diff --git a/dom/locales/en-US/chrome/dom/dom.properties b/dom/locales/en-US/chrome/dom/dom.properties index 2117887e4c18e..e7df4a40699e2 100644 --- a/dom/locales/en-US/chrome/dom/dom.properties +++ b/dom/locales/en-US/chrome/dom/dom.properties @@ -212,6 +212,8 @@ ServiceWorkerGraceTimeoutTermination=Terminating ServiceWorker for scope ‘%1$S # LOCALIZATION NOTE (ServiceWorkerNoFetchHandler): Do not translate "Fetch". ServiceWorkerNoFetchHandler=Fetch event handlers must be added during the worker script’s initial evaluation. ExecCommandCutCopyDeniedNotInputDriven=document.execCommand(‘cut’/‘copy’) was denied because it was not called from inside a short running user-generated event handler. +ManifestIdIsInvalid=The id member did not resolve to a valid URL. +ManifestIdNotSameOrigin=The id member must have the same origin as the start_url member. ManifestShouldBeObject=Manifest should be an object. ManifestScopeURLInvalid=The scope URL is invalid. ManifestScopeNotSameOrigin=The scope URL must be same origin as document. diff --git a/dom/manifest/ManifestProcessor.jsm b/dom/manifest/ManifestProcessor.jsm index b551f5c25a700..6830b80b66ac6 100644 --- a/dom/manifest/ManifestProcessor.jsm +++ b/dom/manifest/ManifestProcessor.jsm @@ -124,6 +124,7 @@ var ManifestProcessor = { background_color: processBackgroundColorMember(), }; processedManifest.scope = processScopeMember(); + processedManifest.id = processIdMember(); if (checkConformance) { processedManifest.moz_validation = errors; processedManifest.moz_manifest_url = manifestURL.href; @@ -258,10 +259,10 @@ var ManifestProcessor = { expectedType: "string", trim: false, }; - let result = new URL(docURL).href; + const defaultStartURL = new URL(docURL).href; const value = extractor.extractValue(spec); if (value === undefined || value === "") { - return result; + return defaultStartURL; } let potentialResult; try { @@ -269,17 +270,16 @@ var ManifestProcessor = { } catch (e) { const warn = domBundle.GetStringFromName("ManifestStartURLInvalid"); errors.push({ warn }); - return result; + return defaultStartURL; } if (potentialResult.origin !== docURL.origin) { const warn = domBundle.GetStringFromName( "ManifestStartURLShouldBeSameOrigin" ); errors.push({ warn }); - } else { - result = potentialResult.href; + return defaultStartURL; } - return result; + return potentialResult.href; } function processThemeColorMember() { @@ -314,6 +314,42 @@ var ManifestProcessor = { }; return extractor.extractLanguageValue(spec); } + + function processIdMember() { + // the start_url serves as the fallback, in case the id is not specified + // or in error. A start_url is assured. + const startURL = new URL(processedManifest.start_url); + + const spec = { + objectName: "manifest", + object: rawManifest, + property: "id", + expectedType: "string", + trim: false, + }; + const extractedValue = extractor.extractValue(spec); + + if (typeof extractedValue !== "string" || extractedValue === "") { + return startURL.href; + } + + let appId; + try { + appId = new URL(extractedValue, startURL.origin); + } catch { + const warn = domBundle.GetStringFromName("ManifestIdIsInvalid"); + errors.push({ warn }); + return startURL.href; + } + + if (appId.origin !== startURL.origin) { + const warn = domBundle.GetStringFromName("ManifestIdNotSameOrigin"); + errors.push({ warn }); + return startURL.href; + } + + return appId.href; + } }, }; var EXPORTED_SYMBOLS = ["ManifestProcessor"]; diff --git a/dom/manifest/test/mochitest.ini b/dom/manifest/test/mochitest.ini index c496caed42b80..73d7a6578707f 100644 --- a/dom/manifest/test/mochitest.ini +++ b/dom/manifest/test/mochitest.ini @@ -13,6 +13,7 @@ support-files = [test_ManifestProcessor_dir.html] [test_ManifestProcessor_display.html] [test_ManifestProcessor_icons.html] +[test_ManifestProcessor_id.html] [test_ManifestProcessor_JSON.html] [test_ManifestProcessor_lang.html] [test_ManifestProcessor_name_and_short_name.html] diff --git a/dom/manifest/test/test_ManifestProcessor_id.html b/dom/manifest/test/test_ManifestProcessor_id.html new file mode 100644 index 0000000000000..336d1d3a773bd --- /dev/null +++ b/dom/manifest/test/test_ManifestProcessor_id.html @@ -0,0 +1,123 @@ + + + +
+ +