[Pkg-mozext-maintainers] Bug#922944: firefox refuses to follow symlinks in /usr/share/webext outside of it

[Ximin Luo]

Package: firefox
Version: 65.0.1-1
Severity: important
Control: affects -1 webext-umatrix

Dear Maintainer,

I'm not sure if this relates to upstream, since it's to do with webextension
loading Debian paths.

The behaviour in firefox-esr is fine. I only recently switched to using firefox
65, so did not notice this until recently.

The webext-umatrix extension uses symlinks to other packages, like this:

$ ls -gG /usr/share/webext/umatrix/lib/
total 16
drwxr-xr-x 2 4096 Feb 21 22:38 diff/
lrwxrwxrwx 1   30 Aug  6  2011 codemirror -> ../../../javascript/codemirror/
-rw-r--r-- 1 9994 Feb 21 22:21 publicsuffixlist.js
lrwxrwxrwx 1   40 Feb 21 23:04 punycode.js -> ../../../javascript/punycode/punycode.js

This works in firefox-esr but not firefox (65), instead in the Browser Console I get:

Loading failed for the <script> with source “moz-extension://62446e26-cedb-4973-97f8-2dddc4c9d55f/lib/punycode.js”.

If I replace the symlink with the real file and restart firefox 65, it works again.

If I copy punycode.js to p.js and then symlink punycode.js to p.js, this also
works. So the problem is not with symlinks themselves, but it seems that
somewhere firefox is checking the absolute path and refusing to load paths
outside of /usr/share/webext.

I tried to grep the firefox source code but was not able to figure out which
part might be doing this.

Please fix this as it prevents us from properly deduplicating files in Debian
webextension packages.

X

-- Package-specific info:


-- Addons package information

-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable'), (300, 'unstable'), (100, 'experimental'), (1, 'experimental-debug')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages firefox depends on:
ii  debianutils               4.8.6.1
ii  fontconfig                2.13.1-2
ii  libasound2                1.1.8-1
ii  libatk1.0-0               2.30.0-2
ii  libc6                     2.28-7
ii  libcairo-gobject2         1.16.0-2
ii  libcairo2                 1.16.0-2
ii  libdbus-1-3               1.12.12-1
ii  libdbus-glib-1-2          0.110-4
ii  libevent-2.1-6            2.1.8-stable-4
ii  libffi6                   3.2.1-9
ii  libfontconfig1            2.13.1-2
ii  libfreetype6              2.9.1-3
ii  libgcc1                   1:8.2.0-20
ii  libgdk-pixbuf2.0-0        2.38.0+dfsg-7
ii  libglib2.0-0              2.58.3-1
ii  libgtk-3-0                3.24.5-1
ii  libjsoncpp1               1.7.4-3
ii  libnspr4                  2:4.20-1
ii  libnss3                   2:3.42-1
ii  libpango-1.0-0            1.42.4-6
ii  libsqlite3-0              3.26.0+fossilbc891ac6b-2
ii  libstartup-notification0  0.12-6
ii  libstdc++6                8.2.0-20
ii  libvpx5                   1.7.0-3
ii  libx11-6                  2:1.6.7-1
ii  libx11-xcb1               2:1.6.7-1
ii  libxcb-shm0               1.13.1-2
ii  libxcb1                   1.13.1-2
ii  libxcomposite1            1:0.4.4-2
ii  libxdamage1               1:1.1.4-3
ii  libxext6                  2:1.3.3-1+b2
ii  libxfixes3                1:5.0.3-1
ii  libxrender1               1:0.9.10-1
ii  libxt6                    1:1.1.5-1
ii  procps                    2:3.3.15-2
ii  zlib1g                    1:1.2.11.dfsg-1

Versions of packages firefox recommends:
ii  libavcodec58  7:4.1-1

Versions of packages firefox suggests:
ii  fonts-lmodern          2.004.5-5
pn  fonts-stix | otf-stix  <none>
ii  libcanberra0           0.30-7
ii  libgssapi-krb5-2       1.17-1
ii  libgtk2.0-0            2.24.32-3
ii  pulseaudio             12.2-3

-- no debconf information