Thunderbird 155 breaks packaged script loading via `WindowListener` and `Services.scriptloader.loadSubScript()`

[RealRaven2000]

Summary

Thunderbird 155 blocks jar:/file: URLs passed to
Services.scriptloader.loadSubScript(), breaking legacy add-ons that use the
WindowListener Experiment to inject chrome-window scripts.

Upstream reference: Mozilla Bug 2061809.

Impact

quickFilters cannot load WindowListener-managed scripts from its packaged XPI,
including scripts registered with:

• registerDefaultPrefs()
• registerWindow()
• startup script loading
• shutdown script loading

This also affects direct calls to Services.scriptloader.loadSubScript() when the script URL resolves to a packaged jar:/file: URI - including all chrome:// scripts. WindowListener is one widely used abstraction that exposes the breakage.

The same patterns are used by QuickFolders, SmartTemplates, and FiltaQuilla.

Proposed short-term fix

Keep the existing WindowListener API and all add-on registration calls unchanged.

Only update the WindowListener Experiment implementation to load scripts via:

Services.scriptloader.loadSubScriptWithOptions(url, {
  target,
  charset: "UTF-8",
  allowUnsafeURL: true,
});

[RealRaven2000]

Here is the complete list of exceptions in Thunderbird Daily 155.0a1 (2026-08-12) (64-bit) on startup:

uncaught exception: Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/quickFilter-prefs.js
Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/qFi-messenger.js implementation.js:729
Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/qFi-3pane.js implementation.js:729
Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/qFi-message.js implementation.js:729
uncaught exception: Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/quickFilter-prefs.js
Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/qFi-messenger.js implementation.js:729
Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/qFi-3pane.js implementation.js:729
Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/qFi-message.js implementation.js:729

and here is a list of error when opening message filters dialog:

Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/qFi-filterlist.js implementation.js:729

and opening the filter editor:

Trying to load untrusted URI.: jar:file:///I:/Thunderbird_Profiles/in5mky4p.Tb91-fix/extensions/quickFilters@axelg.com.xpi!/chrome/content/scripts/qFi-filterEditor.js implementation.js:729

[RealRaven2000]

Fix: using loadSubScriptWithOptions() to force unsafe URL. This is to fix the Add-on not loading anymore in Thunderbird 155 Daily because untrusted URI issues caused by Bug 1974213 "Don't allow file: and jar: schemes in Services.scriptloader.loadSubScript"