7 ms·

Here's the proof-of-concept extension by gorhill for anyone interested: https://gist.github.com/gorhill/b0316e35d4e7e4a44df39e8b7fa5ac20 https://gist.github.com

Here's the proof-of-concept extension by gorhill for anyone interested: https://gist.github.com/gorhill/b0316e35d4e7e4a44df39e8b7fa5ac20 https://gist.github.com/gorhill/b0316e35d4e7e4a44df39e8b7fa5.... Looks like his tweets regarding this have also been deleted.

deleted 7y ago
[deleted]
btown 7y ago
If this is as severe as I think it is, you may seriously want to consider taking down this link. Google and @gorhill have likely made things private for a reason.
- jakeogh 7y ago
  Why? The model is wrong. There are always going to be severe bugs in deliberately complicated software. Hiding them behind terms that pretend the issue is about responsible disclosure is much more harmful in the long run because the real problem does not get fixed. Instead, due to a dependence on bad software, the problem can be used to attack speech.
- 0az 7y ago
  Not necessary: between when I loaded this page five minutes ago and when I logged in to comment, the gist was pulled.
kretor 7y ago
This has been reported before, though not for extensions specifically: https://bugs.chromium.org/p/chromium/issues/detail?id=329125 https://bugs.chromium.org/p/chromium/issues/detail?id=329125 The result back then was that the reported behavior is in accordance with the CSP spec, so the issue was closed. Maybe Chrome should change their default CSP for extensions that haven't declared one though to disallow blob: URLs.
doc_gunthrop 7y ago
That link is returning a 404 now, but an archive was posted: https://archive.is/hi5o1 https://archive.is/hi5o1
gorhill 7y ago
I deleted the tweets and Gist just out of respect for the Chromium people's decision to restrict the issue. I personally do not see the point of considering this specific issue particularly severe because the Chrome Web Store already allows extensions to execute remote code in extension context simply by declaring `unsafe-eval` or `unsafe-inline` (or specific remote hosts) -- and one can find such extensions quite easily.[1] If the Chrome Web Store had a policy of "no remote code execution in extension context under any circumstance", then the issue would definitely have been high severity. * * * [1] https://twitter.com/gorhill/status/1139306139072507906 https://twitter.com/gorhill/status/1139306139072507906

deleted 7y ago

[deleted]

btown 7y ago

If this is as severe as I think it is, you may seriously want to consider taking down this link. Google and @gorhill have likely made things private for a reason.

jakeogh 7y ago
Why? The model is wrong. There are always going to be severe bugs in deliberately complicated software. Hiding them behind terms that pretend the issue is about responsible disclosure is much more harmful in the long run because the real problem does not get fixed. Instead, due to a dependence on bad software, the problem can be used to attack speech.
0az 7y ago
Not necessary: between when I loaded this page five minutes ago and when I logged in to comment, the gist was pulled.

kretor 7y ago

This has been reported before, though not for extensions specifically: https://bugs.chromium.org/p/chromium/issues/detail?id=329125 https://bugs.chromium.org/p/chromium/issues/detail?id=329125 The result back then was that the reported behavior is in accordance with the CSP spec, so the issue was closed. Maybe Chrome should change their default CSP for extensions that haven't declared one though to disallow blob: URLs.

doc_gunthrop 7y ago

That link is returning a 404 now, but an archive was posted: https://archive.is/hi5o1 https://archive.is/hi5o1

gorhill 7y ago

I deleted the tweets and Gist just out of respect for the Chromium people's decision to restrict the issue. I personally do not see the point of considering this specific issue particularly severe because the Chrome Web Store already allows extensions to execute remote code in extension context simply by declaring `unsafe-eval` or `unsafe-inline` (or specific remote hosts) -- and one can find such extensions quite easily.[1] If the Chrome Web Store had a policy of "no remote code execution in extension context under any circumstance", then the issue would definitely have been high severity. * * * [1] https://twitter.com/gorhill/status/1139306139072507906 https://twitter.com/gorhill/status/1139306139072507906