7 ms·

Google apps whitelist hardcoded into Chromium open source project

150 points by RyanZAG 13y ago

gcb1 13y ago
since google started silently removing all the referrer removal options developers contributed to chromium over time, I've started to call it Google's Chromium open source project.
rurounijones 13y ago
What whitelist? JS Execution? No popup blocking? Something else?
- darren_ 13y ago
  Just a guess but there's a comment: // Temporarily allow these whitelisted apps and WebUIs to use NaCl. And it's in a function called "IsNaClAllowed"
  - rurounijones 13y ago
    I am not 100% familiar with NaCL but it this a download / install whitelist then for NaCL programs? [EDIT] answered by https://news.ycombinator.com/item?id=6723930 https://news.ycombinator.com/item?id=6723930
- jpx_ 13y ago
  Looks like it's a whitelist for Native Client.
- millstone 13y ago
  The function name is "bool ChromeContentRendererClient::IsNaClAllowed", so I guess that.
- mhlakhani 13y ago
  // Temporarily allow these whitelisted apps and WebUIs to use NaCl. For NaCl, presumably.
- WestCoastJustin 13y ago
  To me, it looks like they are allowing https @ plus.google.com, plus.sandbox.google.com, ssl.gstatic.com, talk.google.com, talkgadget.google.com, and ssl.gstatic.com to use WebUIs (most likely Dart web apps) [1] and NaCl [2]. // Temporarily allow these whitelisted apps and WebUIs to use NaCl. > Google Native Client (NaCl) is a sandboxing technology for running a subset of Intel x86 or ARM native code in a sandbox. It is proposed for safely running native code from a web browser, allowing web-based applications to run at near-native speeds,[2] which aligns well with Google's plans with Chrome OS. It may also be used for securing browser plugins, and in the future parts of other applications or full applications. [2] [1] https://www.dartlang.org/articles/web-ui/ https://www.dartlang.org/articles/web-ui/ [2] http://en.wikipedia.org/wiki/Google_Native_Client http://en.wikipedia.org/wiki/Google_Native_Client
- RyanZAG 13y ago
  Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.
  - est 13y ago
    With DNS hijack, everyone can remote execute.
    - RyanZAG 13y ago
      No, HTTPS only. So probably only Google or the NSA, I guess.
      - psionski 13y ago
        Well, it's not like you can't buy a valid certificate for google.com from a turkish CA that is trusted by all browsers... This has happened before, the only question is how much you're willing to pay.
        Aissen 13y ago
        There's also hardcoded HSTS pining for Google certificates, preventing this.
        est 13y ago
        How does HSTS deal with expired certs?
  - darren_ 13y ago
    > Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p...? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.
deleted 13y ago
[deleted]
steve-slicify 13y ago
From the source: Allow Chrome Web Store extensions, built-in extensions and extensions under development (for calls from whitelisted apps amongst others)
- josteink 13y ago
  That, and give Google special treatment.
mwill 13y ago
Throwing some more info here, this is the NaCl whitelist, looks like it was originally added Feb last year [1]. There's a discussion on Chromium Code Reviews here [2], and an issue on the project itself here [3] The original commit includes the comment 'We should remove this code when PNaCl ships' which got removed somewhere along the way. [1] http://src.chromium.org/viewvc/chrome/trunk/src/chrome/renderer/chrome_content_renderer_client.cc?revision=122709 http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende... [2] https://codereview.chromium.org/9368046 https://codereview.chromium.org/9368046 [3] https://code.google.com/p/chromium/issues/detail?id=113668 https://code.google.com/p/chromium/issues/detail?id=113668
- leokun 13y ago
  From the bottom of the issue: "Rick Waldron raised some concerns on Twitter (http://goo.gl/xk3CaX http://goo.gl/xk3CaX) so hopefully I can provide a bit more context: We don't enable NaCl on the web at large because we don't want to see a particular instruction set baked into the web. We enable it for apps that are in the Chrome Web Store (even hosted apps which are in the web) because it's a place where over time we can get developers to migrate to PNaCl. For this whitelist, we have similar controls to what we have on the Chrome Web Store, and our goal is to eventually remove the need for it altogether." Seems interesting anyway.
