Backed out 15 changesets (bug 1794001, bug 1793995, bug 1693271) for causing build bustages CLOSED TREE

Backed out changeset 5d4b0c23342f (bug 1793995)
Backed out changeset 79a5023e7822 (bug 1793995)
Backed out changeset 4330821df43f (bug 1793995)
Backed out changeset a653699a5cef (bug 1793995)
Backed out changeset 264a0154514e (bug 1793995)
Backed out changeset 6773cada61a8 (bug 1793995)
Backed out changeset d55a78f3627a (bug 1793995)
Backed out changeset 16299839e25e (bug 1793995)
Backed out changeset 10c5cf69b3f0 (bug 1693271)
Backed out changeset 84e7bf515c94 (bug 1693271)
Backed out changeset b8dbabe61a9a (bug 1794001)
Backed out changeset 3cfe4087793d (bug 1794001)
Backed out changeset dd03b0396eb9 (bug 1794001)
Backed out changeset d4f9b4a3029a (bug 1794001)
Backed out changeset 148d136ce549 (bug 1794001)

Author: Cristian Tuns

Cargo.lock

@@ -513,20 +513,17 @@ nsresult ContentPrincipal::GetSiteIdentifier(SiteIdentifier& aSite) {
 }
 
 WebExtensionPolicy* ContentPrincipal::AddonPolicy() {
-  AssertIsOnMainThread();
-
   if (!mAddon.isSome()) {
     NS_ENSURE_TRUE(mURI, nullptr);
 
-    WebExtensionPolicy* policy =
-        mURI->SchemeIs("moz-extension") ? EPS().GetByURL(mURI.get()) : nullptr;
-    mAddon.emplace(policy ? policy->Core() : nullptr);
+    if (mURI->SchemeIs("moz-extension")) {
+      mAddon.emplace(EPS().GetByURL(mURI.get()));
+    } else {
+      mAddon.emplace(nullptr);
+    }
   }
 
-  if (extensions::WebExtensionPolicyCore* policy = mAddon.ref()) {
-    return policy->GetMainThreadPolicy();
-  }
-  return nullptr;
+  return mAddon.value();
 }
 
 NS_IMETHODIMP

caps/ContentPrincipal.cpp

@@ -76,7 +76,7 @@ class ContentPrincipal final : public BasePrincipal {
  private:
   const nsCOMPtr<nsIURI> mURI;
   nsCOMPtr<nsIURI> mDomain;
-  Maybe<RefPtr<extensions::WebExtensionPolicyCore>> mAddon;
+  Maybe<WeakPtr<extensions::WebExtensionPolicy>> mAddon;
 };
 
 }  // namespace mozilla

caps/ContentPrincipal.h

@@ -11,16 +11,16 @@
 [ChromeOnly, Exposed=Window]
 interface MatchGlob {
   [Throws]
-  constructor(UTF8String glob, optional boolean allowQuestion = true);
-
+  constructor(DOMString glob, optional boolean allowQuestion = true);
+  
   /**
    * Returns true if the string matches the glob.
    */
-  boolean matches(UTF8String string);
+  boolean matches(DOMString string);
 
   /**
    * The glob string this MatchGlob represents.
    */
   [Constant]
-  readonly attribute UTF8String glob;
+  readonly attribute DOMString glob;
 };

dom/chrome-webidl/MatchGlob.webidl

@@ -7,7 +7,7 @@ interface URI;
 interface WindowProxy;
 
 typedef (MatchPatternSet or sequence<DOMString>) MatchPatternSetOrStringSequence;
-typedef (MatchGlob or UTF8String) MatchGlobOrString;
+typedef (MatchGlob or DOMString) MatchGlobOrString;
 
 [ChromeOnly, Exposed=Window]
 interface MozDocumentMatcher {
@@ -74,6 +74,21 @@ interface MozDocumentMatcher {
   [Constant]
   readonly attribute MatchPatternSet? excludeMatches;
 
