224441 2021-04-12 10:16:22 -0700 Runtime disable plugins and replacements 2021-10-27 12:57:43 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=224453 https://bugs.webkit.org/show_bug.cgi?id=224451 https://bugs.webkit.org/show_bug.cgi?id=224449 InRadar P2 Normal --- 224449 224451 224453 1 achristensen achristensen cdumez darin ggaren sam webkit-bug-importer oldest_to_newest 1749264 0 achristensen 2021-04-12 10:16:22 -0700 Runtime disable plugins and replacements 1749268 1 425763 achristensen 2021-04-12 10:20:23 -0700 Created attachment 425763 Patch 1749274 2 sam 2021-04-12 10:31:05 -0700 Disabling plugins seems like a good idea, but I am not totally clear on the motivation for disabling replacement. What is the goal with disabling replacement and does it have to be linked to this (e.g. do we only do replacement if plugins are enabled?) 1749275 3 425763 sam 2021-04-12 10:31:51 -0700 Comment on attachment 425763 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=425763&action=review > Source/WebKitLegacy/mac/WebView/WebPreferences.mm:903 > - (void)setPlugInsEnabled:(BOOL)flag > { > - [self _setBoolValue: flag forKey: WebKitPluginsEnabledPreferenceKey]; > } This seems like a step beyond deprecation. This makes it so that apps that enable the feature won't work. 1749279 4 achristensen 2021-04-12 10:43:59 -0700 (In reply to Sam Weinig from comment #2) > Disabling plugins seems like a good idea, but I am not totally clear on the > motivation for disabling replacement. What is the goal with disabling > replacement and does it have to be linked to this (e.g. do we only do > replacement if plugins are enabled?) The replacement code is related to the existence of plugins. We could do it in a separate patch, but we also want to do it right now so I didn't see a reason to. It is old code that exists to be compatible with websites of more than a decade ago, which we believe have updated since Flash support has waned. (In reply to Sam Weinig from comment #3) > Comment on attachment 425763 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=425763&action=review > > > Source/WebKitLegacy/mac/WebView/WebPreferences.mm:903 > > - (void)setPlugInsEnabled:(BOOL)flag > > { > > - [self _setBoolValue: flag forKey: WebKitPluginsEnabledPreferenceKey]; > > } > > This seems like a step beyond deprecation. This makes it so that apps that > enable the feature won't work. That is correct. WebPreferences is already deprecated. We will look at seed feedback, but we intend to remove all our NPAPI code if this goes smoothly. 1749315 5 achristensen 2021-04-12 12:08:54 -0700 After some internal discussion, we have decided to proceed with this, but split it into three changes: 1. Changing WKWebView to be unable to load plug ins. 2. Changing WebView to be unable to load plug ins. 3. Disabling the plug in replacements. 