Will adding 'match_about_blank: true' to a content script trigger a permission warning?

198 views
Skip to first unread message

David Harbage

unread,
Aug 27, 2018, 3:51:28 PM8/27/18
to Chromium-Extensions-Announce
I work on a chrome extension that injects content scripts into all frames on all webpages. I'd like to extend this functionality by adding "match_about_blank": true to the content script permissions in the manifest file. In the chrome extension docs, it says that updating an extension with additional permissions may temporarily disable it. My question is, will adding the match_about_blank attribute to a content script trigger this permission warning?

Decklin / Deco

unread,
Aug 28, 2018, 2:34:22 PM8/28/18
to David Harbage, Chromium-Extensions-Announce
Yes, it will.

On Mon, Aug 27, 2018 at 8:51 PM David Harbage <david....@gmail.com> wrote:
I work on a chrome extension that injects content scripts into all frames on all webpages. I'd like to extend this functionality by adding "match_about_blank": true to the content script permissions in the manifest file. In the chrome extension docs, it says that updating an extension with additional permissions may temporarily disable it. My question is, will adding the match_about_blank attribute to a content script trigger this permission warning?

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To post to this group, send email to chromium-...@chromium.org.
Visit this group at https://groups.google.com/a/chromium.org/group/chromium-extensions/.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/5080aeb9-1f30-4cce-bd0d-e7e708179c0f%40chromium.org.
For more options, visit https://groups.google.com/a/chromium.org/d/optout.

David Harbage

unread,
Aug 28, 2018, 3:11:37 PM8/28/18
to Chromium-Extensions-Announce, david....@gmail.com
Are you sure of this? Can you expand on your answer a little more or point me in the direction of an explanation? I was under the impression that it wouldn't, since it doesn't change which sites are affected. I should add that the extension already has the "<all_urls>" and "activeTab" permissions, and this is just a key being added to an individual content script:

On Tuesday, August 28, 2018 at 2:34:22 PM UTC-4, Decklin / Deco wrote:
Yes, it will.

On Mon, Aug 27, 2018 at 8:51 PM David Harbage <david....@gmail.com> wrote:
I work on a chrome extension that injects content scripts into all frames on all webpages. I'd like to extend this functionality by adding "match_about_blank": true to the content script permissions in the manifest file. In the chrome extension docs, it says that updating an extension with additional permissions may temporarily disable it. My question is, will adding the match_about_blank attribute to a content script trigger this permission warning?

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extensions+unsub...@chromium.org.

Decklin / Deco

unread,
Aug 29, 2018, 11:45:29 AM8/29/18
to David Harbage, Chromium-Extensions-Announce
All permission changes temporarily disable the extension until the user is prompted to accept the (new one). Even value changes.

On Tue, 28 Aug 2018, 20:11 David Harbage, <david....@gmail.com> wrote:
Are you sure of this? Can you expand on your answer a little more or point me in the direction of an explanation? I was under the impression that it wouldn't, since it doesn't change which sites are affected. I should add that the extension already has the "<all_urls>" and "activeTab" permissions, and this is just a key being added to an individual content script:

Auto Generated Inline Image 1
On Tuesday, August 28, 2018 at 2:34:22 PM UTC-4, Decklin / Deco wrote:
Yes, it will.

On Mon, Aug 27, 2018 at 8:51 PM David Harbage <david....@gmail.com> wrote:
I work on a chrome extension that injects content scripts into all frames on all webpages. I'd like to extend this functionality by adding "match_about_blank": true to the content script permissions in the manifest file. In the chrome extension docs, it says that updating an extension with additional permissions may temporarily disable it. My question is, will adding the match_about_blank attribute to a content script trigger this permission warning?

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.

