[mime_handler] Validate URL during MIME handler fallback re-navigation [chromium/src : main]
Andy Phan (Gerrit)
New activity on the change![]( "Open in Gerrit")
Related details
- Maksim Sisov
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Maksim Sisov (Gerrit)
Maksim Sisov added 1 comment![]( "Open in Gerrit")
if (stream_manager && stream_manager->IsPendingNativeFallback(I wonder if this results in 2 abortAndFallbacks.. eg cached body was stored for url A, 3p extension aborted, server redirected to url B, 3p extension loads again but for url B now, server returns body for url B now, built-in extension now loads.
PS I have a pending task to avoid reloading of the embedder and rather reload the mime handler iframe instead avoiding any network requests. That must fix both problems.
Related details
- Andy Phan
Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Andy Phan (Gerrit)
Andy Phan added 1 comment![]( "Open in Gerrit")
if (stream_manager && stream_manager->IsPendingNativeFallback(I wonder if this results in 2 abortAndFallbacks.. eg cached body was stored for url A, 3p extension aborted, server redirected to url B, 3p extension loads again but for url B now, server returns body for url B now, built-in extension now loads.
PS I have a pending task to avoid reloading of the embedder and rather reload the mime handler iframe instead avoiding any network requests. That must fix both problems.
I believe so, but this is probably the secure and correct behavior. We can't splice A's cached body into B's navigation, but we also cannot assume B should bypass the 3p extension. This is also likely a rare edge case and won't have large performance impact.
Unless the task is small and easy to merge, it may be better to proceed with this smaller security fix and merge back.
Related details
- Maksim Sisov
Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Maksim Sisov (Gerrit)
Maksim Sisov voted and added 1 comment![]( "Open in Gerrit")
Votes added by Maksim Sisov
| Code-Review | +1 |
1 comment
if (stream_manager && stream_manager->IsPendingNativeFallback(Andy PhanI wonder if this results in 2 abortAndFallbacks.. eg cached body was stored for url A, 3p extension aborted, server redirected to url B, 3p extension loads again but for url B now, server returns body for url B now, built-in extension now loads.
PS I have a pending task to avoid reloading of the embedder and rather reload the mime handler iframe instead avoiding any network requests. That must fix both problems.
I believe so, but this is probably the secure and correct behavior. We can't splice A's cached body into B's navigation, but we also cannot assume B should bypass the 3p extension. This is also likely a rare edge case and won't have large performance impact.
Unless the task is small and easy to merge, it may be better to proceed with this smaller security fix and merge back.
- Andy Phan
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Andy Phan (Gerrit)
Andy Phan added 1 comment![]( "Open in Gerrit")
+thestig@ for //chrome
+rdevlin.cronin@ for //extensions/browser/api/mime_handler/mime_handler_api_unittest.cc
Related details
- Devlin Cronin
- Lei Zhang
Code-Coverage
Code-Owners
Code-Review
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Lei Zhang (Gerrit)
Lei Zhang voted and added 2 comments![]( "Open in Gerrit")
Votes added by Lei Zhang
| Code-Review | +1 |
2 comments
reload was redirected (e.g. HTTP 302) to a different origin, the
attacker's cached body could be spliced under the victim's URL, leadingMaybe this can be "a hostile 3P extension" to clarify who the attacker is?
EXPECT_GT(page_count, 1);Just check for exactly 3 pages here?
Related details
- Andy Phan
- Devlin Cronin
Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |