) {
       Services.obs.removeObserver(onInnerWindowDestroyed, "inner-window-destroyed");
diff --git a/testing/specialpowers/content/specialpowersAPI.js b/testing/specialpowers/content/specialpowersAPI.js
--- a/testing/specialpowers/content/specialpowersAPI.js
+++ b/testing/specialpowers/content/specialpowersAPI.js
@@ -2079,16 +2079,20 @@ SpecialPowersAPI.prototype = {
         state = "unloading";
         sp._sendAsyncMessage("SPUnloadExtension", {id});
         return unloadPromise;
       },
 
       sendMessage(...args) {
         sp._sendAsyncMessage("SPExtensionMessage", {id, args});
       },
+
+      grantActiveTab(tabId) {
+        sp._sendAsyncMessage("SPExtensionGrantActiveTab", {id, tabId});
+      },
     };
 
     this._sendAsyncMessage("SPLoadExtension", {ext, id});
 
     let listener = (msg) => {
       if (msg.data.id == id) {
         if (msg.data.type == "extensionStarted") {
           state = "running";
diff --git a/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab.html b/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab.html
new file mode 100644
--- /dev/null
+++ b/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab.html
@@ -0,0 +1,11 @@
+<!DOCTYPE HTML>
+
+<html>
+<head>
+  <meta charset="utf-8">
+</head>
+<body>
+  <iframe id="emptyframe"></iframe>
+  <iframe id="regularframe" src="http://test1.example.com/"></iframe>
+</body>
+</html>
diff --git a/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab2.html b/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab2.html
new file mode 100644
--- /dev/null
+++ b/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab2.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+
+<html>
+<head>
+  <meta charset="utf-8">
+</head>
+<body>
+  <iframe srcdoc="<iframe src='http://test1.example.com/'&gt;</iframe&gt;"></iframe>
+</body>
+</html>
diff --git a/toolkit/components/extensions/test/mochitest/file_contentscript_iframe.html b/toolkit/components/extensions/test/mochitest/file_contentscript_iframe.html
new file mode 100644
--- /dev/null
+++ b/toolkit/components/extensions/test/mochitest/file_contentscript_iframe.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+
+<html>
+<head>
+  <meta charset="utf-8">
+</head>
+<body>
+  <iframe id="frame" src="http://test2.example.com/"></iframe>
+</body>
+</html>
diff --git a/toolkit/components/extensions/test/mochitest/mochitest-common.ini b/toolkit/components/extensions/test/mochitest/mochitest-common.ini
--- a/toolkit/components/extensions/test/mochitest/mochitest-common.ini
+++ b/toolkit/components/extensions/test/mochitest/mochitest-common.ini
@@ -4,16 +4,19 @@ support-files =
   file_WebNavigation_page1.html
   file_WebNavigation_page2.html
   file_WebNavigation_page3.html
   file_WebRequest_page3.html
   file_WebRequest_permission_original.html
   file_WebRequest_permission_original.js
   file_WebRequest_permission_redirected.html
   file_WebRequest_permission_redirected.js
+  file_contentscript_activeTab.html
+  file_contentscript_activeTab2.html
+  file_contentscript_iframe.html
   file_csp.html
   file_csp.html^headers^
   file_ext_test_api_injection.js
   file_image_bad.png
   file_image_good.png
   file_image_great.png
   file_image_redirect.png
   file_mixed.html
@@ -71,16 +74,17 @@ support-files =
 skip-if = (toolkit == 'android') # android doesn't have devtools
 [test_ext_background_teardown.html]
 [test_ext_clipboard.html]
 [test_ext_clipboard_image.html]
 skip-if = headless # disabled test case with_permission_allow_copy, see inline comment. Headless: Bug 1405872
 [test_ext_content_security_policy.html]
 [test_ext_contentscript_about_blank.html]
 skip-if = os == 'android' # bug 1369440
+[test_ext_contentscript_activeTab.html]
 [test_ext_contentscript_api_injection.html]
 [test_ext_contentscript_async_loading.html]
 skip-if = os == 'android' && debug # The generated script takes too long to load on Android debug
 [test_ext_contentscript_cache.html]
 skip-if = (os == 'linux' && debug) || (toolkit == 'android' && debug) # bug 1348241
 [test_ext_contentscript_canvas.html]
 [test_ext_contentscript_context.html]
 [test_ext_contentscript_create_iframe.html]
diff --git a/toolkit/components/extensions/test/mochitest/test_ext_contentscript_activeTab.html b/toolkit/components/extensions/test/mochitest/test_ext_contentscript_activeTab.html
new file mode 100644
--- /dev/null
+++ b/toolkit/components/extensions/test/mochitest/test_ext_contentscript_activeTab.html
@@ -0,0 +1,372 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for content script</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SpawnTask.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/ExtensionTestUtils.js"></script>
+  <script type="text/javascript" src="head.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+
+<script type="text/javascript">
+"use strict";
+
+// Create a test extension with the provided function as the background
+// script.  The background script will have a few helpful functions
+// available.
