4 ms·

> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https

by darren_ 13y ago

> Brief search shows that these dev interfaces would have the ability to access the user's PC outside of the Chrome sandbox. Aren't they just the APIs in https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p...? By the looks of it they're just things that aren't ready for primetime, not things that are special dev-only debug tools or whatever.

RyanZAG 13y ago
Well there is https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/ppb_testing_dev.h&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p... and https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions/dev/ppb_ext_events_dev.h https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions... I haven't looked deeply, but both seem to allow for access outside the sandbox. Maybe a chromium committer could give more detail on the safety of the dev interfaces. They are blocked from public usage for a reason though.
- rmac 13y ago
  which parts of the above code/api allow access outside of the sandbox?
- simias 13y ago
  Eh, using structs for namespacing in C. I hadn't seen that in a while.
- yzshen 13y ago
  They don't enable access outside the sandbox and should be pretty safe. PPB_Testing_Dev is a set of helpers for writing tests: querying status of the plugin; running nested message loop to wait for results of async operations; simulate input events which are received only by the plugin itself. PPB_Ext_Events_Dev is for registering/unregistering events provided by Chrome apps apis (http://developer.chrome.com/apps/api_index.html http://developer.chrome.com/apps/api_index.html). It will only be accessible when the NaCl module is included in a Chrome app. This interface hasn't been implemented yet.

by darren_ 13y ago

RyanZAG 13y ago

Well there is https://code.google.com/p/chromium/codesearch#chromium/src/ppapi/c/dev/ppb_testing_dev.h&sq=package:chromium&type=cs https://code.google.com/p/chromium/codesearch#chromium/src/p... and https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions/dev/ppb_ext_events_dev.h https://src.chromium.org/chrome/trunk/src/ppapi/c/extensions... I haven't looked deeply, but both seem to allow for access outside the sandbox. Maybe a chromium committer could give more detail on the safety of the dev interfaces. They are blocked from public usage for a reason though.

rmac 13y ago
which parts of the above code/api allow access outside of the sandbox?
simias 13y ago
Eh, using structs for namespacing in C. I hadn't seen that in a while.
yzshen 13y ago
They don't enable access outside the sandbox and should be pretty safe. PPB_Testing_Dev is a set of helpers for writing tests: querying status of the plugin; running nested message loop to wait for results of async operations; simulate input events which are received only by the plugin itself. PPB_Ext_Events_Dev is for registering/unregistering events provided by Chrome apps apis (http://developer.chrome.com/apps/api_index.html http://developer.chrome.com/apps/api_index.html). It will only be accessible when the NaCl module is included in a Chrome app. This interface hasn't been implemented yet.