#!/usr/bin/env bash # .SYNOPSIS: # Lists installed Firefox WebExtension permissions with human-readable descriptions. # .DESCRIPTION: # Scans all Firefox profile directories under the current user's home, reads each extension's manifest.json # directly from its .xpi archive, and displays both declared API permissions and host-specific access # patterns translated to friendly names. # .EXECUTION: # Requires bash 4+, unzip, and jq. If missing, the script will attempt to install via the detected package manager. # No root privileges needed except during dependency installation. # Color codes RED="\033[0;31m" # Error YELLOW="\033[1;33m" # Permissions MAGENTA="\033[0;35m" # Profile header CYAN="\033[0;36m" # Extension name NC="\033[0m" # No Color # List of required commands required=(unzip jq) missing=() for cmd in "${required[@]}"; do if ! command -v "$cmd" &>/dev/null; then missing+=("$cmd") fi done # Attempt installation if any missing if (( ${#missing[@]} > 0 )); then echo -e "${YELLOW}Installing missing dependencies: ${missing[*]}${NC}" # Determine package manager and install if command -v apt-get &>/dev/null; then sudo apt-get update sudo apt-get install -y "${missing[@]}" elif command -v dnf &>/dev/null; then sudo dnf install -y "${missing[@]}" elif command -v yum &>/dev/null; then sudo yum install -y "${missing[@]}" elif command -v pacman &>/dev/null; then sudo pacman -Sy --noconfirm "${missing[@]}" elif command -v zypper &>/dev/null; then sudo zypper install -y "${missing[@]}" else echo -e "${RED}Error: No supported package manager found. Install: ${missing[*]} manually.${NC}" exit 1 fi # Re-check installation for cmd in "${missing[@]}"; do if ! command -v "$cmd" &>/dev/null; then echo -e "${RED}Error: Failed to install $cmd. Please install it manually.${NC}" exit 1 fi done fi # Map raw permission keys to human-readable descriptions declare -A permissionMap=( [activeTab]="Access to the active tab" [alarms]="Use browser alarms" [background]="Background page support" [bookmarks]="Manage bookmarks" [browsingData]="Modify browsing data" [clipboardRead]="Read from the clipboard" [clipboardWrite]="Write to the clipboard" [contentSettings]="Modify content settings" [contextMenus]="Add items to context menus" [cookies]="Access cookies" [debugger]="Use the debugging API" [declarativeContent]="Modify page content proactively" [declarativeNetRequest]="Declaratively modify network requests" [dns]="Resolve DNS entries" [downloads]="Manage downloads" [events]="Use event APIs" [find]="Search for text on a page" [geolocation]="Access your location" [history]="Read/modify browsing history" [identity]="Authenticate and identify the user" [idle]="Detect idle state" [management]="Manage browser extensions" [menus]="Modify browser menus" [nativeMessaging]="Communicate with native applications" [notifications]="Show notifications" [pageCapture]="Save pages as MHTML" [privacy]="Modify privacy settings" [proxy]="Manage proxy settings" [runtime]="Interact with the extension runtime" [sessions]="Manage browser sessions" [storage]="Use local storage" [tabs]="Access browser tabs" [theme]="Modify browser theme" [topSites]="Access top sites" [unlimitedStorage]="Store unlimited data" [webNavigation]="Monitor web navigation" [webRequest]="Intercept web requests" [webRequestBlocking]="Block or modify web requests" [""]="Access all websites" ) # Locate Firefox profiles PROFILE_ROOT="$HOME/.mozilla/firefox" if [[ ! -d "$PROFILE_ROOT" ]]; then echo -e "${RED}Error: Firefox profiles directory not found: $PROFILE_ROOT${NC}" exit 1 fi shopt -s nullglob for profile in "$PROFILE_ROOT"/*.default*; do [[ -d "$profile" ]] || continue echo -e "${MAGENTA}Profile: $(basename "$profile")${NC}" ext_dir="$profile/extensions" if [[ ! -d "$ext_dir" ]]; then echo -e " ${YELLOW}No extensions directory found${NC}" continue fi files=("$ext_dir"/*.xpi) if [[ ${#files[@]} -eq 0 ]]; then echo -e " ${YELLOW}No .xpi files found${NC}" continue fi for xpi in "${files[@]}"; do # Read manifest.json from xpi manifest_json=$(unzip -p "$xpi" manifest.json 2>/dev/null) || { echo -e " ${RED}Failed to read manifest.json in $(basename "$xpi")${NC}" continue } # Parse name ext_name=$(jq -r '.name // "Unknown"' <<< "$manifest_json") echo -e " ${CYAN}Extension: $ext_name${NC}" # Gather permissions mapfile -t raw_perms < <( jq -r '.permissions? // [] | .[]' <<< "$manifest_json" jq -r '.host_permissions? // [] | .[]' <<< "$manifest_json" ) if (( ${#raw_perms[@]} > 0 )); then echo -e " ${YELLOW}Permissions:${NC}" for perm in "${raw_perms[@]}"; do if [[ -n "${permissionMap[$perm]}" ]]; then friendly=${permissionMap[$perm]} elif [[ "$perm" =~ ^(\*|https?://) ]]; then friendly="Host access to $perm" else friendly=$perm fi echo -e " - $friendly" done else echo -e " ${YELLOW}Permissions: None or not specified${NC}" fi done echo done

PoC video

Description