+  /**
+   * A set of glob matchers for URLs in which this script should run. If this
+   * list is present, the script will only run in URLs which match the
+   * `matches` pattern as well as one of these globs.
+   */
+  [Cached, Constant, Frozen]
+  readonly attribute sequence<MatchGlob>? includeGlobs;
+
+  /**
+   * A set of glob matchers for URLs in which this script should not run, even
+   * if they match other include patterns or globs.
+   */
+  [Cached, Constant, Frozen]
+  readonly attribute sequence<MatchGlob>? excludeGlobs;
+
   /**
    * The originAttributesPattern for which this script should be enabled for.
    */

dom/chrome-webidl/WebExtensionContentScript.webidl

@@ -176,14 +176,14 @@ interface WebExtensionPolicy {
    * URL root is listed as a web accessible path. Access checks on a path, such
    * as performed in nsScriptSecurityManager, use sourceMayAccessPath below.
    */
-  boolean isWebAccessiblePath(UTF8String pathname);
+  boolean isWebAccessiblePath(DOMString pathname);
 
   /**
    * Returns true if the given path relative to the extension's moz-extension:
    * URL root may be accessed by web content at sourceURI.  For Manifest V2,
    * sourceURI is ignored and the path must merely be listed as web accessible.
    */
-  boolean sourceMayAccessPath(URI sourceURI, UTF8String pathname);
+  boolean sourceMayAccessPath(URI sourceURI, DOMString pathname);
 
   /**
    * Replaces localization placeholders in the given string with localized

dom/chrome-webidl/WebExtensionPolicy.webidl

@@ -15,7 +15,6 @@
 #include "mozilla/dom/PContent.h"
 #include "mozilla/dom/WindowGlobalChild.h"
 
-#include "mozilla/extensions/MatchPattern.h"
 #include "nsContentUtils.h"
 #include "JSActorProtocolUtils.h"
 
@@ -29,7 +28,7 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(JSWindowActorProtocol)
   NS_INTERFACE_MAP_ENTRY(nsIDOMEventListener)
 NS_INTERFACE_MAP_END
 
-NS_IMPL_CYCLE_COLLECTION(JSWindowActorProtocol)
+NS_IMPL_CYCLE_COLLECTION(JSWindowActorProtocol, mURIMatcher)
 
 /* static */ already_AddRefed<JSWindowActorProtocol>
 JSWindowActorProtocol::FromIPC(const JSWindowActorInfo& aInfo) {
@@ -294,18 +293,30 @@ void JSWindowActorProtocol::RemoveObservers() {
   }
 }
 
-extensions::MatchPatternSetCore* JSWindowActorProtocol::GetURIMatcher() {
+extensions::MatchPatternSet* JSWindowActorProtocol::GetURIMatcher() {
   // If we've already created the pattern set, return it.
   if (mURIMatcher || mMatches.IsEmpty()) {
     return mURIMatcher;
   }
 
-  nsTArray<RefPtr<extensions::MatchPatternCore>> patterns(mMatches.Length());
-  for (const nsString& pattern : mMatches) {
-    patterns.AppendElement(new extensions::MatchPatternCore(
-        pattern, false, false, IgnoreErrors()));
+  // Constructing the MatchPatternSet requires a JS environment to be run in.
+  // We can construct it here in the JSM scope, as we will be keeping it around.
+  AutoJSAPI jsapi;
+  MOZ_ALWAYS_TRUE(jsapi.Init(xpc::PrivilegedJunkScope()));
+  GlobalObject global(jsapi.cx(), xpc::PrivilegedJunkScope());
+
+  nsTArray<OwningStringOrMatchPattern> patterns;
+  patterns.SetCapacity(mMatches.Length());
+  for (nsString& s : mMatches) {
+    auto entry = patterns.AppendElement();
+    entry->SetAsString() = s;
   }
-  mURIMatcher = new extensions::MatchPatternSetCore(std::move(patterns));
+
+  MatchPatternOptions matchPatternOptions;
+  // Make MatchPattern's mSchemes create properly.
+  matchPatternOptions.mRestrictSchemes = false;
+  mURIMatcher = extensions::MatchPatternSet::Constructor(
+      global, patterns, matchPatternOptions, IgnoreErrors());
   return mURIMatcher;
 }
 