1749316 6 sam 2021-04-12 12:15:26 -0700 (In reply to Alex Christensen from comment #4) > (In reply to Sam Weinig from comment #2) > > Disabling plugins seems like a good idea, but I am not totally clear on the > > motivation for disabling replacement. What is the goal with disabling > > replacement and does it have to be linked to this (e.g. do we only do > > replacement if plugins are enabled?) > The replacement code is related to the existence of plugins. We could do it > in a separate patch, but we also want to do it right now so I didn't see a > reason to. It is old code that exists to be compatible with websites of > more than a decade ago, which we believe have updated since Flash support > has waned. > Seems like it would be worth keeping around to me. Keeping old sites that use things like QuickTime seems like a worthy goal. I think at the very least it should be in its own change so that it can be backed out separately. > (In reply to Sam Weinig from comment #3) > > Comment on attachment 425763 [details] > > Patch > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=425763&action=review > > > > > Source/WebKitLegacy/mac/WebView/WebPreferences.mm:903 > > > - (void)setPlugInsEnabled:(BOOL)flag > > > { > > > - [self _setBoolValue: flag forKey: WebKitPluginsEnabledPreferenceKey]; > > > } > > > > This seems like a step beyond deprecation. This makes it so that apps that > > enable the feature won't work. > > That is correct. WebPreferences is already deprecated. We will look at > seed feedback, but we intend to remove all our NPAPI code if this goes > smoothly. Then the title and description of this bug is very misleading. You are not just disabling plugins, you are removing support for them completely. Given I have repeatedly asked about doing this and gotten the feedback that doing this requires getting data on usage, I am surprised to see this being done without that data. What has changed? 1749336 7 achristensen 2021-04-12 12:40:36 -0700 Thank you for the feedback on the title of this patch. I intend to retitle this after I finish getting the EWS data on which tests need updating. If you have feedback on the decision process of why this is being done, please redirect that feedback to the internal thread. 1749412 8 425763 darin 2021-04-12 15:28:24 -0700 Comment on attachment 425763 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=425763&action=review >>>> Source/WebKitLegacy/mac/WebView/WebPreferences.mm:903 >>>> } >>> >>> This seems like a step beyond deprecation. This makes it so that apps that enable the feature won't work. >> >> That is correct. WebPreferences is already deprecated. We will look at seed feedback, but we intend to remove all our NPAPI code if this goes smoothly. > > Then the title and description of this bug is very misleading. You are not just disabling plugins, you are removing support for them completely. > > Given I have repeatedly asked about doing this and gotten the feedback that doing this requires getting data on usage, I am surprised to see this being done without that data. What has changed? Sam’s question seems like a good one. Hadn’t heard that we reached the point where we can do this. Not even a linked-on-or-after check? 