+/* global awaitLoad, gatherFrameSources */
+function makeExtension(background) {
+  // Wait for a webNavigation.onCompleted event where the details for the
+  // loaded page match the attributes of `filter`.
+  function awaitLoad(filter) {
+    return new Promise(resolve => {
+      const listener = details => {
+        if (Object.keys(filter).every(key => details[key] === filter[key])) {
+          browser.webNavigation.onCompleted.removeListener(listener);
+          resolve();
+        }
+      };
+      browser.webNavigation.onCompleted.addListener(listener);
+    });
+  }
+
+  // Return a string with a (sorted) list of the source of all frames
+  // in the given tab into which this extension can inject scripts
+  // (ie all frames for which it has the activeTab permission).
+  // Source is the hostname for frames in http sources, or the full
+  // location href in other documents (eg about: pages)
+  async function gatherFrameSources(tabid) {
+    let result = await browser.tabs.executeScript(tabid, {
+      allFrames: true,
+      matchAboutBlank: true,
+      code: "window.location.hostname || window.location.href;",
+    });
+    return String(result.sort());
+  }
+
+  return ExtensionTestUtils.loadExtension({
+    manifest: {
+      permissions: ["activeTab", "webNavigation"],
+    },
+    background: `${awaitLoad}\n${gatherFrameSources}\n${ExtensionTestCommon.serializeScript(background)}`,
+  });
+}
+
+// Test that executeScript() fails without the activeTab permission
+// (or any specific origin permissions).
+add_task(async function test_no_activeTab() {
+  let extension = makeExtension(async function background() {
+    const URL = "http://mochi.test:8888/tests/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab.html";
+
+    let [tab] = await Promise.all([
+      browser.tabs.create({url: URL}),
+      awaitLoad({frameId: 0}),
+    ]);
+
+    try {
+      await gatherFrameSources(tab.id);
+      browser.test.fail("executeScript() should fail without activeTab permission");
+    } catch (err) {
+      browser.test.assertTrue(/^Missing host permission/.test(err.message),
+                              "executeScript() without activeTab permission failed");
+    }
+
+    await browser.tabs.remove(tab.id);
+
+    browser.test.notifyPass("no-active-tab");
+  });
+
+  await extension.startup();
+  await extension.awaitFinish("no-active-tab");
+  await extension.unload();
+});
+
+// Test that dynamically created iframes do not get the activeTab permission
+add_task(async function test_dynamic_frames() {
+  let extension = makeExtension(async function background() {
+    const BASE_HOST = "www.example.com";
+
+    let [tab] = await Promise.all([
+      browser.tabs.create({url: `http://${BASE_HOST}/`}),
+      awaitLoad({frameId: 0}),
+    ]);
+
+    function inject() {
+      let nframes = 4;
+      function frameLoaded() {
+        nframes--;
+        if (nframes == 0) {
+          browser.runtime.sendMessage("frames-loaded");
+        }
+      }
+
+      let frame = document.createElement("iframe");
+      frame.addEventListener("load", frameLoaded, {once: true});
+      document.body.appendChild(frame);
+
+      let div = document.createElement("div");
+      div.innerHTML = "<iframe src='http://test1.example.com/'></iframe>";
+      let framelist = div.getElementsByTagName("iframe");
+      browser.test.assertEq(1, framelist.length, "Found 1 frame inside div");
+      framelist[0].addEventListener("load", frameLoaded, {once: true});
+      document.body.appendChild(div);
+
+      let div2 = document.createElement("div");
+      div2.innerHTML = "<iframe srcdoc=\"<iframe src='http://test2.example.com/'&gt;</iframe&gt;\"></iframe>";
+      framelist = div2.getElementsByTagName("iframe");
