From c4bcbe7056da00277112f21b94966e0443c39805 Mon Sep 17 00:00:00 2001 From: rebloor Date: Fri, 12 Jun 2026 04:39:14 +1200 Subject: [PATCH 1/4] Bug 2034168 explicit permission for file access (#44328) * Add use of declarativeNetRequest to Intercept HTTP requests guide * Bug-2034168 explicit permission for file access * Removing /intercept_http_requests/index.md * Feedback updates * Details of Chrome and Firefox permission labels --- .../api/devtools/inspectedwindow/eval/index.md | 2 ++ .../mozilla/add-ons/webextensions/api/extension/index.md | 4 ++-- .../api/extension/isallowedfileschemeaccess/index.md | 6 +----- files/en-us/mozilla/firefox/releases/153/index.md | 2 +- 4 files changed, 6 insertions(+), 8 deletions(-) diff --git a/files/en-us/mozilla/add-ons/webextensions/api/devtools/inspectedwindow/eval/index.md b/files/en-us/mozilla/add-ons/webextensions/api/devtools/inspectedwindow/eval/index.md index ba7877f765fa3d7..663a38c40628e8b 100644 --- a/files/en-us/mozilla/add-ons/webextensions/api/devtools/inspectedwindow/eval/index.md +++ b/files/en-us/mozilla/add-ons/webextensions/api/devtools/inspectedwindow/eval/index.md @@ -18,6 +18,8 @@ The script is evaluated by default in the main frame of the page. The script mus You can't call `eval()` on privileged browser windows such as "about:addons". +In Firefox 153 and later, calling `eval()` on a `file://` URL requires the extension to be granted file scheme access by the user. Without this permission, the promise rejects with an error. Use {{WebExtAPIRef("extension.isAllowedFileSchemeAccess()")}} to check whether the user has granted the extension this permission. + You can optionally provide an `options` parameter, which includes options to evaluate the script in a different frame or in the context of attached content scripts. Note that Firefox does not yet support the `options` parameter. The `eval()` function returns a [`Promise`](/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) that resolves to the evaluated result of the script or to an error. diff --git a/files/en-us/mozilla/add-ons/webextensions/api/extension/index.md b/files/en-us/mozilla/add-ons/webextensions/api/extension/index.md index 75f9f0b6792a8fa..c64c53deec2f119 100644 --- a/files/en-us/mozilla/add-ons/webextensions/api/extension/index.md +++ b/files/en-us/mozilla/add-ons/webextensions/api/extension/index.md @@ -34,9 +34,9 @@ Utilities related to your extension. Get URLs to resources packages with your ex - {{WebExtAPIRef("extension.getViews()")}} - : Returns an array of the [`Window`](/en-US/docs/Web/API/Window) objects for each of the pages running inside the current extension. - {{WebExtAPIRef("extension.isAllowedIncognitoAccess()")}} - - : Retrieves the state of the extension's access to Incognito-mode (as determined by the user-controlled '_Allowed in Incognito_' checkbox). + - : Retrieves the state of the extension's access to tabs opened in "private browsing" mode (as determined by the user-controlled '_Run in Private Windows_' option in the extension's permissions). - {{WebExtAPIRef("extension.isAllowedFileSchemeAccess()")}} - - : Retrieves the state of the extension's access to the `file://` scheme (as determined by the user-controlled '_Allow access to File URLs_' checkbox). + - : Retrieves the state of the extension's access to the `file://` scheme (as determined by a user-controlled option in the extension's permissions: '_Allow access to File URLs_' on Chrome and '_Access local files on your computer_' on Firefox). - {{WebExtAPIRef("extension.sendRequest()")}} {{deprecated_inline}} - : Sends a single request to other listeners within the extension. - {{WebExtAPIRef("extension.setUpdateUrlData()")}} diff --git a/files/en-us/mozilla/add-ons/webextensions/api/extension/isallowedfileschemeaccess/index.md