diff options
Diffstat (limited to 'doc/Security.md')
| -rw-r--r-- | doc/Security.md | 32 |
1 files changed, 29 insertions, 3 deletions
diff --git a/doc/Security.md b/doc/Security.md index 956f169..66dbde0 100644 --- a/doc/Security.md +++ b/doc/Security.md @@ -196,6 +196,7 @@ Use modern APIs where required: | Extension storage | `storage.local` | | Long-lived extension communication | `runtime.connect()` / `runtime.Port` | | One-shot extension messages | `runtime.sendMessage()` | +| Selection context menu translation | `menus` (selection context only) | | Dynamic script injection, only if needed | `scripting.executeScript()` | ### 5.4 APIs / Patterns to Avoid @@ -234,6 +235,7 @@ Expected initial permission set: ```text storage +menus ``` Expected host permission: @@ -249,6 +251,8 @@ or the minimum equivalent required by the final Ollama-host design. Page access MAY require content-script match patterns for HTTP/HTTPS pages because translation is initiated by selecting page text. +The `menus` permission is used exclusively for the selection-context translation entry point (context menu "選択したテキストを翻訳"). It MUST NOT be used for any other purpose (no page action items, no tab items, no bookmark items, no launcher items). + Do not add broad privileged permissions for convenience. Every newly introduced permission MUST be justified in code review. @@ -260,11 +264,11 @@ Every newly introduced permission MUST be justified in code review. The system has three primary trust zones. ```text -Untrusted Web Page +Untrusted Web Page / PDF Viewer selection | - | selected text + | selected text (content script or menus.selectionText) v -Content Script +Content Script / menu-controller (background) | | validated extension messages v @@ -324,6 +328,25 @@ The background component owns privileged application operations: - request cancellation; - Ollama response parsing. +### 7.4 Firefox PDF Viewer and Context Menu Input + +Firefox's built-in PDF Viewer is privileged browser UI: + +- The extension MUST NOT attempt to inject content scripts into it. +- The extension MUST NOT access its internal DOM, PDF.js internal objects, + `wrappedJSObject`, `cloneInto`, `exportFunction`, or any Firefox-internal + URI/API to work around the injection restriction. +- PDF translation is provided exclusively through the public `menus` API. + +`menus.OnClickData.selectionText` is UNTRUSTED input: + +- it MUST pass the same validation pipeline as content-script selections + (string type check, trim, empty rejection, maximum length, control + character handling) before being sent to Ollama; +- it MUST NOT be treated as trusted control input or rendered as HTML; +- the translation result MUST be rendered in the Action Popup with + `textContent`-style plain-text rendering only. + --- ## 8. DOM and XSS Rules @@ -743,6 +766,9 @@ Before declaring implementation complete, verify all of the following. - [ ] No deprecated WebExtensions API used when a supported current alternative exists. - [ ] Permissions are minimal. - [ ] No unnecessary `tabs`, `scripting`, `webRequest`, `cookies`, or `nativeMessaging` permission. +- [ ] `menus` permission used only for selection-context translation. +- [ ] No content-script injection or internal DOM access into the Firefox PDF Viewer. +- [ ] `menus.OnClickData.selectionText` validated before use. - [ ] Firefox behavior manually verified in `about:debugging`. ### DOM / Page Boundary |