+      browser.test.assertEq(1, framelist.length, "Found 1 frame inside div");
+      framelist[0].addEventListener("load", frameLoaded, {once: true});
+      document.body.appendChild(div2);
+
+      const URL = "http://www.example.com/tests/toolkit/components/extensions/test/mochitest/file_contentscript_iframe.html";
+
+      let xhr = new XMLHttpRequest();
+      xhr.open("GET", URL);
+      xhr.responseType = "document";
+      xhr.overrideMimeType("text/html");
+
+      xhr.addEventListener("load", () => {
+        if (xhr.readyState != 4) {
+          return;
+        }
+        if (xhr.status != 200) {
+          browser.runtime.sendMessage("error");
+        }
+
+        let frame = xhr.response.getElementById("frame");
+        browser.test.assertTrue(frame, "Found frame in response document");
+        frame.addEventListener("load", frameLoaded, {once: true});
+        document.body.appendChild(frame);
+      }, {once: true});
+      xhr.addEventListener("error", () => {
+        browser.runtime.sendMessage("error");
+      }, {once: true});
+      xhr.send();
+    }
+
+    browser.test.onMessage.addListener(async () => {
+      let loadedPromise = new Promise((resolve, reject) => {
+        let listener = msg => {
+          let unlisten = () => browser.runtime.onMessage.removeListener(listener);
+          if (msg == "frames-loaded") {
+            unlisten();
+            resolve();
+          } else if (msg == "error") {
+            unlisten();
+            reject();
+          }
+        };
+        browser.runtime.onMessage.addListener(listener);
+      });
+
+      await browser.tabs.executeScript(tab.id, {
+        code: `(${inject})();`,
+      });
+
+      await loadedPromise;
+
+      let result = await gatherFrameSources(tab.id);
+      browser.test.assertEq(String([BASE_HOST]), result,
+                            "Script is not injected into dynamically created frames");
+
+      await browser.tabs.remove(tab.id);
+
+      browser.test.notifyPass("dynamic-frames");
+    });
+
+    browser.test.sendMessage("ready", tab.id);
+  });
+
+  await extension.startup();
+
+  let tabId = await extension.awaitMessage("ready");
+  extension.grantActiveTab(tabId);
+
+  extension.sendMessage("go");
+  await extension.awaitFinish("dynamic-frames");
+
+  await extension.unload();
+});
+
+// Test that an iframe created from an <iframe srcdoc> gets the
+// activeTab permission.
+add_task(async function test_srcdoc() {
+  let extension = makeExtension(async function background() {
+    const URL = "http://mochi.test:8888/tests/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab2.html";
+    const OUTER_SOURCE = "about:srcdoc";
+    const PAGE_SOURCE = "mochi.test";
+    const FRAME_SOURCE = "test1.example.com";
+
+    let [tab] = await Promise.all([
+      browser.tabs.create({url: URL}),
+      awaitLoad({frameId: 0}),
+    ]);
+
+    browser.test.onMessage.addListener(async msg => {
+      if (msg == "go") {
+        let result = await gatherFrameSources(tab.id);
+        browser.test.assertEq(String([OUTER_SOURCE, PAGE_SOURCE, FRAME_SOURCE]),
+                              result,
+                              "Script is injected into frame created from <iframe srcdoc>");
+
+        await browser.tabs.remove(tab.id);
+
+        browser.test.notifyPass("srcdoc");
+      }
+    });
+
+    browser.test.sendMessage("ready", tab.id);
+  });
+
+  await extension.startup();
+
+  let tabId = await extension.awaitMessage("ready");
+  extension.grantActiveTab(tabId);
+
+  extension.sendMessage("go");
+  await extension.awaitFinish("srcdoc");
+
+  await extension.unload();
+});
+
+// Test that navigating frames by setting the src attribute from the
+// parent page revokes the activeTab permission.
