Bug: Unable to load `resource:///` favicons in `about:home`/`about:newtab` when `browser.newtabpage.activity-stream.improvesearch.handoffToAwesomebar` is false
Status: RESOLVED
Priority: --
Resolution: WONTFIX
Created: 2024-08-25 18:52:48+00:00
Resolved: 2024-09-02 18:04:04+00:00

I don't really remember why I did this in the first place, but I think it's a combination of the default DDG search engine not sending requests via POST and the OpenSearch DDG favicon appearing blurry under certain circumstances at one point. Anyway, this was tested on 129.0 and 128.1.0esr.

Prerequisite:

`browser.newtabpage.activity-stream.improvesearch.handoffToAwesomebar` is set to false.


STR:

1. Visit `https://html.duckduckgo.com/html/` and add its OpenSearch search engine.
2. Directly modify the OpenSearch search engine's `_iconURL` value in `search.json.mozlz4` using [mozlz4-edit](https://addons.mozilla.org/en-US/firefox/addon/mozlz4-edit/).
3. In 128 or before, change the value of `_iconURL` to either `moz-extension://[webext-uuid-for-ddg@search.mozilla.org]/favicon.ico` or `resource://search-extensions/ddg/favicon.ico`. The value of `[webext-uuid-for-ddg@search.mozilla.org]` can be obtained by checking the value of `extensions.webextensions.uuids` in each profile.
4. In 129+, you will need to change the value of `_iconURL` to `resource:///defaults/settings/main/search-config-icons/a06dc3fd-4bdb-41f3-2ebc-4cbed06a9bd3` because the favicons were removed in bug 1895873.
5. Save the `search.json.mozlz4` somewhere else without overwriting it, and close Firefox.
6. Replace the old `search.json.mozlz4` with the new one.
(6a. In ESR builds, you can also set the value of `IconURL` for new search engines using the [SearchEngines](https://mozilla.github.io/policy-templates/#searchengines-this-policy-is-only-available-on-the-esr) policy.)
7. Start Firefox.
8. Visit `about:home`/`about:newtab` and type anything into the search box.

Expected Behavior:

The search widget? should pop out and you can see the customized DDG OpenSearch's favicon.

Actual Behavior:

The customized DDG OpenSearch's favicon failed to load when it's pointing to a `resource:///` link. Browser console contains errors such as 

```
Security Error: Content at about:home may not load or link to resource:///defaults/settings/main/search-config-icons/a06dc3fd-4bdb-41f3-2ebc-4cbed06a9bd3.
```

or

```
Security Error: Content at about:newtab may not load or link to resource:///defaults/settings/main/search-config-icons/a06dc3fd-4bdb-41f3-2ebc-4cbed06a9bd3.
```

Favicons pointing to `resource:///` links are correctly loaded in both the urlbar and the search bar.


After [some](https://searchfox.org/mozilla-central/rev/8ac474648e1aa1738bee5cb13ef9b7dbf8d9bc69/browser/components/search/jar.mn#10,14) [investigation](https://searchfox.org/mozilla-central/rev/e5b80e9a8fc116023931fd1bc80d0824b232f108/layout/style/jar.mn#34-35), I believe the fix can be as simple as adding something like

```
% resource search-config-icons resource://app/defaults/settings/main/search-config-icons/ contentaccessible=yes
```
to _somewhere_, although I am not sure exactly where. Flipping `security.all_resource_uri_content_accessible` and restarting Firefox also works as a workaround, but again I am not sure if I actually wanted to [do that](https://bugzilla.mozilla.org/show_bug.cgi?id=863246#c77) given the security implications.