2 ms·
The security hole is in the guarantees the app store is able to make. webRequest API, because it runs arbitrary JS, could do anything including something malic
by shadowgovt 4y ago
The security hole is in the guarantees the app store is able to make.
webRequest API, because it runs arbitrary JS, could do anything including something malicious by modifying external JS after the extension was submitted to the store. It's an API that makes it impossible for a store to make security guarantees at all.
This is, unfortunately, the behavior ad blockers rely upon to keep their databases of malicious actors fresh.
- hgsgm 4y agoThat's not really true. Block lists can be updated via the store. The security hole is that the app might maliciously modify the content of the pages you are viewing. It doesn't need to make requests if can tell your page to send your requests to a different server. The declarative API solves that by not allowing page modification outside of safety boundaries like deleting elements.
- tadfisher 4y agoAnother way to solve it would have been to define a "blocking" webRequestFilter function of the form "Request -> Bool", because ad blockers only care about preventing requests, not actually executing requests or modifying results.
- amluto 4y agoCome again? Here’s an example with declarativeNetRequest that modifies requests: https://stackoverflow.com/questions/3274144/can-i-modify-outgoing-request-headers-with-a-chrome-extension https://stackoverflow.com/questions/3274144/can-i-modify-out... Saying that manifest v3 is about security is really not credible. Maybe the changes look like security, but the details are simply not consistent with security being the primary goal.