firenvim
firenvim copied to clipboard
glacambre
Broken in thunderbird (again...)
Is firenvim broken with thunderbird 92? I just tried to install it and I don't know what's supposed to happen, firenvim works in my browser. Should I suppose to be able to compose messages with firenvim?
Yes it is broken. You can't expect Firenvim to work with any Thunderbird version for now and I don't think you can expect it to work in the future either, as Thunderbird maintainers do not seem to care much about the issues I report or the patches I send them (which is okay, they don't owe me anything).
@glacambre I was looking at getting firenvim working on thunderbird and came across this post.
I was trying to see if I could maybe add some comments on the thunderbird issue to maybe get the team there to care more about the problems and saw that they are asking for clarification. Maybe you could add the information?
Or alternatively I'm happy to try and bisect where the problem came from, but I'm not familiar with mozilla extension development, how would I run the reproducer that you attached in the issue?
@cycomanic In order to run the reproducer, you need to download it and unpack it.
Then, in Thunderbird, click the "hamburger menu" (the three horizontal bars) at the top right corner of the screen. Select "Addons", this should open the Add-ons Manager. Once there, click on the cog icon. Select "Debug Add-On", then "Load Temporary Add-On" and choose manifest.json.
Once the reproducer is loaded, open a compose window (e.g. by clicking on the button to write a new mail). Working thunderbird versions will display a black square, broken thunderbird versions won't.
@cycomanic I saw you did the work of bisecting the problem on bugzilla. Thanks a lot, I'm not sure you'll be able to get Mozilla to do anything about the problem but I appreciate the time you spent of this.
@glacambre it seems thunderbird disabled javascript in compose windows in response to CVE-2021-43528 which will prevent the canvas element from displaying. I suspect that they will not just reenable it. There is the composeScripts API could using that be a solution for firenvim (I don't have much experience with JS and firefox extensions, so I might be completely off).
On 7/25/22 22:23, Jochen Schröder wrote:
@glacambre https://github.com/glacambre it seems thunderbird disabled javascript in compose windows in response to CVE-2021-43528 https://github.com/advisories/GHSA-q4gq-74cq-85g9 which will prevent the canvas element from displaying. I suspect that they will not just reenable it. There is the composeScripts API could using that be a solution for firenvim (I don't have much experience with JS and firefox extensions, so I might be completely off).
Unfortunately the composeScript API is exactly what the reproducer uses:
$tar -xvf repro.tar thunderbird_repro/ thunderbird_repro/background.js thunderbird_repro/manifest.json thunderbird_repro/compose.js $cd thunderbird_repro $cat background.js browser.composeScripts.register({ js: [{ file: "compose.js" }], }); $cat compose.js
try { document.body.innerText += "compose script loaded"; const canvas = document.createElement("canvas"); document.body.appendChild(canvas); const context = canvas.getContext("2d"); context.fillStyle = "black"; context.fillRect(10, 10, 100, 100); // const txt = document.body.innerHTML; // document.body.innerText += txt; } catch (e) { document.body.innerText += "failure: " + e.toString(); }
I don't quite understand how disabling JS in the compose window can prevent the canvas from working while leaving DOM manipulation fully functional (we know DOM manipulation works because we get the "compose script loaded" message in the compose window). Very puzzling...
On 7/25/22 22:23, Jochen Schröder wrote: @glacambre https://github.com/glacambre it seems thunderbird disabled javascript in compose windows in response to CVE-2021-43528 https://github.com/advisories/GHSA-q4gq-74cq-85g9 which will prevent the canvas element from displaying. I suspect that they will not just eenable it. There is the composeScripts API could using that be a solution for firenvim (I don't have much experience with JS and firefox extensions, so I might be completely off).
Unfortunately the composeScript API is exactly what the reproducer uses:
Yes I just realised that after reading some more as well.
I don't quite understand how disabling JS in the compose window can prevent the canvas from working while leaving DOM manipulation fully functional (we know DOM manipulation works because we get the "compose script loaded" message in the compose window). Very puzzling...
The way I understand it after a bit of reading and with my (very limited) understanding of JS is, that the canvas element requires JS to render, that is not happening, so the canvas element is created by executing compose.js via the composeScripts api, but the canvas is not rendered. If I change compose.js to:
try {
document.body.innerText += "compose script loaded2";
const canvas = document.createElement("canvas");
//document.body.appendChild(canvas);
const context = canvas.getContext("2d");
context.fillStyle = "black";
context.fillRect(10, 10, 100, 100);
// const txt = document.body.innerHTML;
// document.body.innerText += txt;
const imgUrl = canvas.toDataURL();
const img = document.createElement('img');
img.src = imgUrl;
document.body.appendChild(img)
} catch (e) {
document.body.innerText += "failure: " + e.toString();
}
I can see the black rectangle. I'm not sure if that helps for firenvim though?
I'm not sure if that helps for firenvim though?
No, unfortunately this doesn't help as canvas.toDataURL() and img.src = imgUrl are far too slow for interactive use. The solution probably is to run the firenvim script in an iframe that has a webextension context, but this doesn't work either due to https://bugzilla.mozilla.org/show_bug.cgi?id=1707449 ...