"Access your data on all sites" permission corrupts Google search result subtitles.

[RokeJulianLockhart]

1. Description

   When granted https://support.mozilla.org/en-US/kb/permission-request-messages-firefox-extensions?as=u&utm_source=inproduct#w_access-your-data-for-all-websites on https://koji.fedoraproject.org/koji/rpminfo?rpmID=38118194, https://www.google.com/search?client=firefox-b-d&q=wexextension.org+github causes:

   

   Disabling and enabling that preference causes the problem to occur immediately (sometimes without page refresh) and reproducibly.

2. How to replicate the issue + URL

   1. Install cpe:/o:fedoraproject:fedora:40.
      1. Write https://download.fedoraproject.org/pub/fedora/linux/releases/test/40_Beta/Spins/x86_64/iso/Fedora-KDE-Live-x86_64-40_Beta-1.10.iso using flatpak install https://dl.flathub.org/repo/appstream/org.fedoraproject.MediaWriter.flatpakref && flatpak update app/org.fedoraproject.MediaWriter/x86_64/stable --commit=08f95f0584ba56e427555192146ebe9f4e558521bff8588d7fa83998ad184b86.
   2. Enable https://support.mozilla.org/en-US/kb/permission-request-messages-firefox-extensions?as=u&utm_source=inproduct#w_access-your-data-for-all-websites for https://addons.mozilla.org/firefox/downloads/file/4252355/refined_github-24.3.20.xpi via about:addons.
      1. Install https://addons.mozilla.org/firefox/downloads/file/4252355/refined_github-24.3.20.xpi.
         1. Install https://koji.fedoraproject.org/koji/rpminfo?rpmID=38118194.
   3. Visit https://www.google.com/search?client=firefox-b-d&q=wexextension.org+github.

3. Extension version

   https://addons.mozilla.org/firefox/downloads/file/4252355/refined_github-24.3.20.xpi

4. Browser(s) used

   https://koji.fedoraproject.org/koji/rpminfo?rpmID=38118194

[fregante]

When granted

Yeah, don't grant it. This is not a bug. You're asking the extension to run on the wrong sites.

[RokeJulianLockhart]

#7319 (comment)

@fregante, because https://addons.mozilla.org/firefox/downloads/file/4253367/augmented_steam-3.1.0.xpi doesn't expose the ability to enable this permission via about:addons, per https://discourse.mozilla.org/t/how-to-ask-user-to-grant-permissions-for-access-your-data-for-all-websites-through-a-prompt-during-the-installation-process/110637/6, removing

permissions: ["activeTab"],
origins: ["<all_urls>"]

(or similar) from your extension manifest should remediate this. Consequently, because you expose this optional permission, this should be considered erroneous.

That's why it's headed with

Optional permissions for added functionality:

[fregante]

It's an optional permission. You enable it so you deal with the consequences. The permission must exist to support GitHub Enterprise users that enable the extension on each specific domain. It's not meant to run on all URLs