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
denzil_correa 13y ago
An important comment in the code // Whitelisted apps must be served over https.
- josteink 13y ago
  Security issues aside, it still reeks bad taste though. Google is saying that everyone on the internet has to dump plugins, dump Flash and create pure HTML solutions. HTML should be good enough for everyone! Everyone except themselves, apparently. They can just jump to native code on their websites whenever they like. So much for their credibility when it comes to web-standards, eh?
  - true_religion 13y ago
    Isn't it entirely possible they want to dog food their own new code via Chrome before they open up the API to the world?
    - josteink 13y ago
      If they were genuinely interested in dogfooding their own stuff to ensure it works properly, they should also be dogfooding the process of white-listing plugins and websites, not to mention handling graceful fallback when the user cant or wont do that. That's a big part of getting the end-user experience to work well and can't just be "tacked on" later.
      - true_religion 13y ago
        You're just adding things that probably aren't within the scope of the project. For instance graceful fallback is a 'nice to have' but not necessary. If you deny flash or javascript, essentially most sites simply break. I imagine a native client plugin would have the same results if you don't enable it. As for white listing, why can't it simply be handled with the same dialogs used for whitelisting all the other existing extensions per site?
  - wmf 13y ago
e12e 13y ago
Apparently not patched out in Debian either (according to apt-get source chromium-browser). I've got a bit of a mongrel system, so I can't rebuild from source -- but it looks like it should be easy to patch that line to read: bool is_whitelisted_url = false; (If one should be so inclined).
skimmas 13y ago
So it's a... Backdoor
mavdi 13y ago
I'm more horrified by how ugly that code is
semjada 13y ago
be evil
- kdot 13y ago
  You have to remember that Chrome an OS aswell.
andyzweb 13y ago
Code never lies, comments sometimes do. — Ron Jeffries
mkhpalm 13y ago
A lot of things are hodecoded into chrome/chromeium. For example the font types and sizes of the tab area. Their browser is practically unusable on a 4k monitor at full resolution.
oddshocks 13y ago
Very uncool. Google's association with Chromium is why I still recommend FireFox over Chromium, even though they are both open source. Now that I see this, I'm glad I do.
theboss 13y ago
I mean. Google is so large it will always be making mistakes like this. A lot of people look at Google as a whole like it is the greatest set of technical minds in any room on the planet. Sure they have lots of smart people etc.etc but with >10,000 engineers it's impossible. Also, with >10,000 engineers (even assuming they are the best 10k in the world), mistakes will be made which is why vulnerabilities exist in the real world. I guess what I'm trying to say is. Don't act surprised. We've seen it before and we will see it again.
- ryanhuff 13y ago
  I agree, but lets also be sure they don't get a pass just because they are large. In Google's case, being a behemoth corporation is in itself a business risk that they need to manage, and one way to motivate them self-police is by holding them accountable for bad decisions.
hidamon 13y ago
Why would they check if Adblock is installed or not? https://code.google.com/p/chromium/codesearch#chromium/src/chrome/renderer/chrome_content_renderer_client.cc&l=1261 https://code.google.com/p/chromium/codesearch#chromium/src/c... bool ChromeContentRendererClient::IsAdblockInstalled() { return g_current_client->extension_dispatcher_->extensions()->Contains( "gighmmpiobklfepjocnamgkkbiglidom"); } bool ChromeContentRendererClient::IsAdblockPlusInstalled() { return g_current_client->extension_dispatcher_->extensions()->Contains( "cfhdojbkjhnklbpkdaibdccddilifddb"); }
- elq 13y ago
  They were apparently trying to understand performance issues with adblock, so they can fix them... // TODO(mpcomplete): remove the extension-related histograms after we collect // enough data. http://crbug.com/100411 const bool use_adblock_histogram = ChromeContentRendererClient::IsAdblockInstalled(); https://code.google.com/p/chromium/issues/detail?id=100411 https://code.google.com/p/chromium/issues/detail?id=100411