Devlin Cronin

unread,
Aug 29, 2018, 12:23:06 PM8/29/18
to Chromium-Extensions-Announce, david....@gmail.com
This isn't quite true - only permission changes that trigger a change in the permission warnings a user sees will disable an extension.  Chrome's permission warnings system is complex (because certain permissions "consume" other permissions - e.g., the `history` permission consumes the `tabs` permission), and so this isn't as simple.  Some permissions are warning-less (e.g., `storage`), and could be added without disabling the extension.  Others won't generate an additional warning with the other permissions that are present.

The easiest way to test this is to load one version of the extension, look at the permission warnings, and then load the second version of the extension, and look at the permission warnings.  This process is somewhat described here: https://developer.chrome.com/extensions/permission_warnings#view_warnings.  If there is a change due to the permission added, then it is likely the extension will be disabled.  Note: rarely, but occasionally, there are differences between Chrome versions, so we'd recommend trying on all current Chrome channels.

In this particular case, adding "match_about_blank" to a content script - if that's *all* that changes - should not disable the extension, since it doesn't grant the extension any increased permission.  If other values change (e.g., the content script's "matches" values, other manifest keys, or the "permissions" list), then there is a chance the extension will be disabled.

Cheers,
- Devlin


On Wednesday, August 29, 2018 at 8:45:29 AM UTC-7, Decklin / Deco wrote:
All permission changes temporarily disable the extension until the user is prompted to accept the (new one). Even value changes.

On Tue, 28 Aug 2018, 20:11 David Harbage, <david....@gmail.com> wrote:
Are you sure of this? Can you expand on your answer a little more or point me in the direction of an explanation? I was under the impression that it wouldn't, since it doesn't change which sites are affected. I should add that the extension already has the "<all_urls>" and "activeTab" permissions, and this is just a key being added to an individual content script:

Auto Generated Inline Image 1
On Tuesday, August 28, 2018 at 2:34:22 PM UTC-4, Decklin / Deco wrote:
Yes, it will.

On Mon, Aug 27, 2018 at 8:51 PM David Harbage <david....@gmail.com> wrote:
I work on a chrome extension that injects content scripts into all frames on all webpages. I'd like to extend this functionality by adding "match_about_blank": true to the content script permissions in the manifest file. In the chrome extension docs, it says that updating an extension with additional permissions may temporarily disable it. My question is, will adding the match_about_blank attribute to a content script trigger this permission warning?

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extensions+unsub...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extensions+unsub...@chromium.org.
To post to this group, send email to chromium-extensions@chromium.org.

David Harbage

unread,
Aug 30, 2018, 2:21:38 PM8/30/18
to Chromium-Extensions-Announce, david....@gmail.com
Thanks you for taking the time to write this explanation Devlin. I can't tell you how much I appreciate it.

PhistucK

unread,
Aug 30, 2018, 2:45:01 PM8/30/18
to Devlin Cronin, Chromium-extensions, david....@gmail.com
By the way, perhaps there should be a way in Chrome to emulate this in order to see if you get a permission alert?
It is not great to have to publish stuff to the store (or ask here) just to find that out...

PhistucK


On Wed, Aug 29, 2018 at 7:23 PM Devlin Cronin <rdevlin...@chromium.org> wrote:
This isn't quite true - only permission changes that trigger a change in the permission warnings a user sees will disable an extension.  Chrome's permission warnings system is complex (because certain permissions "consume" other permissions - e.g., the `history` permission consumes the `tabs` permission), and so this isn't as simple.  Some permissions are warning-less (e.g., `storage`), and could be added without disabling the extension.  Others won't generate an additional warning with the other permissions that are present.

The easiest way to test this is to load one version of the extension, look at the permission warnings, and then load the second version of the extension, and look at the permission warnings.  This process is somewhat described here: https://developer.chrome.com/extensions/permission_warnings#view_warnings.  If there is a change due to the permission added, then it is likely the extension will be disabled.  Note: rarely, but occasionally, there are differences between Chrome versions, so we'd recommend trying on all current Chrome channels.

In this particular case, adding "match_about_blank" to a content script - if that's *all* that changes - should not disable the extension, since it doesn't grant the extension any increased permission.  If other values change (e.g., the content script's "matches" values, other manifest keys, or the "permissions" list), then there is a chance the extension will be disabled.