1749851 9 achristensen 2021-04-13 13:58:17 -0700 I looked at hundreds of important apps and none of them used NPAPI plugins. The only references to NPAPI were from old embedded QTWebKit frameworks that have the ability to load plugins, but no plugins were found. In many of the environments where it is possible that NPAPI is used for other plugins, our ability to gather metrics is also disabled. This is our way to try to remove plugin support: We will try the small changes in the bugs related to this bug and listen for feedback. If we receive feedback that these are still used, it will be straightforward to revert them. Otherwise, at some time in the future we will remove the code this disables and the associated tests. One thing that has changed recently is the end of life of Flash has been reached. The possibility of someone using Flash has prevented us from doing this in the past, but that reason is now gone. 1749906 10 ggaren 2021-04-13 15:44:01 -0700 > Not even a linked-on-or-after check? To address this question specifically: A linked-on-or-after check is a good way to prevent new uses of legacy technology while giving old uses time to update and age out. But our belief is that old uses have already aged out. So, we're discussing ways to find out for sure. 1751847 11 webkit-bug-importer 2021-04-19 10:17:14 -0700 <rdar://problem/76850750> 1809391 12 achristensen 2021-10-27 12:57:43 -0700 https://trac.webkit.org/changeset/275911/webkit https://trac.webkit.org/changeset/276720/webkit https://trac.webkit.org/changeset/275910/webkit 425763 2021-04-12 10:20:23 -0700 2021-04-13 13:59:25 -0700 Patch bug-224441-20210412102022.patch text/plain 5532 achristensen U3VidmVyc2lvbiBSZXZpc2lvbjogMjc1NjEzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IDYyYjlhMjhlOWJiYTFhNjlmM2EwNGE3 MjI5MGJlYzMwNWU3NDExOGQuLmJiZmRlMzdkZDBiOTFlOTBhNjg2NmMxNGM0MTM0YmI2NGUyNGVl NDUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMTkgQEAKKzIwMjEtMDQtMTIgIEFsZXggQ2hyaXN0ZW5zZW4gIDxh Y2hyaXN0ZW5zZW5Ad2Via2l0Lm9yZz4KKworICAgICAgICBSdW50aW1lIGRpc2FibGUgcGx1Z2lu cyBhbmQgcmVwbGFjZW1lbnRzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD0yMjQ0NDEKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICBGbGFzaCBpcyBubyBsb25nZXIgc3VwcG9ydGVkLCBhbmQgaXQgd2FzIHRoZSBs YXN0IE5QQVBJIHBsdWdpbiBzdXBwb3J0ZWQgZm9yIFNhZmFyaS4KKyAgICAgICAgVGhlcmUgaXMg c3RpbGwgZGVwcmVjYXRlZCBBUEkgdG8gZW5hYmxlIE5QQVBJIHBsdWdpbnMgaW4gdGhpcmQgcGFy dHkgYXBwcy4KKyAgICAgICAgVGhpcyBpcyB3aHkgaXRzIGRlcHJlY2F0ZWQuCisKKyAgICAgICAg V2UgYWxzbyBkaXNhYmxlIHNvbWUgaW5qZWN0aW9uIG9mIHBsdWdpbi1saWtlIGludGVyZmFjZXMg dGhhdCBpbmNyZWFzZWQgY29tcGF0aWJpbGl0eSB3aXRoIHNpdGVzIHRoYXQgdXNlZCBmbGFzaCBv biBpT1MuCisgICAgICAgIFRoaXMgaXMgYSBzdGVwIHRvd2FyZHMgY29tcGxldGVseSByZW1vdmlu ZyBhbGwgdGhpcyBjb2RlLgorCisgICAgICAgICogU2NyaXB0cy9QcmVmZXJlbmNlcy9XZWJQcmVm ZXJlbmNlcy55YW1sOgorCiAyMDIxLTA0LTA2ICBZdXN1a2UgU3V6dWtpICA8eXN1enVraUBhcHBs ZS5jb20+CiAKICAgICAgICAgW0pTQ10gV2FzbU1lbW9yeSBjYWdpbmcgc2hvdWxkIGNhcmUgbnVs bHB0cgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nIGIvU291cmNlL1dlYkNv