Bug 64080 – Web Inspector: secure access to extensions API

• Status: RESOLVED
• Resolution: FIXED
• Component: Web Inspector (Deprecated)

[Andrey Kosyakov]

Use relative filenames instead of URLs when specifying extension resources (panels, sidebars, icons)/

Also, we used to allow extension requests for any iframes injected into WebInspecor front-end. This patch changes it to only allow extension requests coming from the same origin as the extension we explicitly loaded.

[Andrey Kosyakov]

Created attachment 99969 [details]
patch

[Pavel Feldman]

Comment on attachment 99969 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=99969&action=review

> LayoutTests/platform/gtk/Skipped:-1554
> -inspector/

Thanks for making inspector tests pass on gtk.

> Source/WebCore/inspector/front-end/ExtensionServer.js:495
> +        } while (resourcePath !== old_path);

split("/"), followed by a push on normal / pull on ..

[Andrey Kosyakov]

A variation of patch landed as r90581: http://trac.webkit.org/changeset/90581

[Andras Becsi]

(In reply to comment #3)
> A variation of patch landed as r90581: http://trac.webkit.org/changeset/90581

After this change inspector/extensions/extensions.html times out at least on the Qt Linux Release, SnowLeopard Intel Release, Windows 7 Release bots and inspector/profiler/cpu-profiler-profiling.html on the Qt Linux Release bot.

[Andrey Kosyakov]

(In reply to comment #4)
> (In reply to comment #3)
> > A variation of patch landed as r90581: http://trac.webkit.org/changeset/90581
> 
> After this change inspector/extensions/extensions.html times out at least on the Qt Linux Release, SnowLeopard Intel Release, Windows 7 Release bots and inspector/profiler/cpu-profiler-profiling.html on the Qt Linux Release bot.

Yup, I just noticed this as well, the fix is coming in a few minutes.

[Andrey Kosyakov]

(In reply to comment #5)
> (In reply to comment #4)
> > (In reply to comment #3)
> > > A variation of patch landed as r90581: http://trac.webkit.org/changeset/90581
> > 
> > After this change inspector/extensions/extensions.html times out at least on the Qt Linux Release, SnowLeopard Intel Release, Windows 7 Release bots and inspector/profiler/cpu-profiler-profiling.html on the Qt Linux Release bot.
> 
> Yup, I just noticed this as well, the fix is coming in a few minutes.

Actually, not. I'll rather rollback for the time being.