Upcoming change to extensions that run on 'file' URLs

[Matt Perry]

I recently landed a change to how content scripts work on 'file' URLs that will show up in the next Dev channel release. The change (http://src.chromium.org/viewvc/chrome?view=rev&revision=50737) makes it so that extensions aren't granted access to 'file' URLs by default - the user now has to opt-in manually by visiting the extensions management page.

I'm also working on another change so that developers who want extensions that can affect all pages don't need to enumerate all of the URL patterns and protocol schemes that we support (http://code.google.com/p/chromium/issues/detail?id=47179).

When the first part rolls out to the dev channel this week, two things will change:

- users who are currently depending on using some extensions on file: URLs will lose that functionality until they go to chrome://extensions and opt-in to re-enable.

- users who install new extensions that list file:// URL permissions won't see the full access permission ("All data on your computer and the websites you visit"), but will instead see the all websites permission ("Your data on all websites").

The purpose of these changes is to remove the scary restriction on extensions that interact with 'file' URLs. We want to avoid requiring these extensions to go through a manual review.

[Ilya Sukhar]

Out of curiosity - why was this mechanism chosen instead of giving the user a check box on the install dialog (i.e. they can select between "all data and..." or just "all websites...")?

It's great that the manual process is going away in the future.

--
You received this message because you are subscribed to the Google Groups "Chromium-extensions" group.
To post to this group, send email to chromium-...@chromium.org.
To unsubscribe from this group, send email to chromium-extens...@chromium.org.
For more options, visit this group at http://groups.google.com/a/chromium.org/group/chromium-extensions/?hl=en.

[Matt Perry]

Your idea is not mutually exclusive with what's implemented. We'd still want to give the user a way to change his mind after installing.

However, part of the reason we made this a user option in the first place is that we considered it a power user option. For that reason, we probably don't want to put the option in a prominent place where it is likely to confuse more casual users.

[Daniel Wagner-Hall]

Matt: Could this be auto-enabled (or at least auto-checked, with an
opt-out) for extensions which are loaded unpacked? As this is intended
for testing extensions anyway, it would make my testing process more
convenient, and not affect the privacy/security concerns being
addressed.

[Matt Perry]

Good idea. Makes sense to me. Could you open a bug at crbug.com and assign it to me?

[Daniel Wagner-Hall]

Filed as http://crbug.com/48526 (alas non-@chromiums still can't add
labels/CCs/owners to bugs) - thanks!

[PhistucK]

Done.

☆PhistucK