150 points by RyanZAG 13y ago

gcb1 13y ago

since google started silently removing all the referrer removal options developers contributed to chromium over time, I've started to call it Google's Chromium open source project.

rurounijones 13y ago

What whitelist? JS Execution? No popup blocking? Something else?

darren_ 13y ago
Just a guess but there's a comment: // Temporarily allow these whitelisted apps and WebUIs to use NaCl. And it's in a function called "IsNaClAllowed"
- rurounijones 13y ago
  I am not 100% familiar with NaCL but it this a download / install whitelist then for NaCL programs? [EDIT] answered by https://news.ycombinator.com/item?id=6723930 https://news.ycombinator.com/item?id=6723930
jpx_ 13y ago
Looks like it's a whitelist for Native Client.
millstone 13y ago
The function name is "bool ChromeContentRendererClient::IsNaClAllowed", so I guess that.
mhlakhani 13y ago
// Temporarily allow these whitelisted apps and WebUIs to use NaCl. For NaCl, presumably.
WestCoastJustin 13y ago
To me, it looks like they are allowing https @ plus.google.com, plus.sandbox.google.com, ssl.gstatic.com, talk.google.com, talkgadget.google.com, and ssl.gstatic.com to use WebUIs (most likely Dart web apps) [1] and NaCl [2]. // Temporarily allow these whitelisted apps and WebUIs to use NaCl. > Google Native Client (NaCl) is a sandboxing technology for running a subset of Intel x86 or ARM native code in a sandbox. It is proposed for safely running native code from a web browser, allowing web-based applications to run at near-native speeds,[2] which aligns well with Google's plans with Chrome OS. It may also be used for securing browser plugins, and in the future parts of other applications or full applications. [2] [1] https://www.dartlang.org/articles/web-ui/ https://www.dartlang.org/articles/web-ui/ [2] http://en.wikipedia.org/wiki/Google_Native_Client http://en.wikipedia.org/wiki/Google_Native_Client
RyanZAG 13y ago
Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.
- est 13y ago
  With DNS hijack, everyone can remote execute.
  - RyanZAG 13y ago
    No, HTTPS only. So probably only Google or the NSA, I guess.
    - psionski 13y ago
      Well, it's not like you can't buy a valid certificate for google.com from a turkish CA that is trusted by all browsers... This has happened before, the only question is how much you're willing to pay.
      - Aissen 13y ago
        There's also hardcoded HSTS pining for Google certificates, preventing this.
        est 13y ago
        How does HSTS deal with expired certs?
- darren_ 13y ago
  > Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p...? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.

deleted 13y ago

[deleted]

steve-slicify 13y ago

From the source: Allow Chrome Web Store extensions, built-in extensions and extensions under development (for calls from whitelisted apps amongst others)

josteink 13y ago
That, and give Google special treatment.

mwill 13y ago

Throwing some more info here, this is the NaCl whitelist, looks like it was originally added Feb last year [1]. There's a discussion on Chromium Code Reviews here [2], and an issue on the project itself here [3] The original commit includes the comment 'We should remove this code when PNaCl ships' which got removed somewhere along the way. [1] http://src.chromium.org/viewvc/chrome/trunk/src/chrome/renderer/chrome_content_renderer_client.cc?revision=122709 http://src.chromium.org/viewvc/chrome/trunk/src/chrome/rende... [2] https://codereview.chromium.org/9368046 https://codereview.chromium.org/9368046 [3] https://code.google.com/p/chromium/issues/detail?id=113668 https://code.google.com/p/chromium/issues/detail?id=113668

leokun 13y ago
From the bottom of the issue: "Rick Waldron raised some concerns on Twitter (http://goo.gl/xk3CaX http://goo.gl/xk3CaX) so hopefully I can provide a bit more context: We don't enable NaCl on the web at large because we don't want to see a particular instruction set baked into the web. We enable it for apps that are in the Chrome Web Store (even hosted apps which are in the web) because it's a place where over time we can get developers to migrate to PNaCl. For this whitelist, we have similar controls to what we have on the Chrome Web Store, and our goal is to eventually remove the need for it altogether." Seems interesting anyway.
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]

denzil_correa 13y ago

An important comment in the code // Whitelisted apps must be served over https.

