4 ms·

What whitelist? JS Execution? No popup blocking? Something else?

darren_ 13y ago
Just a guess but there's a comment: // Temporarily allow these whitelisted apps and WebUIs to use NaCl. And it's in a function called "IsNaClAllowed"
- rurounijones 13y ago
  I am not 100% familiar with NaCL but it this a download / install whitelist then for NaCL programs? [EDIT] answered by https://news.ycombinator.com/item?id=6723930 https://news.ycombinator.com/item?id=6723930
jpx_ 13y ago
Looks like it's a whitelist for Native Client.
millstone 13y ago
The function name is "bool ChromeContentRendererClient::IsNaClAllowed", so I guess that.
mhlakhani 13y ago
// Temporarily allow these whitelisted apps and WebUIs to use NaCl. For NaCl, presumably.
WestCoastJustin 13y ago
To me, it looks like they are allowing https @ plus.google.com, plus.sandbox.google.com, ssl.gstatic.com, talk.google.com, talkgadget.google.com, and ssl.gstatic.com to use WebUIs (most likely Dart web apps) [1] and NaCl [2]. // Temporarily allow these whitelisted apps and WebUIs to use NaCl. > Google Native Client (NaCl) is a sandboxing technology for running a subset of Intel x86 or ARM native code in a sandbox. It is proposed for safely running native code from a web browser, allowing web-based applications to run at near-native speeds,[2] which aligns well with Google's plans with Chrome OS. It may also be used for securing browser plugins, and in the future parts of other applications or full applications. [2] [1] https://www.dartlang.org/articles/web-ui/ https://www.dartlang.org/articles/web-ui/ [2] http://en.wikipedia.org/wiki/Google_Native_Client http://en.wikipedia.org/wiki/Google_Native_Client
RyanZAG 13y ago
Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.
- est 13y ago
  With DNS hijack, everyone can remote execute.
  - RyanZAG 13y ago
    No, HTTPS only. So probably only Google or the NSA, I guess.
    - psionski 13y ago
      Well, it's not like you can't buy a valid certificate for google.com from a turkish CA that is trusted by all browsers... This has happened before, the only question is how much you're willing to pay.
      - Aissen 13y ago
        There's also hardcoded HSTS pining for Google certificates, preventing this.
        est 13y ago
        How does HSTS deal with expired certs?
- darren_ 13y ago
  > Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p...? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.

Just a guess but there's a comment: // Temporarily allow these whitelisted apps and WebUIs to use NaCl. And it's in a function called "IsNaClAllowed"

rurounijones 13y ago
I am not 100% familiar with NaCL but it this a download / install whitelist then for NaCL programs? [EDIT] answered by https://news.ycombinator.com/item?id=6723930 https://news.ycombinator.com/item?id=6723930

jpx_ 13y ago

Looks like it's a whitelist for Native Client.

millstone 13y ago

The function name is "bool ChromeContentRendererClient::IsNaClAllowed", so I guess that.

mhlakhani 13y ago

// Temporarily allow these whitelisted apps and WebUIs to use NaCl. For NaCl, presumably.

WestCoastJustin 13y ago

To me, it looks like they are allowing https @ plus.google.com, plus.sandbox.google.com, ssl.gstatic.com, talk.google.com, talkgadget.google.com, and ssl.gstatic.com to use WebUIs (most likely Dart web apps) [1] and NaCl [2]. // Temporarily allow these whitelisted apps and WebUIs to use NaCl. > Google Native Client (NaCl) is a sandboxing technology for running a subset of Intel x86 or ARM native code in a sandbox. It is proposed for safely running native code from a web browser, allowing web-based applications to run at near-native speeds,[2] which aligns well with Google's plans with Chrome OS. It may also be used for securing browser plugins, and in the future parts of other applications or full applications. [2] [1] https://www.dartlang.org/articles/web-ui/ https://www.dartlang.org/articles/web-ui/ [2] http://en.wikipedia.org/wiki/Google_Native_Client http://en.wikipedia.org/wiki/Google_Native_Client

RyanZAG 13y ago

Did a bit of digging - it lets NACL apps downloaded from those whitelisted Google apis have access to "dev interfaces". Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. In effect, this gives Google remote code execution rights from their domains on anybody running Chromium.

est 13y ago
With DNS hijack, everyone can remote execute.
- RyanZAG 13y ago
  No, HTTPS only. So probably only Google or the NSA, I guess.
  - psionski 13y ago
    Well, it's not like you can't buy a valid certificate for google.com from a turkish CA that is trusted by all browsers... This has happened before, the only question is how much you're willing to pay.
    - Aissen 13y ago
      There's also hardcoded HSTS pining for Google certificates, preventing this.
      - est 13y ago
        How does HSTS deal with expired certs?
darren_ 13y ago
> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p...? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.