Issue metadata
Sign in to add a comment
|
Permission "activeTab" doesn't behave properly
Reported by
klich...@gmail.com,
Oct 9
|
||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3567.0 Safari/537.36 Steps to reproduce the problem: 1. Create a Chrome Extension with a background page 2. Setup "activeTab" permission in the manifest. 3. Use chrome.tabs.onUpdated inside of background page to track URL changes for the "active tab". 4. Activate extension on a web page. 5. Surf the website using <a> links (navigate) and see that onUpdated is able to read tab.url and tab.title just fine. What is the expected behavior? https://developer.chrome.com/extensions/activeTab We read here "Access to the tab lasts until the tab is navigated or closed." Shouldn't navigating inside of this tab revoke right to see tab.url and tab.title in onUpdated call? Chrome 69 does not provide url/title after navigation, 71 - does. What went wrong? url/title of tab shouldnt be accessible after navigation inside of tab, having only "activeTab" permissions and no generic "tabs" permission. Did this work before? Yes 69 (I dont have versions between 69 and 71 handy) Does this work in other browsers? Yes Chrome version: 71.0.3567.0 Channel: n/a OS Version: OS X 10.14.0 Flash Version: If this is a fix, please explain the proper behavior. Thanks!
,
Oct 10
Thanks for filing the issue! @Reporter: Could you please provide a sample test extension file(...satisfying the conditions mentioned in C#0) which helps to triage it further in a better way. Any further inputs from your end may be helpful.
,
Oct 10
Hey, sure. Below is a sample case that shows the 71/69 chrome difference on particular website. Setup: 1. Install extension, attached to this comment. 2. Open background page of the extension. 3. Go to https://www.internet-radio.com/ Act: 4. Click button in extension popup "Click me". 5. Click "Blues" button tag (https://www.internet-radio.com/stations/blues/ link). 6. Click "Jazz" button tag (https://www.internet-radio.com/stations/jazz/ link). 7. Click "Country" button tag (https://www.internet-radio.com/stations/country/ link). Assert: 8. Check output in the background page. 69 chrome: Started tracking tab updates... background.js:7 Tab updated: url = https://www.internet-radio.com/stations/blues/ background.js:7 Tab updated: url = undefined background.js:7 Tab updated: url = undefined 71 chrome: Started tracking tab updates... background.js:7 Tab updated: url = https://www.internet-radio.com/stations/blues/ background.js:7 Tab updated: url = https://www.internet-radio.com/stations/jazz/ background.js:7 Tab updated: url = https://www.internet-radio.com/stations/country/ You can clearly see that first URL is printed when tab was navigated and after that behavior is different: 69 chrome does not includes URL into onUpdated event (see code of extension for details). NOTE: I tried navigating inside of SPA page, where clicking the link did not load page but only changed URL - in that case both DO show urls. So probably url change is not considered navigation to revoke the tab permission.
,
Oct 10
Thank you for providing more feedback. Adding the requester to the cc list. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 11
Tried checking the issue using the test file "activetab_extension.zip" provided in comment#3 on reported chrome version 71.0.3567.0 and on 69.0.3497.100 using Mac 10.13.1 with the below mentioned steps. 1. Launched Chrome 2. Added the given extension 3. Clicked on "E" Extension icon->"Click me" 4. Opened background page of the extension 5. Navigated to https://www.internet-radio.com/ 6. Clicked on "Blues", "Jazz" & "Country" buttons respectively after clicking "Click me" button. Observed similar behaviour on both reported version 71.0.3567.0 and on 69.0.3497.100(where it is mentioned as working fine). Attaching the screencast of the same for reference. @Reporter: Could you please have a look at the screencast and let us know if we have missed anything in the process. Any further inputs from your end may be helpful. Thanks!
,
Oct 11
,
Oct 11
,
Oct 11
Aha, I would like to point out that I was *not* clicking the extension button each time before I navigate, but only once, just like in my steps described. So, from my understanding, when I click "Click me", "activeTab" grants "tabs" permission to extension to access tab from this current page. After navigating, extension shouldn't be having that permission to the new, navigated page, anymore, should it? In order to replicate my flow, please try to: ... 3. Go to https://www.internet-radio.com/ 4. Click button in extension popup "Click me". ... And from here navigate to the mentioned links.
,
Oct 11
Thank you for providing more feedback. Adding the requester to the cc list. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 11
Might be a good idea to reload extension beforehand for a clean experiment.
,
Oct 12
Tried testing the issue as per comment#8 and comment#10 by clicking popup "Click me" only once and by reloading the extension, on reported chrome version 71.0.3567.0 and version 69.0.3497.100 using Mac 10.13.1 Our Observations: ------------------ In Chrome 69.0.3497.100 we have seen Tab updated: url = https://www.internet-radio.com/stations/blues/ then was seen upon clicking Jazz/Country Tab updated: url = undefined Tab updated: url = undefined Similar results are seen in Chrome 71.0.3567.0 too Tab updated: url = https://www.internet-radio.com/stations/blues/ then was seen upon clicking Jazz/Country Tab updated: url = undefined Tab updated: url = undefined Attaching the screen casts of both the versions for reference. And removing Needs-Bisect label as we couldn't find any difference in both the mentioned versions and requesting someone from the respective team to have a look into this. @Reporter: Could you please have a look at the screen casts attached and let us know if anything missed from our end. Thanks!
,
Oct 12
,
Nov 12
Mac triage: marking for Extensions triage and +cc rdevlin.cronin@ - is this a bug or design behavior?
,
Nov 16
We did introduce a behavior change recently to not revoke the activeTab access for same-origin navigations. But that's supposed to be there in M72. Quoting from the documentation: "Note: From M72 onwards, the activeTab permission will be granted until the user navigates to a different origin. That is, if the user invokes the extension on https://example.com and then navigates to https://example.com/foo, the extension will continue to have access to the page. If the user navigates to https://chromium.org, access is revoked." So I am not sure why you see this behavior in M71. Assigning to Devlin who introduced the change. |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by swarnasree.mukkala@chromium.org
, Oct 10