cmUvQ2hhbmdlTG9nCmluZGV4IDAzNzc2ZGZkZmZkZGJiZjQ5NTJiZjY0MDQ3YmUxYmQ5MjU2OTUx ZTYuLjE5M2M1N2VlZDUwZGQ3Y2M2MTY3MzE5YWViNzRmNjA1NWM4NjQ1OGYgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cK QEAgLTEsMyArMSwxNCBAQAorMjAyMS0wNC0xMiAgQWxleCBDaHJpc3RlbnNlbiAgPGFjaHJpc3Rl bnNlbkB3ZWJraXQub3JnPgorCisgICAgICAgIFJ1bnRpbWUgZGlzYWJsZSBwbHVnaW5zIGFuZCBy ZXBsYWNlbWVudHMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTIyNDQ0MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgIE5vIG5ldyB0ZXN0cyAoT09QUyEpLgorCisgICAgICAgICogcGFnZS9TZXR0aW5ncy55YW1s OgorCiAyMDIxLTA0LTA3ICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAg ICAgRHJvcCB1bm5lY2Vzc2FyeSBOREVCVUcgY2hlY2tzIGluIFNlcnZpY2VXb3JrZXJDb250YWlu ZXIKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nIGIvU291cmNlL1dlYktpdC9D aGFuZ2VMb2cKaW5kZXggNTA4NzgxOTVhOWU1ZjdlMjU0ZThhMGJhZjA2ZjJkMmFkOWMxZWY2OC4u Zjg2ODViYThiMzBkYWIxZTkyYmVmNTAzZWZkOTE1YWNlMzVkNDRjYSAxMDA2NDQKLS0tIGEvU291 cmNlL1dlYktpdC9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYktpdC9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNCBAQAorMjAyMS0wNC0xMiAgQWxleCBDaHJpc3RlbnNlbiAgPGFjaHJpc3RlbnNlbkB3 ZWJraXQub3JnPgorCisgICAgICAgIFJ1bnRpbWUgZGlzYWJsZSBwbHVnaW5zIGFuZCByZXBsYWNl bWVudHMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIy NDQ0MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICog VUlQcm9jZXNzL0FQSS9Db2NvYS9XS1ByZWZlcmVuY2VzLm1tOgorICAgICAgICAoLVtXS1ByZWZl cmVuY2VzIHBsdWdJbnNFbmFibGVkXSk6CisgICAgICAgICgtW1dLUHJlZmVyZW5jZXMgc2V0UGx1 Z0luc0VuYWJsZWQ6XSk6CisKIDIwMjEtMDQtMDcgIE1pY2hhZWwgQ2F0YW56YXJvICA8bWNhdGFu emFyb0Bnbm9tZS5vcmc+CiAKICAgICAgICAgW1dQRV1bR1RLXSBOdWxsIHBvaW50ZXIgZGVyZWZl cmVuY2Ugd2hlbiBjaGlsZCBwcm9jZXNzIGV4aXRzIGltbWVkaWF0ZWx5CmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViS2l0TGVnYWN5L21hYy9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0TGVnYWN5L21h Yy9DaGFuZ2VMb2cKaW5kZXggNjBjNDM4OTIwZjM0OTk2MTM4M2I2MTY0YWZmMmJlN2I2MTc4ZWI1 OC4uNTFiNTQ5NjdmNTMzZmRmYjI5NWExNzY4MjA2YmE4NDYxM2Q5YjE5NiAxMDA2NDQKLS0tIGEv U291cmNlL1dlYktpdExlZ2FjeS9tYWMvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXRMZWdh Y3kvbWFjL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDIxLTA0LTEyICBBbGV4IENocmlz dGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUnVudGltZSBkaXNh YmxlIHBsdWdpbnMgYW5kIHJlcGxhY2VtZW50cworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjI0NDQxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgKiBXZWJWaWV3L1dlYlByZWZlcmVuY2VzLm1tOgorICAgICAg ICAoLVtXZWJQcmVmZXJlbmNlcyBhcmVQbHVnSW5zRW5hYmxlZF0pOgorICAgICAgICAoLVtXZWJQ cmVmZXJlbmNlcyBzZXRQbHVnSW5zRW5hYmxlZDpdKToKKwogMjAyMS0wMy0zMSAgQ2hyaXMgRHVt ZXogIDxjZHVtZXpAYXBwbGUuY29tPgogCiAgICAgICAgIFVzZSBNQUNIX1BPUlRfVkFMSUQoKSB3 aGVuIHdhbnRpbmcgdG8gY2hlY2sgaWYgYSBtYWNoIHBvcnQgaXMgdmFsaWQKZGlmZiAtLWdpdCBh L1NvdXJjZS9XVEYvU2NyaXB0cy9QcmVmZXJlbmNlcy9XZWJQcmVmZXJlbmNlcy55YW1sIGIvU291 cmNlL1dURi9TY3JpcHRzL1ByZWZlcmVuY2VzL1dlYlByZWZlcmVuY2VzLnlhbWwKaW5kZXggZDVh MWUxM2Y3MTMwZjE1N2YyYzUxMjFmZjM4NzMyYzkwMGExYzJlNy4uNTIyNTE1ZDJlZmE4MDdlZmRm ZDViMjQwYzMzNWJjZGEzYzlkODQ5OSAxMDA2NDQKLS0tIGEvU291cmNlL1dURi9TY3JpcHRzL1By