Content scripts access to getCoalescedEvents #31638

rebloor · 2024-01-10T15:37:04Z

Description

This change includes:

Firefox 120 release note to cover Bug 1858434 Expose getCoalescedEvents only on SecureContext
Firefox 123 release note to cover Bug 1870498 Extensions content scripts do not have access to Secure Context APIs in HTTP sites like getCoalescedEvents
note on the context scripts page about the all-contexts exception for getCoalescedEvents
note on the getCoalescedEvents page about the all-contexts exceptions for content scripts

rebloor · 2024-01-10T15:37:41Z

FYI @gregorypappas

github-actions · 2024-01-10T15:38:32Z

Preview URLs

External URLs (3)

URL: /en-US/docs/Mozilla/Firefox/Releases/120
Title: Firefox 120 for developers

https://bugzil.la/1858434 (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Mozilla/Firefox/Releases/123
Title: Firefox 123 for developers

https://bugzil.la/1858434 (1 time) (Note! This may be a new URL 👀)
https://bugzil.la/1870498 (1 time) (Note! This may be a new URL 👀)

rebloor · 2024-01-10T15:39:05Z

files/en-us/mozilla/firefox/releases/123/index.md

@@ -57,6 +57,7 @@ This article provides information about the changes in Firefox 123 that affect d
 ## Changes for add-on developers

 - Addition of fhe {{WebExtAPIRef("contextualIdentities.move")}} function enables items to be moved in the list of contextual identities. This function enables extensions to customize the order in which contextual identities display in the UI ([Firefox bug 1333395](https://bugzil.la/1333395)).
+- The {{domxref("PointerEvent.getCoalescedEvents()")}} method (which was restricted to use in secure contexts only in Firefox 120 ([Firefox bug 1858434](https://bugzil.la/1858434))) is now available for use by extensions in all contexts [Firefox bug 1870498](https://bugzil.la/1870498)).


Or should this be under Firefox 120 for Bug 1859236?

123 is not the right place.

This was a temporary regression in 120 Nightly, there has not been any change on 120 beta or release.

I think that it would be nice to call out that the restriction does not apply to extensions... Maybe under "Changes for add-on developers"?

- Although the {{domxref("PointerEvent.getCoalescedEvents()")}} has been restricted to Secure Contexts only, content scripts can continue to use this method even in documents that are not a secure context ([Firefox bug 1870498](https://bugzil.la/1870498)).

(and if we have a section in our documentation for this, maybe link to that article)

rebloor · 2024-01-10T15:39:35Z

files/en-us/web/api/pointerevent/getcoalescedevents/index.md

-{{APIRef("Pointer Events")}} {{secureContext_header}}
+{{APIRef("Pointer Events")}}
+
+<div class='notecard secure'><h4>Secure context</h4><p> In web page scripts, this feature is available only in <a href='/en-US/docs/Web/Security/Secure_Contexts'>secure contexts</a> (HTTPS) in some or all <a href='#browser_compatibility'>supporting browsers</a>. In Firefox, when called from a web extension content script, this feature is available in all contexts.</p></div>


Is there a better way of handling this?

I think that we should have a dedicated section about Secure Contexts in content scripts, and cross-link that from https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts

It doesn't feel entirely right to offer a notable mention of the behavior in extension-specific code here. I'd like more input from other MDN curators/peers here.

Rob--W · 2024-01-12T00:08:21Z

files/en-us/mozilla/add-ons/webextensions/content_scripts/index.md

-Just like the scripts loaded by normal web pages, content scripts can read and modify the content of their pages using the standard DOM APIs. However, they can only do this when [host permissions to the web page's origin have been granted](#permissions).
+Just like the scripts loaded by normal web pages, content scripts can read and modify the content of their pages using the standard [Web APIs](/en-US/docs/Web/API). However, they can only do this when [host permissions to the web page's origin have been granted](#permissions).
+
+> **Note:** The restriction on using specific Web API in [secure contexts](/en-US/docs/Web/Security/Secure_Contexts) only applies to their use in extensions, except that {{domxref("PointerEvent.getCoalescedEvents()")}} can be used from content scripts in all contexts.


What are you trying to express here?

The rule expressed in the paragraph before is a good baseline. For ease of comprehension, I suggest to leave the message simple (content scripts can access any Web APIs available to the web page. And maybe have a section elsewhere on this page describing the difference compared to the usual expectations. Then we can use that section to explain special differences... Maybe under "Content script environment"?