Cheers,
- Devlin

On Wednesday, August 29, 2018 at 8:45:29 AM UTC-7, Decklin / Deco wrote:
All permission changes temporarily disable the extension until the user is prompted to accept the (new one). Even value changes.

On Tue, 28 Aug 2018, 20:11 David Harbage, <david....@gmail.com> wrote:
Are you sure of this? Can you expand on your answer a little more or point me in the direction of an explanation? I was under the impression that it wouldn't, since it doesn't change which sites are affected. I should add that the extension already has the "<all_urls>" and "activeTab" permissions, and this is just a key being added to an individual content script:

Auto Generated Inline Image 1
On Tuesday, August 28, 2018 at 2:34:22 PM UTC-4, Decklin / Deco wrote:
Yes, it will.

On Mon, Aug 27, 2018 at 8:51 PM David Harbage <david....@gmail.com> wrote:
I work on a chrome extension that injects content scripts into all frames on all webpages. I'd like to extend this functionality by adding "match_about_blank": true to the content script permissions in the manifest file. In the chrome extension docs, it says that updating an extension with additional permissions may temporarily disable it. My question is, will adding the match_about_blank attribute to a content script trigger this permission warning?

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.

David Harbage

unread,
Aug 30, 2018, 2:53:43 PM8/30/18
to Chromium-Extensions-Announce, rdevlin...@chromium.org, david....@gmail.com
I was actually able to test this locally by following the instructions in the link Devlin shared - https://developer.chrome.com/extensions/permission_warnings#update_permissions. Basically, you pack one version of your extension (prior to whatever permission changes you're making) and install it in chrome. Then you take the updated version of your extension (the one with permission changes), and pack it in chrome again but use the private key that was generated the for the last version of the extension that you packed. This simulates an extension upgrade, and will give you any extension permission warnings that would occur when you push out an update to the extension.


On Thursday, August 30, 2018 at 2:45:01 PM UTC-4, PhistucK wrote:
By the way, perhaps there should be a way in Chrome to emulate this in order to see if you get a permission alert?
It is not great to have to publish stuff to the store (or ask here) just to find that out...

PhistucK


On Wed, Aug 29, 2018 at 7:23 PM Devlin Cronin <rdevlin...@chromium.org> wrote:
This isn't quite true - only permission changes that trigger a change in the permission warnings a user sees will disable an extension.  Chrome's permission warnings system is complex (because certain permissions "consume" other permissions - e.g., the `history` permission consumes the `tabs` permission), and so this isn't as simple.  Some permissions are warning-less (e.g., `storage`), and could be added without disabling the extension.  Others won't generate an additional warning with the other permissions that are present.

The easiest way to test this is to load one version of the extension, look at the permission warnings, and then load the second version of the extension, and look at the permission warnings.  This process is somewhat described here: https://developer.chrome.com/extensions/permission_warnings#view_warnings.  If there is a change due to the permission added, then it is likely the extension will be disabled.  Note: rarely, but occasionally, there are differences between Chrome versions, so we'd recommend trying on all current Chrome channels.

In this particular case, adding "match_about_blank" to a content script - if that's *all* that changes - should not disable the extension, since it doesn't grant the extension any increased permission.  If other values change (e.g., the content script's "matches" values, other manifest keys, or the "permissions" list), then there is a chance the extension will be disabled.

Cheers,
- Devlin

On Wednesday, August 29, 2018 at 8:45:29 AM UTC-7, Decklin / Deco wrote:
All permission changes temporarily disable the extension until the user is prompted to accept the (new one). Even value changes.

On Tue, 28 Aug 2018, 20:11 David Harbage, <david....@gmail.com> wrote:
Are you sure of this? Can you expand on your answer a little more or point me in the direction of an explanation? I was under the impression that it wouldn't, since it doesn't change which sites are affected. I should add that the extension already has the "<all_urls>" and "activeTab" permissions, and this is just a key being added to an individual content script:

Auto Generated Inline Image 1
On Tuesday, August 28, 2018 at 2:34:22 PM UTC-4, Decklin / Deco wrote:
Yes, it will.

