mozilla-mobile/fenix

[Bug] Extensions declaring the nativeMessaging permission fail to install

Closed this issue · 18 comments

dessant commented

Steps to reproduce

Add LastPass Password Manager to a collection and try to install it by following this guide.

Expected behavior

The nativeMessaging permission is ignored and the extension is successfully installed.

Actual behavior

An error message shows up: Failed to install LastPass Password Manager.

Device information

  • Fenix version: 201013 17:00

Notes

Fennec ignores the nativeMessaging permission and the extension is successfully installed.

┆Issue is synchronized with this Jira Task

stale commented

See: #17373 This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

  • 👎2
  • 😕1
dessant commented

The issue is still relevant.

  • 👍1
stale commented

See: #17373 This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

  • 👎1
  • 😕1
4-FLOSS-Free-Libre-Open-Source-Software commented

The issue is still relevant.

Rob--W commented

This is a regression caused by mozilla-mobile/android-components#6052 in an attempt to resolve mozilla-mobile/android-components#6015. That patch rejects add-ons with the "nativeMessaging" permission: https://github.com/mozilla-mobile/android-components/blob/96ae23b628816faeabeee8c91340ae7601743ec1/components/feature/addons/src/main/java/mozilla/components/feature/addons/AddonManager.kt#L359

In my opinion (as a Firefox engineer working on the WebExtension framework in Firefox), the restriction is unnecessary; although "nativeMessaging" has been re-purposed for internal purposes, it is only available with the geckoViewAddons permission, and fails otherwise: https://searchfox.org/mozilla-central/rev/a12c2c2e59c92d8f969d8f3f290ab16919449c9d/toolkit/components/extensions/ExtensionParent.jsm#278-288

To fix this issue, PR mozilla-mobile/android-components#6015 needs to be partially undone, by removing "nativeMessaging". Patches are welcome, I suppose.

EDIT: Fix issue links to point to android-components repo instead of this one.

  • 👍1
agi commented

I don't think we should fix this in the front-end. If Gecko finds a permission that we don't recognize, we ignore it, we don't send it straight to the embedder. In this case the same thing should happen, the permission is ignored if geckoviewAddons is not present (and I think it should also ignored if the addon is not built-in) so the front-end should never get the request for nativeMessaging to begin with. Otherwise they would have to know to not ask the user for permission for nativeMessaging when geckoviewAddons is not present which I think is not the right place to handle that.

@Rob--W do you think that would be possible? I guess worst case scenario we can filter the permission request in GeckoView right before it gets to AC.

Rob--W commented

@Rob--W do you think that would be possible? I guess worst case scenario we can filter the permission request in GeckoView right before it gets to AC.

I've implemented that in https://bugzilla.mozilla.org/show_bug.cgi?id=1739746.
Now there should no longer be an objection against rejecting add-ons with the nativeMessaging permission in A-C/Fenix.

  • 👍1
  • 🎉2
Alexandru2909 commented

cc @Amejia481 for more experienced input on this issue.

Amejia481 commented

It looks like the issue was addressed on Gecko some time ago, @dessant is the issue fixed for you ?

Rob--W commented

The gecko part was a blocker to this bug, but the actual change to fix this bug needs to be made in android-components.

As mentioned in a previous comment, mozilla-mobile/android-components#6052 needs to partially be reverted:

Such a change would be trivial to make.

  • 👍1
Amejia481 commented

Thanks for the clarification!

agi commented

This bug has been fixed in Gecko, see https://bugzilla.mozilla.org/show_bug.cgi?id=1759601#c3 and later. I'm resolving this, if anybody can reproduce this please reopen this issue or open a new one.

  • 👍1
dessant commented

@agi, I've just tested and both Buster and LastPass fails to install on the latest Nightly, could you reopen the issue?

  • 👍1
Rob--W commented

@agi, I've just tested and both Buster and LastPass fails to install on the latest Nightly, could you reopen the issue?

Could you open a new bug report and share the full reproduction steps, to trigger the issue in a new profile?

dessant commented

@Rob--W, the reproduction steps have remained the same: #15904 (comment)

  • 👍1
dessant commented

@thekiefs, this issue is about extensions with the nativeMessaging permission failing to install on Android, those extensions do not have such permission. You could try asking for help here: https://support.mozilla.org/en-US/questions/new/desktop/form