Bug 2073916 - Run the snapshot manager in a sandbox

src/firefox/bidi.ts

@@ -158,19 +158,21 @@ export class BiDiFacade extends EventEmitter<FirefoxEventMap> {
 
   async evaluate<T = unknown>(
     context: BrowsingContext.BrowsingContext,
-    expression: string
+    expression: string,
+    sandbox?: string
   ): Promise<T> {
-    return remoteValueToNative(await this.evaluateRaw(expression, context)) as T;
+    return remoteValueToNative(await this.evaluateRaw(context, expression, sandbox)) as T;
   }
 
   async evaluateRaw(
     context: BrowsingContext.BrowsingContext,
-    expression: string
+    expression: string,
+    sandbox?: string
   ): Promise<Script.RemoteValue> {
     const result = await this.sendCommand('script.evaluate', {
       expression,
       awaitPromise: true,
-      target: { context },
+      target: { context, sandbox },
     });
     if (result.type === 'success') {
       return result.result;
@@ -183,21 +185,25 @@ export class BiDiFacade extends EventEmitter<FirefoxEventMap> {
   async callFunction<T = unknown>(
     context: BrowsingContext.BrowsingContext,
     functionDeclaration: string,
-    args: Script.LocalValue[]
+    args: Script.LocalValue[],
+    sandbox?: string
   ): Promise<T> {
-    return remoteValueToNative(await this.callFunctionRaw(context, functionDeclaration, args)) as T;
+    return remoteValueToNative(
+      await this.callFunctionRaw(context, functionDeclaration, args, sandbox)
+    ) as T;
   }
 
   async callFunctionRaw(
     context: BrowsingContext.BrowsingContext,
     functionDeclaration: string,
-    args: Script.LocalValue[]
+    args: Script.LocalValue[],
+    sandbox?: string
   ): Promise<Script.RemoteValue> {
     const result = await this.sendCommand('script.callFunction', {
       functionDeclaration,
       arguments: args,
       awaitPromise: true,
-      target: { context },
+      target: { context, sandbox },
     });
     if (result.type === 'success') {
       return result.result;

src/firefox/index.ts

@@ -144,7 +144,7 @@ export class FirefoxClient {
    * native value; throws on a script exception.
    */
   async evaluate(expression: string): Promise<unknown> {
-    return await this.getBidi().evaluate(expression, this.getContext());
+    return await this.getBidi().evaluate(this.getContext(), expression);
   }
 
   // UID-based input methods

src/firefox/snapshot/manager.ts

@@ -14,6 +14,8 @@ import type { Snapshot, SnapshotJson, InjectedScriptResult } from './types.js';
 import { formatSnapshotTree } from './formatter.js';
 import { UidResolver } from './resolver.js';
 
+export const SNAPSHOT_MANAGER_SANDBOX = 'snapshot-manager';
+
 /**
  * Options for snapshot creation
  */
@@ -218,7 +220,8 @@ export class SnapshotManager {
         return window.__createSnapshot(nextElementId, options);
       }
       `,
-      [nativeToLocalValue(nextElementId), nativeToLocalValue(options || {})]
+      [nativeToLocalValue(nextElementId), nativeToLocalValue(options || {})],
+      SNAPSHOT_MANAGER_SANDBOX
     );
 
     return result;

src/firefox/snapshot/resolver.ts

@@ -5,6 +5,7 @@
  */
 
 import type { BrowsingContext, Script } from 'webdriver-bidi-protocol';
+import { SNAPSHOT_MANAGER_SANDBOX } from './manager.js';
 import { BiDiFacade } from '../bidi.js';
 import { nativeToLocalValue } from '../../utils/local-value.js';
 import { logDebug } from '../../utils/logger.js';
@@ -26,7 +27,7 @@ export class UidResolver {
    */
   async clear(context: BrowsingContext.BrowsingContext): Promise<void> {
     try {
-      await this.bidi.evaluate(CLEAR_SCRIPT, context);
+      await this.bidi.evaluate(context, CLEAR_SCRIPT, SNAPSHOT_MANAGER_SANDBOX);
       logDebug('Snapshot UIDs cleared');
     } catch {
       logDebug('Unable to clear snapshot UIDs (page may be navigating)');
@@ -40,9 +41,12 @@ export class UidResolver {
     context: BrowsingContext.BrowsingContext,
     uid: string
   ): Promise<string> {
-    const selector = await this.bidi.callFunction<string | null>(context, SELECTOR_SCRIPT, [
-      nativeToLocalValue(uid),
-    ]);
+    const selector = await this.bidi.callFunction<string | null>(
+      context,
+      SELECTOR_SCRIPT,
+      [nativeToLocalValue(uid)],
+      SNAPSHOT_MANAGER_SANDBOX
+    );
     if (!selector) {
       throw new Error(notFoundMessage(uid));
     }
@@ -57,9 +61,12 @@ export class UidResolver {
     context: BrowsingContext.BrowsingContext,
     uid: string
   ): Promise<Script.SharedReference> {
-    const element = await this.bidi.callFunctionRaw(context, RESOLVE_SCRIPT, [
-      nativeToLocalValue(uid),
-    ]);
+    const element = await this.bidi.callFunctionRaw(
+      context,
+      RESOLVE_SCRIPT,
+      [nativeToLocalValue(uid)],
+      SNAPSHOT_MANAGER_SANDBOX
+    );
     if (element?.type !== 'node' || !element.sharedId) {
       throw new Error(notFoundMessage(uid));
     }

tests/firefox/snapshot/resolver.test.ts

@@ -4,6 +4,7 @@
 
 import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { BrowsingContext, Script } from 'webdriver-bidi-protocol';
+import { SNAPSHOT_MANAGER_SANDBOX } from '@/firefox/snapshot/manager';
 import { UidResolver } from '@/firefox/snapshot/resolver.js';
 import { nativeToLocalValue } from '@/utils/local-value';
 
@@ -33,9 +34,12 @@ describe('UidResolver', () => {
       const element = await resolver.resolveUidToElement(CONTEXT, 'e0');
 
       expect(element).toEqual({ sharedId: 'shared-1' });
-      expect(mockBiDi.callFunctionRaw).toHaveBeenCalledWith(CONTEXT, expect.any(String), [
-        nativeToLocalValue('e0'),
-      ]);
+      expect(mockBiDi.callFunctionRaw).toHaveBeenCalledWith(
+        CONTEXT,
+        expect.any(String),
+        [nativeToLocalValue('e0')],
+        SNAPSHOT_MANAGER_SANDBOX
+      );
     });
 
     it('should throw when the page has no element for the UID', async () => {
@@ -68,7 +72,7 @@ describe('UidResolver', () => {
       await resolver.clear(CONTEXT);
 
       expect(mockBiDi.evaluate).toHaveBeenCalledOnce();
-      expect(mockBiDi.evaluate.mock.calls[0][0]).toContain('__clearUidRegistry');
+      expect(mockBiDi.evaluate.mock.calls[0][1]).toContain('__clearUidRegistry');
     });
 
     it('should not throw when the page cannot be reached', async () => {

tsconfig.json

@@ -26,7 +26,6 @@
     "noUncheckedIndexedAccess": true,
     "allowUnusedLabels": false,
     "allowUnreachableCode": false,
-    "exactOptionalPropertyTypes": true,
     "noImplicitOverride": true,
     "useUnknownInCatchVariables": true,
     "isolatedModules": true