b/files/en-us/mozilla/add-ons/webextensions/api/extension/isallowedfileschemeaccess/index.md index d492a44284e3916..e77bad520a512ab 100644 --- a/files/en-us/mozilla/add-ons/webextensions/api/extension/isallowedfileschemeaccess/index.md +++ b/files/en-us/mozilla/add-ons/webextensions/api/extension/isallowedfileschemeaccess/index.md @@ -8,8 +8,6 @@ sidebar: addonsidebar Returns `true` if the extension can access the "file://" scheme, `false` otherwise. -This is an asynchronous function that returns a [`Promise`](/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise). - ## Syntax ```js-nolint @@ -22,9 +20,7 @@ None. ### Return value -A [`Promise`](/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) that will be fulfilled with a boolean: `true` if the extension is allowed access to "file://" URLs, `false` otherwise. - -Firefox will always return `false`. +A [`Promise`](/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) fulfilled with a boolean: `true` if the extension is allowed access to "file://" URLs, `false` otherwise. ## Examples diff --git a/files/en-us/mozilla/firefox/releases/153/index.md b/files/en-us/mozilla/firefox/releases/153/index.md index 0d707964f30ae86..244e8e141495cab 100644 --- a/files/en-us/mozilla/firefox/releases/153/index.md +++ b/files/en-us/mozilla/firefox/releases/153/index.md @@ -72,8 +72,8 @@ Firefox 153 is the current [Nightly version of Firefox](https://www.firefox.com/ ## Changes for add-on developers +- Extensions now require explicit user permission to access `file://` URLs. Previously, access to local files was covered by the "Access your data for all websites" host permission. This change introduces a separate "Access local files on your computer" option in the extension's permissions settings (desktop only), and file access is turned off by default for all extensions, including existing ones. The {{WebExtAPIRef("extension.isAllowedFileSchemeAccess()")}} method now correctly returns `true` if the user has granted file scheme access; previously, Firefox always returned `false`. Additionally, calling {{WebExtAPIRef("devtools.inspectedWindow.eval()")}} on `file://` URLs now requires this permission. ([Firefox bug 2034168](https://bugzil.la/2034168)) - Adds the {{WebExtAPIRef("contextualIdentities.getSupportedColors()")}} and {{WebExtAPIRef("contextualIdentities.getSupportedIcons()")}} methods to retrieve the colors and icons available for contextual identities (containers). ([Firefox bug 2044712](https://bugzil.la/2044712)) -- Extension content scripts can now read and modify constructed stylesheets in {{domxref("document.adoptedStyleSheets")}} and {{domxref("ShadowRoot.adoptedStyleSheets")}}, without `.wrappedJSObject`. ([Firefox bug 1751346](https://bugzil.la/1751346)) From 5054fb75bce0f095ed9ca9ad11dabde32eea5cb4 Mon Sep 17 00:00:00 2001 From: rebloor Date: Fri, 12 Jun 2026 04:50:25 +1200 Subject: [PATCH 2/4] Bug 1315558 documentation for the publicSuffix API (#44401) * Bug 1315558 documentation for the publicSuffix API * Apply suggestions from @Rob--W Co-authored-by: Rob Wu Co-authored-by: rebloor * Remove potentially confusing training commas from examples Removed explicit mention of error message content Tidied up glossary references * Remove trailing commas * Remove trailing commas * drop mention of background scripts-only --------- Co-authored-by: Rob Wu --- .../api/publicsuffix/domainencoding/index.md | 22 ++++ .../api/publicsuffix/getdomain/index.md | 117 ++++++++++++++++++ .../api/publicsuffix/getknownsuffix/index.md | 46 +++++++ .../webextensions/api/publicsuffix/index.md | 37 ++++++ .../api/publicsuffix/isknownsuffix/index.md | 44 +++++++ .../optional_permissions/index.md | 2 + .../manifest.json/permissions/index.md | 1 + .../mozilla/firefox/releases/153/index.md | 2 + 8 files changed, 271 insertions(+) create mode 100644 