Bug 1429590 - Only allow one homepage to be set by extensions r=aswan
authorMark Striemer <mstriemer@mozilla.com>
Wed, 31 Jan 2018 20:21:32 -0600
changeset 403565 1a8f7940e10800387d3de28e3538ac4004c7bc14
parent 403564 b0deb6af3dfb09da428c5dae40d67a486b8acf0b
child 403566 43679b41bece563cc07b032b325b274bcbe2b229
push id33438
push userrgurzau@mozilla.com
push dateWed, 14 Feb 2018 10:46:56 +0000
treeherdermozilla-central@c48e46d5edbf [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersaswan
bugs1429590
milestone60.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1429590 - Only allow one homepage to be set by extensions r=aswan MozReview-Commit-ID: 8DTj8ceWAr8
browser/components/extensions/schemas/chrome_settings_overrides.json
browser/components/extensions/test/browser/browser_ext_chrome_settings_overrides_home.js
toolkit/components/extensions/Schemas.jsm
--- a/browser/components/extensions/schemas/chrome_settings_overrides.json
+++ b/browser/components/extensions/schemas/chrome_settings_overrides.json
@@ -7,17 +7,17 @@
         "properties": {
           "chrome_settings_overrides": {
             "type": "object",
             "optional": true,
             "additionalProperties": { "$ref": "UnrecognizedProperty" },
             "properties": {
               "homepage": {
                 "type": "string",
-                "format": "relativeUrl",
+                "format": "homepageUrl",
                 "optional": true,
                 "preprocess": "localize"
               },
              "search_provider": {
                 "type": "object",
                 "optional": true,
                 "additionalProperties": { "$ref": "UnrecognizedProperty" },
                 "properties": {
--- a/browser/components/extensions/test/browser/browser_ext_chrome_settings_overrides_home.js
+++ b/browser/components/extensions/test/browser/browser_ext_chrome_settings_overrides_home.js
@@ -264,8 +264,29 @@ add_task(async function test_local() {
   await prefPromise;
 
   let homepage = getHomePageURL();
   ok((homepage.startsWith("moz-extension") && homepage.endsWith("home.html")),
      "Home url should be relative to extension.");
 
   await ext1.unload();
 });
+
+add_task(async function test_multiple() {
+  let extension = ExtensionTestUtils.loadExtension({
+    manifest: {
+      chrome_settings_overrides: {
+        homepage: "https://mozilla.org/|https://developer.mozilla.org/|https://addons.mozilla.org/",
+      },
+    },
+    useAddonManager: "temporary",
+  });
+
+  let prefPromise = promisePrefChangeObserved(HOMEPAGE_URL_PREF);
+  await extension.startup();
+  await prefPromise;
+
+  is(getHomePageURL(),
+     "https://mozilla.org/%7Chttps://developer.mozilla.org/%7Chttps://addons.mozilla.org/",
+     "The homepage encodes | so only one homepage is allowed");
+
+  await extension.unload();
+});
--- a/toolkit/components/extensions/Schemas.jsm
+++ b/toolkit/components/extensions/Schemas.jsm
@@ -931,16 +931,24 @@ const FORMATS = {
       } catch (e) {
         return string;
       }
     }
 
     throw new SyntaxError(`String ${JSON.stringify(string)} must be a relative URL`);
   },
 
+  homepageUrl(string, context) {
+    // Pipes are used for separating homepages, but we only allow extensions to
+    // set a single homepage. Encoding any pipes makes it one URL.
+    return FORMATS.relativeUrl(
+      string.replace(new RegExp("\\|", "g"), "%7C"),
+      context);
+  },
+
   imageDataOrStrictRelativeUrl(string, context) {
     // Do not accept a string which resolves as an absolute URL, or any
     // protocol-relative URL, except PNG or JPG data URLs
     if (!string.startsWith("data:image/png;base64,") && !string.startsWith("data:image/jpeg;base64,")) {
       try {
         return FORMATS.strictRelativeUrl(string, context);
       } catch (e) {
         throw new SyntaxError(`String ${JSON.stringify(string)} must be a relative or PNG or JPG data:image URL`);