ZWZlcmVuY2VzL1dlYlByZWZlcmVuY2VzLnlhbWwKKysrIGIvU291cmNlL1dURi9TY3JpcHRzL1By ZWZlcmVuY2VzL1dlYlByZWZlcmVuY2VzLnlhbWwKQEAgLTE3MjAsNyArMTcyMCw3IEBAIFBsdWdp bnNFbmFibGVkOgogICB3ZWJjb3JlT25DaGFuZ2U6IHBsdWdpbnNFbmFibGVkQ2hhbmdlZAogICBk ZWZhdWx0VmFsdWU6CiAgICAgV2ViS2l0TGVnYWN5OgotICAgICAgZGVmYXVsdDogdHJ1ZQorICAg ICAgZGVmYXVsdDogZmFsc2UKICAgICBXZWJLaXQ6CiAgICAgICBkZWZhdWx0OiBmYWxzZQogICAg IFdlYkNvcmU6CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL1NldHRpbmdzLnlhbWwg Yi9Tb3VyY2UvV2ViQ29yZS9wYWdlL1NldHRpbmdzLnlhbWwKaW5kZXggOWQ2YTViMjFjOWNiYzE0 MzU1YjFhMzJkMjA2YTgxM2I3YmY0ZTk2Zi4uMmQwM2Y5MjRjMjYwODg0M2FkYTk1ZjllNmVmMDIy M2JhYmUzMGYxOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGFnZS9TZXR0aW5ncy55YW1s CisrKyBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvU2V0dGluZ3MueWFtbApAQCAtNDQ3LDcgKzQ0Nyw2 IEBAIFF1aWNrVGltZVBsdWdpblJlcGxhY2VtZW50RW5hYmxlZDoKICAgdHlwZTogYm9vbAogICBk ZWZhdWx0VmFsdWU6CiAgICAgV2ViQ29yZToKLSAgICAgIFBMQVRGT1JNKElPU19GQU1JTFkpOiB0 cnVlCiAgICAgICBkZWZhdWx0OiBmYWxzZQogCiBSZXBhaW50T3V0c2lkZUxheW91dEVuYWJsZWQ6 CkBAIC02NDIsNSArNjQxLDQgQEAgWW91VHViZUZsYXNoUGx1Z2luUmVwbGFjZW1lbnRFbmFibGVk OgogICB0eXBlOiBib29sCiAgIGRlZmF1bHRWYWx1ZToKICAgICBXZWJDb3JlOgotICAgICAgUExB VEZPUk0oQ09DT0EpOiB0cnVlCiAgICAgICBkZWZhdWx0OiBmYWxzZQpkaWZmIC0tZ2l0IGEvU291 cmNlL1dlYktpdC9VSVByb2Nlc3MvQVBJL0NvY29hL1dLUHJlZmVyZW5jZXMubW0gYi9Tb3VyY2Uv V2ViS2l0L1VJUHJvY2Vzcy9BUEkvQ29jb2EvV0tQcmVmZXJlbmNlcy5tbQppbmRleCBmYWU4ZDhm NDdhYjIxYWRkZWI3MjI2NDY3YWE1ODE0OTMwOWFmOTUwLi5lNjc4YWE5MmE0MzUxMDZiYzkxMjgw ZGQ5YzAyZWJhN2U3NzBjY2E5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9B UEkvQ29jb2EvV0tQcmVmZXJlbmNlcy5tbQorKysgYi9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9B UEkvQ29jb2EvV0tQcmVmZXJlbmNlcy5tbQpAQCAtMTUxMiwxMiArMTUxMiwxMSBAQCBzdGF0aWMg V2ViQ29yZTo6RWRpdGFibGVMaW5rQmVoYXZpb3IgdG9FZGl0YWJsZUxpbmtCZWhhdmlvcihfV0tF ZGl0YWJsZUxpbmtCZWhhdgogCiAtIChCT09MKXBsdWdJbnNFbmFibGVkCiB7Ci0gICAgcmV0dXJu IF9wcmVmZXJlbmNlcy0+cGx1Z2luc0VuYWJsZWQoKTsKKyAgICByZXR1cm4gTk87CiB9CiAKIC0g KHZvaWQpc2V0UGx1Z0luc0VuYWJsZWQ6KEJPT0wpcGx1Z0luc0VuYWJsZWQKIHsKLSAgICBfcHJl ZmVyZW5jZXMtPnNldFBsdWdpbnNFbmFibGVkKHBsdWdJbnNFbmFibGVkKTsKIH0KIAogI2VuZGlm CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0TGVnYWN5L21hYy9XZWJWaWV3L1dlYlByZWZlcmVu Y2VzLm1tIGIvU291cmNlL1dlYktpdExlZ2FjeS9tYWMvV2ViVmlldy9XZWJQcmVmZXJlbmNlcy5t bQppbmRleCBjMDUwODc0NTdkM2MyOTdmNTdkYzcxMzllNTg4Zjc1YTc5NjQzZjk0Li5mMzhjNTJi NTdkY2I1MTAzYWU0MTExODA1NWZhZWRhYmQxZWQxM2U1IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2Vi S2l0TGVnYWN5L21hYy9XZWJWaWV3L1dlYlByZWZlcmVuY2VzLm1tCisrKyBiL1NvdXJjZS9XZWJL aXRMZWdhY3kvbWFjL1dlYlZpZXcvV2ViUHJlZmVyZW5jZXMubW0KQEAgLTg5NSwxMiArODk1LDEx IEBAIHB1YmxpYzoKIAogLSAoQk9PTClhcmVQbHVnSW5zRW5hYmxlZAogewotICAgIHJldHVybiBb c2VsZiBfYm9vbFZhbHVlRm9yS2V5OiBXZWJLaXRQbHVnaW5zRW5hYmxlZFByZWZlcmVuY2VLZXld OworICAgIHJldHVybiBOTzsKIH0KIAogLSAodm9pZClzZXRQbHVnSW5zRW5hYmxlZDooQk9PTClm bGFnCiB7Ci0gICAgW3NlbGYgX3NldEJvb2xWYWx1ZTogZmxhZyBmb3JLZXk6IFdlYktpdFBsdWdp bnNFbmFibGVkUHJlZmVyZW5jZUtleV07CiB9CiAKIC0gKEJPT0wpYWxsb3dzQW5pbWF0ZWRJbWFn ZXMK