From 373c121342554206b037d3155a5dae54b6ebdcdf Mon Sep 17 00:00:00 2001
From: Mike Conley <mconley@mozilla.com>
Date: Tue, 8 Nov 2022 14:51:41 +0000
Subject: [PATCH] Bug 1798814 - Prevent non-extension buttons from entering the
 AREA_ADDONS area. r=cmkm

Differential Revision: https://phabricator.services.mozilla.com/D161096
---
 .../customizableui/CustomizableUI.jsm         |  8 ++
 .../customizableui/test/browser.ini           |  1 +
 .../test/browser_addons_area.js               | 76 +++++++++++++++++++
 3 files changed, 85 insertions(+)
 create mode 100644 browser/components/customizableui/test/browser_addons_area.js

diff --git a/browser/components/customizableui/CustomizableUI.jsm b/browser/components/customizableui/CustomizableUI.jsm
index c5e98d06e7f1..9a2b2117a13d 100644
--- a/browser/components/customizableui/CustomizableUI.jsm
+++ b/browser/components/customizableui/CustomizableUI.jsm
@@ -3381,6 +3381,14 @@ var CustomizableUIInternal = {
     ) {
       return false;
     }
+
+    if (
+      aArea == CustomizableUI.AREA_ADDONS &&
+      !CustomizableUI.isWebExtensionWidget(aWidgetId)
+    ) {
+      return false;
+    }
+
     let placement = this.getPlacementOfWidget(aWidgetId);
     // Items in the palette can move, and items can move within their area:
     if (!placement || placement.area == aArea) {
diff --git a/browser/components/customizableui/test/browser.ini b/browser/components/customizableui/test/browser.ini
index 8a88d3a5bfa6..f44ba052a187 100644
--- a/browser/components/customizableui/test/browser.ini
+++ b/browser/components/customizableui/test/browser.ini
@@ -124,6 +124,7 @@ skip-if = verify
 [browser_1702200_PanelMultiView_header_separator.js]
 [browser_1795260_searchbar_overflow_toolbar.js]
 tags = overflowable-toolbar
+[browser_addons_area.js]
 [browser_allow_dragging_removable_false.js]
 [browser_bookmarks_toolbar_collapsed_restore_default.js]
 [browser_bookmarks_toolbar_shown_newtab.js]
diff --git a/browser/components/customizableui/test/browser_addons_area.js b/browser/components/customizableui/test/browser_addons_area.js
new file mode 100644
index 000000000000..533d48b238ea
--- /dev/null
+++ b/browser/components/customizableui/test/browser_addons_area.js
@@ -0,0 +1,76 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+/**
+ * Test that widgets provided by extensions can be added to the
+ * ADDONS area, but all other widgets cannot.
+ */
+add_task(async function test_only_extension_widgets_in_addons_area() {
+  registerCleanupFunction(async () => {
+    await CustomizableUI.reset();
+  });
+
+  Assert.ok(
+    !CustomizableUI.canWidgetMoveToArea(
+      "home-button",
+      CustomizableUI.AREA_ADDONS
+    ),
+    "Cannot move a built-in button to the ADDONS area."
+  );
+
+  // Now double-check that we cannot accidentally default a non-extension
+  // widget into the ADDONS area.
+  const kTestDynamicWidget = "a-test-widget";
+  CustomizableUI.createWidget({
+    id: kTestDynamicWidget,
+    label: "Test widget",
+    defaultArea: CustomizableUI.AREA_ADDONS,
+  });
+  Assert.equal(
+    CustomizableUI.getPlacementOfWidget(kTestDynamicWidget),
+    null,
+    "An attempt to put a non-extension widget into the ADDONS area by default should fail."
+  );
+  CustomizableUI.destroyWidget(kTestDynamicWidget);
+
+  const kWebExtensionButtonID1 = "a-test-extension-button";
+
+  CustomizableUI.createWidget({
+    id: kWebExtensionButtonID1,
+    label: "Test extension widget",
+    defaultArea: CustomizableUI.AREA_NAVBAR,
+    webExtension: true,
+  });
+
+  Assert.ok(
+    CustomizableUI.canWidgetMoveToArea(
+      kWebExtensionButtonID1,
+      CustomizableUI.AREA_ADDONS
+    ),
+    "Can move extension button to the addons area."
+  );
+
+  CustomizableUI.destroyWidget(kWebExtensionButtonID1);
+
+  // Now check that extension buttons can default to the ADDONS area, if need
+  // be.
+
+  const kWebExtensionButtonID2 = "a-test-extension-button-2";
+
+  CustomizableUI.createWidget({
+    id: kWebExtensionButtonID2,
+    label: "Test extension widget 2",
+    defaultArea: CustomizableUI.AREA_ADDONS,
+    webExtension: true,
+  });
+
+  Assert.equal(
+    CustomizableUI.getPlacementOfWidget(kWebExtensionButtonID2)?.area,
+    CustomizableUI.AREA_ADDONS,
+    "An attempt to put an extension widget into the ADDONS area by default should work."
+  );
+
+  CustomizableUI.destroyWidget(kWebExtensionButtonID2);
+});