On Mon, Aug 27, 2018 at 8:51 PM David Harbage <david....@gmail.com> wrote:
I work on a chrome extension that injects content scripts into all frames on all webpages. I'd like to extend this functionality by adding "match_about_blank": true to the content script permissions in the manifest file. In the chrome extension docs, it says that updating an extension with additional permissions may temporarily disable it. My question is, will adding the match_about_blank attribute to a content script trigger this permission warning?

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extensions+unsub...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extensions+unsub...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extensions+unsub...@chromium.org.

PhistucK

unread,
Aug 30, 2018, 2:58:28 PM8/30/18
to david....@gmail.com, Chromium-extensions, Devlin Cronin
Huh, I assumed you would get a warning anyway if you install it this way.

PhistucK


On Thu, Aug 30, 2018 at 9:53 PM David Harbage <david....@gmail.com> wrote:
I was actually able to test this locally by following the instructions in the link Devlin shared - https://developer.chrome.com/extensions/permission_warnings#update_permissions. Basically, you pack one version of your extension (prior to whatever permission changes you're making) and install it in chrome. Then you take the updated version of your extension (the one with permission changes), and pack it in chrome again but use the private key that was generated the for the last version of the extension that you packed. This simulates an extension upgrade, and will give you any extension permission warnings that would occur when you push out an update to the extension.

On Thursday, August 30, 2018 at 2:45:01 PM UTC-4, PhistucK wrote:
By the way, perhaps there should be a way in Chrome to emulate this in order to see if you get a permission alert?
It is not great to have to publish stuff to the store (or ask here) just to find that out...

PhistucK


On Wed, Aug 29, 2018 at 7:23 PM Devlin Cronin <rdevlin...@chromium.org> wrote:
This isn't quite true - only permission changes that trigger a change in the permission warnings a user sees will disable an extension.  Chrome's permission warnings system is complex (because certain permissions "consume" other permissions - e.g., the `history` permission consumes the `tabs` permission), and so this isn't as simple.  Some permissions are warning-less (e.g., `storage`), and could be added without disabling the extension.  Others won't generate an additional warning with the other permissions that are present.

The easiest way to test this is to load one version of the extension, look at the permission warnings, and then load the second version of the extension, and look at the permission warnings.  This process is somewhat described here: https://developer.chrome.com/extensions/permission_warnings#view_warnings.  If there is a change due to the permission added, then it is likely the extension will be disabled.  Note: rarely, but occasionally, there are differences between Chrome versions, so we'd recommend trying on all current Chrome channels.

In this particular case, adding "match_about_blank" to a content script - if that's *all* that changes - should not disable the extension, since it doesn't grant the extension any increased permission.  If other values change (e.g., the content script's "matches" values, other manifest keys, or the "permissions" list), then there is a chance the extension will be disabled.

Cheers,
- Devlin

On Wednesday, August 29, 2018 at 8:45:29 AM UTC-7, Decklin / Deco wrote:
All permission changes temporarily disable the extension until the user is prompted to accept the (new one). Even value changes.

On Tue, 28 Aug 2018, 20:11 David Harbage, <david....@gmail.com> wrote:
Are you sure of this? Can you expand on your answer a little more or point me in the direction of an explanation? I was under the impression that it wouldn't, since it doesn't change which sites are affected. I should add that the extension already has the "<all_urls>" and "activeTab" permissions, and this is just a key being added to an individual content script:

Auto Generated Inline Image 1
On Tuesday, August 28, 2018 at 2:34:22 PM UTC-4, Decklin / Deco wrote:
Yes, it will.

