New issue
Advanced search Search tips

Issue 893723 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug-Regression



Sign in to add a comment

Permission "activeTab" doesn't behave properly

Reported by klich...@gmail.com, Oct 9

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3567.0 Safari/537.36

Steps to reproduce the problem:
1. Create a Chrome Extension with a background page
2. Setup "activeTab" permission in the manifest.
3. Use chrome.tabs.onUpdated inside of background page to track URL changes for the "active tab".
4. Activate extension on a web page.
5. Surf the website using <a> links (navigate) and see that onUpdated is able to read tab.url and tab.title just fine.

What is the expected behavior?
https://developer.chrome.com/extensions/activeTab

We read here "Access to the tab lasts until the tab is navigated or closed."
Shouldn't navigating inside of this tab revoke right to see tab.url and tab.title in onUpdated call?

Chrome 69 does not provide url/title after navigation, 71 - does.

What went wrong?
url/title of tab shouldnt be accessible after navigation inside of tab, having only "activeTab" permissions and no generic "tabs" permission.

Did this work before? Yes 69 (I dont have versions between 69 and 71 handy)

Does this work in other browsers? Yes

Chrome version: 71.0.3567.0  Channel: n/a
OS Version: OS X 10.14.0
Flash Version: 

If this is a fix, please explain the proper behavior. Thanks!
 
Labels: Needs-Bisect Needs-Triage-M71
Cc: vamshi.kommuri@chromium.org
Labels: Triaged-ET Needs-Feedback
Thanks for filing the issue!

@Reporter: Could you please provide a sample test extension file(...satisfying the conditions mentioned in C#0) which helps to triage it further in a better way. Any further inputs from your end may be helpful.
Hey, sure. Below is a sample case that shows the 71/69 chrome difference on particular website.

Setup:
1. Install extension, attached to this comment.
2. Open background page of the extension.
3. Go to https://www.internet-radio.com/

Act:
4. Click button in extension popup "Click me".
5. Click "Blues" button tag (https://www.internet-radio.com/stations/blues/ link).
6. Click "Jazz" button tag (https://www.internet-radio.com/stations/jazz/ link).
7. Click "Country" button tag (https://www.internet-radio.com/stations/country/ link).

Assert:
8. Check output in the background page.

69 chrome:

Started tracking tab updates...
background.js:7 Tab updated: url =  https://www.internet-radio.com/stations/blues/
background.js:7 Tab updated: url =  undefined
background.js:7 Tab updated: url =  undefined

71 chrome:

Started tracking tab updates...
background.js:7 Tab updated: url =  https://www.internet-radio.com/stations/blues/
background.js:7 Tab updated: url =  https://www.internet-radio.com/stations/jazz/
background.js:7 Tab updated: url =  https://www.internet-radio.com/stations/country/

You can clearly see that first URL is printed when tab was navigated and after that behavior is different: 69 chrome does not includes URL into onUpdated event (see code of extension for details).

NOTE: I tried navigating inside of SPA page, where clicking the link did not load page but only changed URL - in that case both DO show urls. So probably url change is not considered navigation to revoke the tab permission.
activetab_extension.zip
1.9 KB Download
Project Member

Comment 4 by sheriffbot@chromium.org, Oct 10

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: Needs-Feedback
Tried checking the issue using the test file "activetab_extension.zip" provided in comment#3 on reported chrome version 71.0.3567.0 and on 69.0.3497.100 using Mac 10.13.1 with the below mentioned steps.
1. Launched Chrome
2. Added the given extension
3. Clicked on "E" Extension icon->"Click me"
4. Opened background page of the extension
5. Navigated to https://www.internet-radio.com/
6. Clicked on "Blues", "Jazz" & "Country" buttons respectively after clicking "Click me" button.
Observed similar behaviour on both reported version 71.0.3567.0  and on 69.0.3497.100(where it is mentioned as working fine). Attaching the screencast of the same for reference.

@Reporter: Could you please have a look at the screencast and let us know if we have missed anything in the process. Any further inputs from your end may be helpful.

Thanks! 
893723.mp4
5.6 MB View Download
Labels: -Hotlist-Interop
Components: Platform>Extensions
Aha, I would like to point out that I was *not* clicking the extension button each time before  I navigate, but only once, just like in my steps described. So, from my understanding, when I click "Click me", "activeTab" grants "tabs" permission to extension to access tab from this current page. After navigating, extension shouldn't be having that permission to the new, navigated page, anymore, should it?

In order to replicate my flow, please try to:
...
3. Go to https://www.internet-radio.com/
4. Click button in extension popup "Click me".
...
And from here navigate to the mentioned links.
Project Member

Comment 9 by sheriffbot@chromium.org, Oct 11

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Might be a good idea to reload extension beforehand for a clean experiment.
Labels: -Needs-Bisect Needs-Feedback
Tried testing the issue as per comment#8 and comment#10 by clicking popup "Click me" only once and by reloading the extension, on reported chrome version 71.0.3567.0 and version 69.0.3497.100 using Mac 10.13.1

Our Observations:
------------------
In Chrome 69.0.3497.100 we have seen
Tab updated: url =  https://www.internet-radio.com/stations/blues/
then was seen upon clicking Jazz/Country
Tab updated: url =  undefined
Tab updated: url =  undefined

Similar results are seen in Chrome 71.0.3567.0 too
Tab updated: url =  https://www.internet-radio.com/stations/blues/
then was seen upon clicking Jazz/Country
Tab updated: url =  undefined
Tab updated: url =  undefined

Attaching the screen casts of both the versions for reference. And removing Needs-Bisect label as we couldn't find any difference in both the mentioned versions and requesting someone from the respective team to have a look into this.

@Reporter: Could you please have a look at the screen casts attached and let us know if anything missed from our end.

Thanks!
893723 M69.mp4
4.0 MB View Download
893723 M71.mp4
2.8 MB View Download
Components: -Blink>SecurityFeature
Cc: rdevlin....@chromium.org
Status: Untriaged (was: Unconfirmed)
Mac triage: marking for Extensions triage and +cc rdevlin.cronin@ - is this a bug or design behavior?
Cc: -rdevlin....@chromium.org
Owner: rdevlin....@chromium.org
Status: Assigned (was: Untriaged)
We did introduce a behavior change recently to not revoke the activeTab access for same-origin navigations. But that's supposed to be there in M72. Quoting from the documentation:

"Note: From M72 onwards, the activeTab permission will be granted until the user navigates to a different origin. That is, if the user invokes the extension on https://example.com and then navigates to https://example.com/foo, the extension will continue to have access to the page. If the user navigates to https://chromium.org, access is revoked."

So I am not sure why you see this behavior in M71.

Assigning to Devlin who introduced the change.

Sign in to add a comment