+add_task(async function test_navigate_by_src() {
+  let extension = makeExtension(async function background() {
+    const URL = "http://mochi.test:8888/tests/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab.html";
+    const PAGE_SOURCE = "mochi.test";
+    const EMPTY_SOURCE = "about:blank";
+    const FRAME_SOURCE = "test1.example.com";
+
+    let [tab] = await Promise.all([
+      browser.tabs.create({url: URL}),
+      awaitLoad({frameId: 0}),
+    ]);
+
+    browser.test.onMessage.addListener(async msg => {
+      if (msg == "go") {
+        let result = await gatherFrameSources(tab.id);
+        browser.test.assertEq(String([EMPTY_SOURCE, PAGE_SOURCE, FRAME_SOURCE]),
+                              result,
+                              "In original page, script is injected into base page and original frames");
+
+        let loadedPromise = awaitLoad({tabId: tab.id});
+        await browser.tabs.executeScript(tab.id, {
+          code: "document.getElementById('emptyframe').src = 'http://test2.example.com/';",
+        });
+        await loadedPromise;
+
+        result = await gatherFrameSources(tab.id);
+        browser.test.assertEq(String([PAGE_SOURCE, FRAME_SOURCE]), result,
+                              "Script is not injected into initially empty frame after navigation");
+
+        loadedPromise = awaitLoad({tabId: tab.id});
+        await browser.tabs.executeScript(tab.id, {
+          code: "document.getElementById('regularframe').src = 'http://test2.example.com/';",
+        });
+        await loadedPromise;
+
+        result = await gatherFrameSources(tab.id);
+        browser.test.assertEq(String([PAGE_SOURCE]), result,
+                              "Script is not injected into regular frame after navigation");
+
+        await browser.tabs.remove(tab.id);
+        browser.test.notifyPass("test-scripts");
+      }
+    });
+
+    browser.test.sendMessage("ready", tab.id);
+  });
+
+  await extension.startup();
+
+  let tabId = await extension.awaitMessage("ready");
+  extension.grantActiveTab(tabId);
+
+  extension.sendMessage("go");
+  await extension.awaitFinish("test-scripts");
+
+  await extension.unload();
+});
+
+// Test that navigating frames by setting window.location from inside the
+// frame revokes the activeTab permission.
+add_task(async function test_navigate_by_window_location() {
+  let extension = makeExtension(async function background() {
+    const URL = "http://mochi.test:8888/tests/toolkit/components/extensions/test/mochitest/file_contentscript_activeTab.html";
+    const PAGE_SOURCE = "mochi.test";
+    const EMPTY_SOURCE = "about:blank";
+    const FRAME_SOURCE = "test1.example.com";
+
+    let [tab] = await Promise.all([
+      browser.tabs.create({url: URL}),
+      awaitLoad({frameId: 0}),
+    ]);
+
+    browser.test.onMessage.addListener(async msg => {
+      if (msg == "go") {
+        let result = await gatherFrameSources(tab.id);
+        browser.test.assertEq(String([EMPTY_SOURCE, PAGE_SOURCE, FRAME_SOURCE]),
+                              result,
+                              "Script initially injected into all frames");
+
+        let nframes = 0;
+        let frames = await browser.webNavigation.getAllFrames({tabId: tab.id});
+        for (let frame of frames) {
+          if (frame.parentFrameId == -1) {
+            continue;
+          }
+
+          let loadPromise = awaitLoad({
+            tabId: tab.id,
+            frameId: frame.frameId,
+          });
+
+          await browser.tabs.executeScript(tab.id, {
+            frameId: frame.frameId,
+            matchAboutBlank: true,
+            code: "window.location.href = 'https://test2.example.com/';",
+          });
+          await loadPromise;
+
+          try {
+            result = await browser.tabs.executeScript(tab.id, {
+              frameId: frame.frameId,
+              matchAboutBlank: true,
+              code: "window.location.hostname;",
+            });
+
+            browser.test.fail("executeScript should have failed on navigated frame");
+          } catch (err) {
+            browser.test.assertEq("Frame not found, or missing host permission", err.message);
+          }
+
+          nframes++;
+        }
+        browser.test.assertEq(2, nframes, "Found 2 frames");
+
+        await browser.tabs.remove(tab.id);
+        browser.test.notifyPass("scripted-navigation");
+      }
+    });
+
+    browser.test.sendMessage("ready", tab.id);
+  });
+
+  await extension.startup();
+
+  let tabId = await extension.awaitMessage("ready");
+  extension.grantActiveTab(tabId);
+
+  extension.sendMessage("go");
+  await extension.awaitFinish("scripted-navigation");
+
+  await extension.unload();
+});
+
+</script>
+
+</body>
+</html>