Error: Permission denied to access property "apply"

[hmdhk]

This Issue happens when using walkme.com firefox extension.

to reproduce:

• install walkme.com firefox extension
• load a page with zone.js
• record some steps with walkme
• click "Preview" in walkme

Update:
As you can see the error is in patchProperty/desc.set. In this case it is trying to set 'load' event on a script with a different origin and when the event fires this error happens. According to MDN "Permission denied" could be the result of cross-origin issue.

[poxrud]

I've investigated this issue since I'm the one that wrote the wrapFn function that is referenced in the error.

The problem is with the "walkme" Firefox extension. The extension is inserting a:
<script src="https://cdn.walkme.com/player/resources/wmjQuery171.js" id="mt_script"></script>
into the page content.

Aside from being a huge security risk, this triggers a security error when ZoneJS tries to monkypatch script.onload.

This is the desired behavior, because you don't want arbitrary web pages being able to modify your extension created objects.

You can find more info here: https://developer.mozilla.org/en-US/Add-ons/SDK/Guides/Content_Scripts/Interacting_with_page_scripts

For the solution, I would recommend the extension creators use the proper API in order to include the js file assets into the extension. As is described in https://developer.mozilla.org/en-US/Add-ons/SDK/Guides/Content_Scripts/Loading_Content_Scripts.

[hmdhk]

The problem is not specific to "walkme", this can happen whenever a script with a different origin is added to the page.

Also this can't be desired behaviour, since zone.js is patching the browser API and while doing so it should not violate security rules, like accessing a script from another origin.

[poxrud]

This only happens with Firefox addons that try to insert a <script> tag that points to an external cross-domain script. I doubt that these addons would pass the Firefox Add-on Review Process.