On Mon, Aug 27, 2018 at 8:51 PM David Harbage <david....@gmail.com> wrote:
I work on a chrome extension that injects content scripts into all frames on all webpages. I'd like to extend this functionality by adding "match_about_blank": true to the content script permissions in the manifest file. In the chrome extension docs, it says that updating an extension with additional permissions may temporarily disable it. My question is, will adding the match_about_blank attribute to a content script trigger this permission warning?

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.

Devlin Cronin

unread,
Aug 30, 2018, 5:41:14 PM8/30/18
to Chromium-Extensions-Announce, rdevlin...@chromium.org, david....@gmail.com
By the way, perhaps there should be a way in Chrome to emulate this in order to see if you get a permission alert?
It is not great to have to publish stuff to the store (or ask here) just to find that out...
Very much agreed - it's something we would like to add.  Better yet would be to have support in the store's developer dashboard as well, to warn developers before pushing an update that will disable the extension.  That's a bit more complicated yet, since all the logic for determining updates is in Chrome, and can change across channels (though very rarely). 

On Thursday, August 30, 2018 at 11:45:01 AM UTC-7, PhistucK wrote:
By the way, perhaps there should be a way in Chrome to emulate this in order to see if you get a permission alert?
It is not great to have to publish stuff to the store (or ask here) just to find that out...

PhistucK


On Wed, Aug 29, 2018 at 7:23 PM Devlin Cronin <rdevlin...@chromium.org> wrote:
This isn't quite true - only permission changes that trigger a change in the permission warnings a user sees will disable an extension.  Chrome's permission warnings system is complex (because certain permissions "consume" other permissions - e.g., the `history` permission consumes the `tabs` permission), and so this isn't as simple.  Some permissions are warning-less (e.g., `storage`), and could be added without disabling the extension.  Others won't generate an additional warning with the other permissions that are present.

The easiest way to test this is to load one version of the extension, look at the permission warnings, and then load the second version of the extension, and look at the permission warnings.  This process is somewhat described here: https://developer.chrome.com/extensions/permission_warnings#view_warnings.  If there is a change due to the permission added, then it is likely the extension will be disabled.  Note: rarely, but occasionally, there are differences between Chrome versions, so we'd recommend trying on all current Chrome channels.

In this particular case, adding "match_about_blank" to a content script - if that's *all* that changes - should not disable the extension, since it doesn't grant the extension any increased permission.  If other values change (e.g., the content script's "matches" values, other manifest keys, or the "permissions" list), then there is a chance the extension will be disabled.

Cheers,
- Devlin

On Wednesday, August 29, 2018 at 8:45:29 AM UTC-7, Decklin / Deco wrote:
All permission changes temporarily disable the extension until the user is prompted to accept the (new one). Even value changes.

On Tue, 28 Aug 2018, 20:11 David Harbage, <david....@gmail.com> wrote:
Are you sure of this? Can you expand on your answer a little more or point me in the direction of an explanation? I was under the impression that it wouldn't, since it doesn't change which sites are affected. I should add that the extension already has the "<all_urls>" and "activeTab" permissions, and this is just a key being added to an individual content script:

Auto Generated Inline Image 1
On Tuesday, August 28, 2018 at 2:34:22 PM UTC-4, Decklin / Deco wrote:
Yes, it will.

On Mon, Aug 27, 2018 at 8:51 PM David Harbage <david....@gmail.com> wrote:
I work on a chrome extension that injects content scripts into all frames on all webpages. I'd like to extend this functionality by adding "match_about_blank": true to the content script permissions in the manifest file. In the chrome extension docs, it says that updating an extension with additional permissions may temporarily disable it. My question is, will adding the match_about_blank attribute to a content script trigger this permission warning?

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extensions+unsub...@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extensions+unsub...@chromium.org.
To post to this group, send email to chromium-extensions@chromium.org.

--
You received this message because you are subscribed to the Google Groups "Chromium-Extensions-Announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extensions+unsub...@chromium.org.
To post to this group, send email to chromium-extensions@chromium.org.
Reply all
Reply to author
Forward
0 new messages