josteink 13y ago
Security issues aside, it still reeks bad taste though. Google is saying that everyone on the internet has to dump plugins, dump Flash and create pure HTML solutions. HTML should be good enough for everyone! Everyone except themselves, apparently. They can just jump to native code on their websites whenever they like. So much for their credibility when it comes to web-standards, eh?
- true_religion 13y ago
  Isn't it entirely possible they want to dog food their own new code via Chrome before they open up the API to the world?
  - josteink 13y ago
    If they were genuinely interested in dogfooding their own stuff to ensure it works properly, they should also be dogfooding the process of white-listing plugins and websites, not to mention handling graceful fallback when the user cant or wont do that. That's a big part of getting the end-user experience to work well and can't just be "tacked on" later.
    - true_religion 13y ago
      You're just adding things that probably aren't within the scope of the project. For instance graceful fallback is a 'nice to have' but not necessary. If you deny flash or javascript, essentially most sites simply break. I imagine a native client plugin would have the same results if you don't enable it. As for white listing, why can't it simply be handled with the same dialogs used for whitelisting all the other existing extensions per site?
- wmf 13y ago

e12e 13y ago

Apparently not patched out in Debian either (according to apt-get source chromium-browser). I've got a bit of a mongrel system, so I can't rebuild from source -- but it looks like it should be easy to patch that line to read: bool is_whitelisted_url = false; (If one should be so inclined).

skimmas 13y ago

So it's a... Backdoor

mavdi 13y ago

I'm more horrified by how ugly that code is

semjada 13y ago

be evil

kdot 13y ago
You have to remember that Chrome an OS aswell.

andyzweb 13y ago

Code never lies, comments sometimes do. — Ron Jeffries

mkhpalm 13y ago

A lot of things are hodecoded into chrome/chromeium. For example the font types and sizes of the tab area. Their browser is practically unusable on a 4k monitor at full resolution.

oddshocks 13y ago

Very uncool. Google's association with Chromium is why I still recommend FireFox over Chromium, even though they are both open source. Now that I see this, I'm glad I do.

theboss 13y ago

I mean. Google is so large it will always be making mistakes like this. A lot of people look at Google as a whole like it is the greatest set of technical minds in any room on the planet. Sure they have lots of smart people etc.etc but with >10,000 engineers it's impossible. Also, with >10,000 engineers (even assuming they are the best 10k in the world), mistakes will be made which is why vulnerabilities exist in the real world. I guess what I'm trying to say is. Don't act surprised. We've seen it before and we will see it again.

ryanhuff 13y ago
I agree, but lets also be sure they don't get a pass just because they are large. In Google's case, being a behemoth corporation is in itself a business risk that they need to manage, and one way to motivate them self-police is by holding them accountable for bad decisions.

hidamon 13y ago

Why would they check if Adblock is installed or not? https://code.google.com/p/chromium/codesearch#chromium/src/chrome/renderer/chrome_content_renderer_client.cc&l=1261 https://code.google.com/p/chromium/codesearch#chromium/src/c... bool ChromeContentRendererClient::IsAdblockInstalled() { return g_current_client->extension_dispatcher_->extensions()->Contains( "gighmmpiobklfepjocnamgkkbiglidom"); } bool ChromeContentRendererClient::IsAdblockPlusInstalled() { return g_current_client->extension_dispatcher_->extensions()->Contains( "cfhdojbkjhnklbpkdaibdccddilifddb"); }

elq 13y ago
They were apparently trying to understand performance issues with adblock, so they can fix them... // TODO(mpcomplete): remove the extension-related histograms after we collect // enough data. http://crbug.com/100411 const bool use_adblock_histogram = ChromeContentRendererClient::IsAdblockInstalled(); https://code.google.com/p/chromium/issues/detail?id=100411 https://code.google.com/p/chromium/issues/detail?id=100411