Bug 1845752. r=ckerschb

Differential Revision: https://phabricator.services.mozilla.com/D186676

toolkit/components/search/OpenSearchEngine.sys.mjs

@@ -144,7 +144,12 @@ export class OpenSearchEngine extends SearchEngine {
 
     lazy.logConsole.debug("_install: Downloading engine from:", loadURI.spec);
 
-    var chan = lazy.SearchUtils.makeChannel(loadURI);
+    var chan = lazy.SearchUtils.makeChannel(
+      loadURI,
+      // OpenSearchEngine is loading a definition file for a search engine,
+      // TYPE_DOCUMENT captures that load best
+      Ci.nsIContentPolicy.TYPE_DOCUMENT
+    );
 
     if (this._engineToUpdate && chan instanceof Ci.nsIHttpChannel) {
       var lastModified = this._engineToUpdate.getAttr("updatelastmodified");

toolkit/components/search/SearchEngine.sys.mjs

@@ -805,7 +805,10 @@ export class SearchEngine {
           this._hasPreferredIcon = isPreferred;
         };
 
-        let chan = lazy.SearchUtils.makeChannel(uri);
+        let chan = lazy.SearchUtils.makeChannel(
+          uri,
+          Ci.nsIContentPolicy.TYPE_IMAGE
+        );
         let listener = new lazy.SearchUtils.LoadListener(
           chan,
           /^image\//,

toolkit/components/search/SearchUtils.sys.mjs

@@ -248,19 +248,24 @@ export var SearchUtils = {
    *
    * @param {string|nsIURI} url
    *   The URL string from which to create an nsIChannel.
+   * @param {nsIContentPolicy} contentPolicyType
+   *   The type of document being loaded.
    * @returns {nsIChannel}
    *   an nsIChannel object, or null if the url is invalid.
    */
-  makeChannel(url) {
+  makeChannel(url, contentPolicyType) {
+    if (!contentPolicyType) {
+      throw new Error("makeChannel called with invalid content policy type");
+    }
     try {
       let uri = typeof url == "string" ? Services.io.newURI(url) : url;
       return Services.io.newChannelFromURI(
         uri,
         null /* loadingNode */,
-        Services.scriptSecurityManager.getSystemPrincipal(),
+        Services.scriptSecurityManager.createNullPrincipal({}),
         null /* triggeringPrincipal */,
         Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL,
-        Ci.nsIContentPolicy.TYPE_OTHER
+        contentPolicyType
       );
     } catch (ex) {}
 

toolkit/components/search/tests/xpcshell/data/iconsRedirect.sjs

@@ -10,7 +10,7 @@ function handleRequest(request, response) {
   response.setStatusLine("1.1", 302, "Moved");
   if (request.queryString == "type=invalid") {
     response.setHeader("Content-Type", "image/png", false);
-    response.setHeader("Location", "engine.xml", false);
+    response.setHeader("Location", "/head_search.js", false);
   } else {
     response.setHeader("Content-Type", "text/html", false);
     response.setHeader("Location", "remoteIcon.ico", false);

toolkit/components/search/tests/xpcshell/test_opensearch_icons_invalid.js

@@ -12,9 +12,11 @@ add_task(async function setup() {
 });
 
 add_task(async function test_installedresourceicon() {
+  // Attempts to load a resource:// url as an icon.
   let engine1 = await SearchTestUtils.promiseNewSearchEngine({
     url: `${gDataUrl}opensearch/resourceicon.xml`,
   });
+  // Attempts to load a chrome:// url as an icon.
   let engine2 = await SearchTestUtils.promiseNewSearchEngine({
     url: `${gDataUrl}opensearch/chromeicon.xml`,
   });
@@ -32,12 +34,13 @@ add_task(async function test_installedhttpplace() {
 
   // The easiest way to test adding the icon is via a generated xml, otherwise
   // we have to somehow insert the address of the server into it.
+  // Attempts to load a non-image page into an image icon.
   let engine = await SearchTestUtils.promiseNewSearchEngine({
     url:
       `${gDataUrl}data/engineMaker.sjs?` +
       JSON.stringify({
         baseURL: gDataUrl,
-        image: "opensearch/resourceicon.xml",
+        image: "head_search.js",
         name: "invalidicon",
         method: "GET",
       }),

toolkit/components/search/tests/xpcshell/test_webextensions_install.js

@@ -5,6 +5,8 @@
 
 const { promiseShutdownManager, promiseStartupManager } = AddonTestUtils;
 
+let gBaseUrl;
+
 async function getEngineNames() {
   let engines = await Services.search.getEngines();
   return engines.map(engine => engine._name);
@@ -13,6 +15,8 @@ async function getEngineNames() {
 add_task(async function setup() {
   let server = useHttpServer();
   server.registerContentType("sjs", "sjs");
+  gBaseUrl = `http://localhost:${server.identity.primaryPort}/`;
+
   await SearchTestUtils.useTestEngines("test-extensions");
   await promiseStartupManager();
 
@@ -132,7 +136,7 @@ add_task(async function test_load_favicon_invalid() {
   // User installs a new search engine
   let extension = await SearchTestUtils.installSearchExtension(
     {
-      favicon_url: `${gDataUrl}engine.xml`,
+      favicon_url: `${gBaseUrl}/head_search.js`,
     },
     { skipUnload: true }
   );