files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/domainencoding/index.md create mode 100644 files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/getdomain/index.md create mode 100644 files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/getknownsuffix/index.md create mode 100644 files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/index.md create mode 100644 files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/isknownsuffix/index.md diff --git a/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/domainencoding/index.md b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/domainencoding/index.md new file mode 100644 index 000000000000000..dcf90ba8d34978b --- /dev/null +++ b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/domainencoding/index.md @@ -0,0 +1,22 @@ +--- +title: publicSuffix.DomainEncoding +slug: Mozilla/Add-ons/WebExtensions/API/publicSuffix/DomainEncoding +page-type: webextension-api-type +browser-compat: webextensions.api.publicSuffix.DomainEncoding +sidebar: addonsidebar +--- + +The encoding format for domain names returned by {{WebExtAPIRef("publicSuffix.getDomain()")}}. + +## Type + +Values of this type are strings. Possible values are: + +- `"punycode"` + - : Returns the domain in [Punycode](https://en.wikipedia.org/wiki/Punycode) (ASCII-compatible encoding, ACE). This value is the default. +- `"display"` + - : Returns the domain in Unicode form, suitable for display to users. If the Unicode representation contains characters that could be confused with characters from another script (confusable characters), the domain is returned in Punycode instead to prevent [homograph attacks](https://en.wikipedia.org/wiki/IDN_homograph_attack). + +## Browser compatibility + +{{Compat}} diff --git a/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/getdomain/index.md b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/getdomain/index.md new file mode 100644 index 000000000000000..ee65265894ca61b --- /dev/null +++ b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/getdomain/index.md @@ -0,0 +1,117 @@ +--- +title: publicSuffix.getDomain() +slug: Mozilla/Add-ons/WebExtensions/API/publicSuffix/getDomain +page-type: webextension-api-function +browser-compat: webextensions.api.publicSuffix.getDomain +sidebar: addonsidebar +--- + +Returns the {{Glossary("Registrable_domain","registrable domain")}} (eTLD+1) of the hostname, or `null` if no registrable domain can be determined. + +The registrable domain is the public suffix plus one preceding label. For example, for `"sub.example.co.uk"`, the registrable domain is `"example.co.uk"`. + +By default, this method returns `null` for: + +- IP addresses. +- Hostnames that are themselves a public suffix (e.g., `"com"`). +- Hostnames with no known public suffix (e.g., `"localhost"`). + +The `options` parameter provides flags for changing this default behavior. + +## Syntax + +```js-nolint +let domain = browser.publicSuffix.getDomain(hostname) +let domain = browser.publicSuffix.getDomain(hostname, options) +``` + +### Parameters + +- `hostname` + - : `string`. The hostname to extract the registrable domain from. +- `options` {{optional_inline}} + - : `object`. Options that control the returned value. + - `encoding` {{optional_inline}} + - : {{WebExtAPIRef("publicSuffix.DomainEncoding")}}. The encoding to use for the returned domain name. Defaults to `"punycode"`. + - `allowIPAddress` {{optional_inline}} + - : `boolean`. If `true` and `hostname` is an IP address, the IP address is returned as-is. Defaults to `false`. + - `allowPlainSuffix` {{optional_inline}} + - : `boolean`. If `true` and `hostname` is a known public suffix, the suffix is returned as-is. Defaults to `false`. + - `allowUnknownSuffix` {{optional_inline}} + - : `boolean`. If `true` and `hostname` has no known public suffix, the last two domain labels of the