Rob--W · 2024-01-12T00:13:06Z

files/en-us/mozilla/firefox/releases/123/index.md

@@ -57,6 +57,7 @@ This article provides information about the changes in Firefox 123 that affect d
 ## Changes for add-on developers

 - Addition of fhe {{WebExtAPIRef("contextualIdentities.move")}} function enables items to be moved in the list of contextual identities. This function enables extensions to customize the order in which contextual identities display in the UI ([Firefox bug 1333395](https://bugzil.la/1333395)).
+- The {{domxref("PointerEvent.getCoalescedEvents()")}} method (which was restricted to use in secure contexts only in Firefox 120 ([Firefox bug 1858434](https://bugzil.la/1858434))) is now available for use by extensions in all contexts [Firefox bug 1870498](https://bugzil.la/1870498)).


123 is not the right place.

This was a temporary regression in 120 Nightly, there has not been any change on 120 beta or release.

I think that it would be nice to call out that the restriction does not apply to extensions... Maybe under "Changes for add-on developers"?

- Although the {{domxref("PointerEvent.getCoalescedEvents()")}} has been restricted to Secure Contexts only, content scripts can continue to use this method even in documents that are not a secure context ([Firefox bug 1870498](https://bugzil.la/1870498)).

(and if we have a section in our documentation for this, maybe link to that article)

Rob--W · 2024-01-12T00:18:54Z

files/en-us/web/api/pointerevent/getcoalescedevents/index.md

-{{APIRef("Pointer Events")}} {{secureContext_header}}
+{{APIRef("Pointer Events")}}
+
+<div class='notecard secure'><h4>Secure context</h4><p> In web page scripts, this feature is available only in <a href='/en-US/docs/Web/Security/Secure_Contexts'>secure contexts</a> (HTTPS) in some or all <a href='#browser_compatibility'>supporting browsers</a>. In Firefox, when called from a web extension content script, this feature is available in all contexts.</p></div>


I think that we should have a dedicated section about Secure Contexts in content scripts, and cross-link that from https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts

It doesn't feel entirely right to offer a notable mention of the behavior in extension-specific code here. I'd like more input from other MDN curators/peers here.

rebloor · 2024-01-12T02:04:43Z

@Rob--W can I confirm my understanding:

in Firefox 120 the Web API getCoalescedEvents() was changed so it only worked in secure contexts (bug 1858434). In the same release bug 1859236, remove this restriction from the method when run from a content script (to retain the status quo from a web extension perspective). Neither change has (prior to PR) been noted in release notes
we need a way to document the exception for the execution of getCoalescedEvents() from content scripts (and as you suggest, it probably makes more sense to put this under the execution environment than the place I've chosen and then to link to the execution environment section from the secure context pages see also list).

If this is correct where does Bug 1870498, the one that kicked this all off, come in?

github-actions · 2024-03-06T11:54:39Z

This pull request has merge conflicts that must be resolved before it can be merged.

Content scripts access to getCoalescedEvents

3ee514f

rebloor added the Content:WebExt WebExtensions docs label Jan 10, 2024

rebloor requested a review from Rob--W January 10, 2024 15:37

rebloor self-assigned this Jan 10, 2024

rebloor requested review from a team as code owners January 10, 2024 15:37

rebloor requested review from Elchi3 and removed request for a team January 10, 2024 15:37

github-actions bot added Content:WebAPI Web API docs Content:Firefox Content in the Mozilla/Firefox subtree labels Jan 10, 2024

rebloor commented Jan 10, 2024

View reviewed changes

Rob--W reviewed Jan 12, 2024

View reviewed changes

github-actions bot added the merge conflicts �� [PR only] label Mar 6, 2024

Elchi3 removed their request for review July 17, 2024 10:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Content scripts access to getCoalescedEvents #31638

Content scripts access to getCoalescedEvents #31638

rebloor commented Jan 10, 2024

rebloor commented Jan 10, 2024

github-actions bot commented Jan 10, 2024

rebloor Jan 10, 2024

Rob--W Jan 12, 2024

rebloor Jan 10, 2024

Rob--W Jan 12, 2024

Rob--W Jan 12, 2024

Rob--W Jan 12, 2024

Rob--W Jan 12, 2024

rebloor commented Jan 12, 2024

github-actions bot commented Mar 6, 2024

Content scripts access to getCoalescedEvents #31638

Are you sure you want to change the base?

Content scripts access to getCoalescedEvents #31638

Conversation

rebloor commented Jan 10, 2024

Description

rebloor commented Jan 10, 2024

github-actions bot commented Jan 10, 2024

rebloor Jan 10, 2024

Choose a reason for hiding this comment

Rob--W Jan 12, 2024

Choose a reason for hiding this comment

rebloor Jan 10, 2024

Choose a reason for hiding this comment

Rob--W Jan 12, 2024

Choose a reason for hiding this comment

Rob--W Jan 12, 2024

Choose a reason for hiding this comment

Rob--W Jan 12, 2024

Choose a reason for hiding this comment

Rob--W Jan 12, 2024

Choose a reason for hiding this comment

rebloor commented Jan 12, 2024

github-actions bot commented Mar 6, 2024