@@ -365,7 +376,7 @@ bool JSWindowActorProtocol::Matches(BrowsingContext* aBrowsingContext,
     return false;
   }
 
-  if (extensions::MatchPatternSetCore* uriMatcher = GetURIMatcher()) {
+  if (extensions::MatchPatternSet* uriMatcher = GetURIMatcher()) {
     if (!uriMatcher->Matches(aURI)) {
       aRv.ThrowNotSupportedError(nsPrintfCString(
           "Window protocol '%s' doesn't match uri %s", mName.get(),

dom/ipc/jsactor/JSWindowActorProtocol.cpp

@@ -77,7 +77,7 @@ class JSWindowActorProtocol final : public JSActorProtocol,
 
  private:
   explicit JSWindowActorProtocol(const nsACString& aName) : mName(aName) {}
-  extensions::MatchPatternSetCore* GetURIMatcher();
+  extensions::MatchPatternSet* GetURIMatcher();
   bool RemoteTypePrefixMatches(const nsDependentCSubstring& aRemoteType);
   bool MessageManagerGroupMatches(BrowsingContext* aBrowsingContext);
   ~JSWindowActorProtocol() = default;
@@ -94,7 +94,7 @@ class JSWindowActorProtocol final : public JSActorProtocol,
   ParentSide mParent;
   ChildSide mChild;
 
-  RefPtr<extensions::MatchPatternSetCore> mURIMatcher;
+  RefPtr<extensions::MatchPatternSet> mURIMatcher;
 };
 
 }  // namespace dom

dom/ipc/jsactor/JSWindowActorProtocol.h

@@ -459,7 +459,7 @@ FilenameTypeAndDetails nsContentSecurityUtils::FilenameToFilenameType(
       sanitizedPathAndScheme.Append(u"can't get addon off main thread]"_ns);
     }
 
-    AppendUTF8toUTF16(url.FilePath(), sanitizedPathAndScheme);
+    sanitizedPathAndScheme.Append(url.FilePath());
     return FilenameTypeAndDetails(kExtensionURI, Some(sanitizedPathAndScheme));
   }
 

dom/security/nsContentSecurityUtils.cpp

@@ -941,33 +941,6 @@ who = "Mike Hommey <mh+mozilla@glandium.org>"
 criteria = "safe-to-deploy"
 delta = "0.7.0 -> 0.7.1"
 
-[[audits.rure]]
-who = "Nika Layzell <nika@thelayzells.com>"
-criteria = "safe-to-deploy"
-version = "0.2.2"
-notes = """
-This is a fairly straightforward FFI wrapper crate for `regex`, maintained by
-the `regex` developers in the same repository.
-
-This crate is explicitly designed for FFI use, and should not be used directly
-by Rust code. The exported `extern \"C\"` functions are not marked as `unsafe`,
-meaning that it is technically incorrect to use them from within Rust code,
-however they are reasonable to use from C code.
-
-The unsafe code in this crate heavily depends on the C caller maintaining
-invariants, however these invariants are clearly documented in the `rure.h`
-file, bundled with the crate.
-
-I have checked the signatures of each function both in C++ and in the Rust to
-ensure they match.  In some places, the c `rure.h` header file is missing a
-`const` qualifier which could be present given the Rust code, however this will
-have no impact on ABI, and is fairly normal for FFI crates.
-
-Panics are handled in all Rust FFI methods, meaning that projects which do not
-disable unwinding will still consistently abort (using `libc::abort()`) if a
-panic occurs in the Rust code.
-"""
-
 [[audits.rust_decimal]]
 who = "Mike Hommey <mh+mozilla@glandium.org>"
 criteria = "safe-to-deploy"