hostname are returned. Defaults to `false`. + +### Return value + +A `string` containing the registrable domain of `hostname`, or `null` if no registrable domain can be determined. + +Throws an error if `hostname` is not a valid hostname. + +## Examples + +Get the registrable domain of a hostname: + +```js +console.log(browser.publicSuffix.getDomain("sub.example.com")); // "example.com" +console.log(browser.publicSuffix.getDomain("sub.example.co.uk")); // "example.co.uk" +console.log(browser.publicSuffix.getDomain("user.github.io")); // "user.github.io" +console.log(browser.publicSuffix.getDomain("com")); // null (is itself a suffix) +console.log(browser.publicSuffix.getDomain("192.0.2.1")); // null (IP address) +console.log(browser.publicSuffix.getDomain("localhost")); // null (no known suffix) +``` + +Using `allowIPAddress` to return IP addresses as-is: + +```js +console.log( + browser.publicSuffix.getDomain("192.0.2.1", { allowIPAddress: true }) +); // "192.0.2.1" +console.log( + browser.publicSuffix.getDomain("[2001:db8::1]", { allowIPAddress: true }) +); // "2001:db8::1" +``` + +Using `allowPlainSuffix` to return hostnames that are public suffixes: + +```js +console.log( + browser.publicSuffix.getDomain("co.uk", { allowPlainSuffix: true }) +); // "co.uk" +``` + +Using `allowUnknownSuffix` to handle private or local domains: + +```js +console.log( + browser.publicSuffix.getDomain("mydevice.local", { + allowUnknownSuffix: true + }) +); // "mydevice.local" +console.log( + browser.publicSuffix.getDomain("host.intranet", { allowUnknownSuffix: true }) +); // "host.intranet" +``` + +Using `encoding: "display"` for internationalized domain names: + +```js +// "xn--nxasmq6b.com" is the punycode form of "βόλος.com" +console.log( + browser.publicSuffix.getDomain("sub.xn--nxasmq6b.com", { + encoding: "display" + }) +); // "βόλος.com" + +// Domains with confusable characters remain in punycode +// "xn--bs-red.com" has characters confusable with another script +console.log( + browser.publicSuffix.getDomain("sub.xn--bs-red.com", { + encoding: "display" + }) +); // "xn--bs-red.com" +``` + +{{WebExtExamples}} + +## Browser compatibility + +{{Compat}} diff --git a/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/getknownsuffix/index.md b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/getknownsuffix/index.md new file mode 100644 index 000000000000000..cf9e943389a85f8 --- /dev/null +++ b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/getknownsuffix/index.md @@ -0,0 +1,46 @@ +--- +title: publicSuffix.getKnownSuffix() +slug: Mozilla/Add-ons/WebExtensions/API/publicSuffix/getKnownSuffix +page-type: webextension-api-function +browser-compat: webextensions.api.publicSuffix.getKnownSuffix +sidebar: addonsidebar +--- + +Returns the known public suffix (eTLD) of the hostname according to the [Public Suffix List](https://publicsuffix.org/), or `null` if the hostname has no known public suffix. + +When a hostname has multiple possible public suffixes, the longest matching entry is returned. + +## Syntax + +```js-nolint +let suffix = browser.publicSuffix.getKnownSuffix(hostname) +``` + +### Parameters + +- `hostname` + - : `string`. The hostname whose public suffix is to be returned. + +### Return value + +A `string` containing the public suffix of `hostname`, or `null` if no known public suffix exists for `hostname`. + +Throws an error if `hostname` is not a valid hostname. + +## Examples + +Get the public suffix of a hostname: + +```js +console.log(browser.publicSuffix.getKnownSuffix("example.com")); // "com" +console.log(browser.publicSuffix.getKnownSuffix("example.co.uk")); // "co.uk" +console.log(browser.publicSuffix.getKnownSuffix("user.github.io")); // "github.io" +console.log(browser.publicSuffix.getKnownSuffix("com")); // "com" +console.log(browser.publicSuffix.getKnownSuffix("localhost")); // null +``` + +{{WebExtExamples}} + +## Browser compatibility + +{{Compat}} diff --git a/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/index.md b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/index.md new file mode 100644 index 000000000000000..2732005c0814b02 --- /dev/null +++ b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/index.md @@ -0,0 +1,37 @@ +--- +title: publicSuffix +slug: Mozilla/Add-ons/WebExtensions/API/publicSuffix +page-type: webextension-api +browser-compat: webextensions.api.publicSuffix +sidebar: addonsidebar +--- + +Use the `publicSuffix` API to work with domain names and public suffixes (effective top-level domains, or eTLDs) from the [Public Suffix List](https://publicsuffix.org/). Because the browser's built-in Public Suffix List is always up to date, extensions don't need to bundle a copy. + +Common use cases include: + +- Identifying the {{Glossary("Registrable_domain","registrable domain")}} (eTLD+1) of a hostname to group related domains or detect third-party requests. +- Checking whether a hostname is itself a public suffix. +- Extracting the public suffix portion of a hostname. + +To use this API, you must have the `"publicSuffix"` [permission](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions). + +## Types + +- {{WebExtAPIRef("publicSuffix.DomainEncoding")}} + - : Specifies the encoding format for domain names returned by {{WebExtAPIRef("publicSuffix.getDomain()")}}. + +## Functions + +- {{WebExtAPIRef("publicSuffix.isKnownSuffix()")}} + - : Returns `true` if the hostname is a known public suffix. +- {{WebExtAPIRef("publicSuffix.getKnownSuffix()")}} + - : Returns the known public suffix of a hostname, or `null` if none exists. +- {{WebExtAPIRef("publicSuffix.getDomain()")}} + - : Returns the registrable domain (eTLD+1) of a hostname. + +{{WebExtExamples("h2")}} + +## Browser compatibility + +{{Compat}} diff --git a/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/isknownsuffix/index.md b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/isknownsuffix/index.md new file mode 100644 index 000000000000000..017c35e26f4cd69 --- /dev/null +++ b/files/en-us/mozilla/add-ons/webextensions/api/publicsuffix/isknownsuffix/index.md @@ -0,0 +1,44 @@ +--- +title: publicSuffix.isKnownSuffix() +slug: Mozilla/Add-ons/WebExtensions/API/publicSuffix/isKnownSuffix +page-type: webextension-api-function +browser-compat: webextensions.api.publicSuffix.isKnownSuffix +sidebar: addonsidebar +--- + +Returns `true` if the hostname is a known public suffix (eTLD) in the [Public Suffix List](https://publicsuffix.org/). + +## Syntax + +```js-nolint +let result = browser.publicSuffix.isKnownSuffix(hostname) +``` + +### Parameters + +- `hostname` + - : `string`. The hostname to check. + +### Return value + +`true` if `hostname` is a known public suffix, `false` otherwise. + +Throws an error if `hostname` is not a valid hostname. + +## Examples + +Check whether a string is a known public suffix: + +```js +console.log(browser.publicSuffix.isKnownSuffix("com")); // true +console.log(browser.publicSuffix.isKnownSuffix("co.uk")); // true +console.log(browser.publicSuffix.isKnownSuffix("github.io")); // true +console.log(browser.publicSuffix.isKnownSuffix("example.com")); // false +console.log(browser.publicSuffix.isKnownSuffix("localhost")); // false +``` + +{{WebExtExamples}} + +## Browser compatibility + +{{Compat}} diff --git a/files/en-us/mozilla/add-ons/webextensions/manifest.json/optional_permissions/index.md b/files/en-us/mozilla/add-ons/webextensions/manifest.json/optional_permissions/index.md index f83c1a1d11cd774..403930aded7795d 100644 --- a/files/en-us/mozilla/add-ons/webextensions/manifest.json/optional_permissions/index.md +++ b/files/en-us/mozilla/add-ons/webextensions/manifest.json/optional_permissions/index.md @@ -82,6 +82,7 @@ The optional API permissions are: - `pkcs11` - `privacy` - `proxy` +- `publicSuffix` - `scripting` - `search` - `sessions` @@ -103,6 +104,7 @@ These optional permissions are granted silently, without a user prompt: - `activeTab` - `cookies` - `idle` +- `publicSuffix` - `tabGroups` - `webRequest` - `webRequestBlocking` diff --git a/files/en-us/mozilla/add-ons/webextensions/manifest.json/permissions/index.md b/files/en-us/mozilla/add-ons/webextensions/manifest.json/permissions/index.md index f0102e0220101e3..c4049eac3f41d30 100644 --- a/files/en-us/mozilla/add-ons/webextensions/manifest.json/permissions/index.md +++ b/files/en-us/mozilla/add-ons/webextensions/manifest.json/permissions/index.md @@ -111,6 +111,7 @@ These permissions are available in Manifest V2 and above unless otherwise noted: - `pageCapture` - `pkcs11` - `privacy` +- `publicSuffix` - `proxy` - `scripting` - `search` diff --git a/files/en-us/mozilla/firefox/releases/153/index.md b/files/en-us/mozilla/firefox/releases/153/index.md index 244e8e141495cab..14b5bb7ca77a404 100644 --- a/files/en-us/mozilla/firefox/releases/153/index.md +++ b/files/en-us/mozilla/firefox/releases/153/index.md @@ -73,6 +73,8 @@ Firefox 153 is the current [Nightly version of Firefox](https://www.firefox.com/ ## Changes for add-on developers - Extensions now require explicit user permission to access `file://` URLs. Previously, access to local files was covered by the "Access your data for all websites" host permission. This change introduces a separate "Access local files on your computer" option in the extension's permissions settings (desktop only), and file access is turned off by default for all extensions, including existing ones. The {{WebExtAPIRef("extension.isAllowedFileSchemeAccess()")}} method now correctly returns `true` if the user has granted file scheme access; previously, Firefox always returned `false`. Additionally, calling {{WebExtAPIRef("devtools.inspectedWindow.eval()")}} on `file://` URLs now requires this permission. ([Firefox bug 2034168](https://bugzil.la/2034168)) +- Adds the {{WebExtAPIRef("publicSuffix")}} API, enabling extensions to determine the registrable domain (eTLD+1) and public suffix of a hostname using the browser's built-in [Public Suffix List](https://publicsuffix.org/). The API provides three synchronous methods: {{WebExtAPIRef("publicSuffix.isKnownSuffix()")}}, {{WebExtAPIRef("publicSuffix.getKnownSuffix()")}}, and {{WebExtAPIRef("publicSuffix.getDomain()")}}. ([Firefox bug 1315558](https://bugzil.la/1315558)) +- Extension content scripts can now read and modify constructed stylesheets in {{domxref("document.adoptedStyleSheets")}} and {{domxref("ShadowRoot.adoptedStyleSheets")}}, without `.wrappedJSObject`. ([Firefox bug 1751346](https://bugzil.la/1751346)) - Adds the {{WebExtAPIRef("contextualIdentities.getSupportedColors()")}} and {{WebExtAPIRef("contextualIdentities.getSupportedIcons()")}} methods to retrieve the colors and icons available for contextual identities (containers). ([Firefox bug 2044712](https://bugzil.la/2044712)) From 20c11f6af0809fa827413acf968b56bf4650d8d4 Mon Sep 17 00:00:00 2001 From: rebloor Date: Fri, 12 Jun 2026 05:05:02 +1200 Subject: [PATCH 3/4] Bug 1930776 updates for the implementation of userScripts.execute (#44369) * Bug 1930776 updates for the implementation of userScripts.execute * Feedback updates --- .../add-ons/webextensions/api/userscripts/index.md | 9 ++++----- .../webextensions/api/userscripts/scriptsource/index.md | 2 +- files/en-us/mozilla/firefox/releases/153/index.md | 1 + 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/files/en-us/mozilla/add-ons/webextensions/api/userscripts/index.md b/files/en-us/mozilla/add-ons/webextensions/api/userscripts/index.md index 554798e8cb88149..e1ce589873658cd 100644 --- a/files/en-us/mozilla/add-ons/webextensions/api/userscripts/index.md +++ b/files/en-us/mozilla/add-ons/webextensions/api/userscripts/index.md @@ -22,7 +22,7 @@ To use this API, you need the `userScripts` permission and [`host_permissions`]( ## Execution worlds -When a user script is registered or updated (using {{WebExtAPIRef("userScripts.register()")}} or {{WebExtAPIRef("userScripts.update()")}}), your extension can set it to run in an isolated `USER_SCRIPT` world or the `MAIN` world. +When a user script is registered, updated, or executed (using {{WebExtAPIRef("userScripts.register()")}}, {{WebExtAPIRef("userScripts.update()")}}, and {{WebExtAPIRef("userScripts.execute()")}} respectively), your extension can set it to run in an isolated `USER_SCRIPT` world or the `MAIN` world. A `USER_SCRIPT` world provides an isolated execution environment that isn't accessible to a host page or other extensions. This isolation is similar to a [content script environment](/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_scripts#content_script_environment), except `USER_SCRIPT` worlds cannot access extension APIs. @@ -51,14 +51,13 @@ When an extension updates, user scripts are cleared. To restore scripts, add cod ## Types - {{WebExtAPIRef("userScripts.ExecutionWorld")}} - - : The execution environment for a script injected with {{WebExtAPIRef("userScripts.register()")}} - or {{WebExtAPIRef("userScripts.update()")}}. + - : The execution environment for a script injected with {{WebExtAPIRef("userScripts.,"execute()", "execute()"}}, {{WebExtAPIRef("userScripts.register()", "register()")}}, or {{WebExtAPIRef("userScripts.update()", "update()")}}. - {{WebExtAPIRef("userScripts.RegisteredUserScript")}} - : An `object` returned by {{WebExtAPIRef("userScripts.getScripts","getScripts()")}} representing registered user scripts and used as input to {{WebExtAPIRef("userScripts.register","register()")}} and {{WebExtAPIRef("userScripts.update","update()")}}. - {{WebExtAPIRef("userScripts.ScriptSource")}} - - : The code or a file source for a user script. + - : The code or a file source for a user script used in {{WebExtAPIRef("userScripts.execute()", "execute()")}} and {{WebExtAPIRef("userScripts.RegisteredUserScript","RegisteredUserScript")}} . - {{WebExtAPIRef("userScripts.UserScriptFilter")}} - - : A list of user scripts to be processed by {{WebExtAPIRef("userScripts.getScripts()")}} or {{WebExtAPIRef("userScripts.unregister()")}}. + - : A list of user scripts to be processed by {{WebExtAPIRef("userScripts.getScripts()", "getScripts()")}} or {{WebExtAPIRef("userScripts.unregister()", "unregister()")}}. - {{WebExtAPIRef("userScripts.WorldProperties")}} - : The configuration of a `USER_SCRIPT` execution environment. diff --git a/files/en-us/mozilla/add-ons/webextensions/api/userscripts/scriptsource/index.md b/files/en-us/mozilla/add-ons/webextensions/api/userscripts/scriptsource/index.md index d48a3ba4482a6e0..67fb9e23ef1135f 100644 --- a/files/en-us/mozilla/add-ons/webextensions/api/userscripts/scriptsource/index.md +++ b/files/en-us/mozilla/add-ons/webextensions/api/userscripts/scriptsource/index.md @@ -6,7 +6,7 @@ browser-compat: webextensions.api.userScripts.ScriptSource sidebar: addonsidebar --- -The code or source file for a user script. This describes the object values of the "js" property in {{WebExtAPIRef("userScripts.RegisteredUserScript","RegisteredUserScript")}}. +The code or source file for a user script. This describes the object values of the "js" property in {{WebExtAPIRef("userScripts.execute()", "execute()")}} and {{WebExtAPIRef("userScripts.RegisteredUserScript","RegisteredUserScript")}}. ## Type diff --git a/files/en-us/mozilla/firefox/releases/153/index.md b/files/en-us/mozilla/firefox/releases/153/index.md index 14b5bb7ca77a404..796013dfd361d0b 100644 --- a/files/en-us/mozilla/firefox/releases/153/index.md +++ b/files/en-us/mozilla/firefox/releases/153/index.md @@ -73,6 +73,7 @@ Firefox 153 is the current [Nightly version of Firefox](https://www.firefox.com/ ## Changes for add-on developers - Extensions now require explicit user permission to access `file://` URLs. Previously, access to local files was covered by the "Access your data for all websites" host permission. This change introduces a separate "Access local files on your computer" option in the extension's permissions settings (desktop only), and file access is turned off by default for all extensions, including existing ones. The {{WebExtAPIRef("extension.isAllowedFileSchemeAccess()")}} method now correctly returns `true` if the user has granted file scheme access; previously, Firefox always returned `false`. Additionally, calling {{WebExtAPIRef("devtools.inspectedWindow.eval()")}} on `file://` URLs now requires this permission. ([Firefox bug 2034168](https://bugzil.la/2034168)) +- Supports the {{WebExtAPIRef("userScripts.execute()")}} method, enabling extensions to inject user scripts on demand into a tab or frame. Unlike {{WebExtAPIRef("userScripts.register()")}}, this method supports one-off injection of multiple script sources executed in a defined order. ([Firefox bug 1930776](https://bugzil.la/1930776)) - Adds the {{WebExtAPIRef("publicSuffix")}} API, enabling extensions to determine the registrable domain (eTLD+1) and public suffix of a hostname using the browser's built-in [Public Suffix List](https://publicsuffix.org/). The API provides three synchronous methods: {{WebExtAPIRef("publicSuffix.isKnownSuffix()")}}, {{WebExtAPIRef("publicSuffix.getKnownSuffix()")}}, and {{WebExtAPIRef("publicSuffix.getDomain()")}}. ([Firefox bug 1315558](https://bugzil.la/1315558)) - Extension content scripts can now read and modify constructed stylesheets in {{domxref("document.adoptedStyleSheets")}} and {{domxref("ShadowRoot.adoptedStyleSheets")}}, without `.wrappedJSObject`. ([Firefox bug 1751346](https://bugzil.la/1751346)) - Adds the {{WebExtAPIRef("contextualIdentities.getSupportedColors()")}} and {{WebExtAPIRef("contextualIdentities.getSupportedIcons()")}} methods to retrieve the colors and icons available for contextual identities (containers). ([Firefox bug 2044712](https://bugzil.la/2044712)) From bfaf90116752cffcff6098be4d40f843b8e9f6ee Mon Sep 17 00:00:00 2001 From: Hamish Willee Date: Fri, 12 Jun 2026 03:34:40 +1000 Subject: [PATCH 4/4] FF152 Relnote: AnimationEvent/TransitionEvent .animate supported (#44392) --- files/en-us/mozilla/firefox/releases/152/index.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/files/en-us/mozilla/firefox/releases/152/index.md b/files/en-us/mozilla/firefox/releases/152/index.md index 4b097f03ec36c3c..760ae063f00fac4 100644 --- a/files/en-us/mozilla/firefox/releases/152/index.md +++ b/files/en-us/mozilla/firefox/releases/152/index.md @@ -66,6 +66,9 @@ Firefox 152 is the current [Beta version of Firefox](https://www.firefox.com/en- - The {{domxref("PerformanceResourceTiming.firstInterimResponseStart","firstInterimResponseStart")}} and {{domxref("PerformanceResourceTiming.finalResponseHeadersStart","finalResponseHeadersStart")}} properties of the {{domxref("PerformanceResourceTiming")}} interface are supported. These can be used to measure how long it takes for the browser to receive interim HTTP responses and the final HTTP response after sending a request, respectively. ([Firefox bug 2006340](https://bugzil.la/2006340)). +- The {{domxref("AnimationEvent.animation")}} and {{domxref("TransitionEvent.animation")}} properties are now supported. + These provide a more ergonomic way to access the associated animation than calling {{domxref("element.getAnimations()")}} and filtering on the event's `animationName` or `propertyName`. + ([Firefox bug 1929118](https://bugzil.la/1929118)). #### DOM