Screencast

I have troubles uploading screencast. The reason may be censorship in Russia, because I managed to upload screencast via TOR in this comment.

Deleted: Ghost of extensions control my proxy.mp4 5.9 MB

	Ghost of extensions control my proxy.mp4 5.9 MB View Download

I haven't tried these steps, but I'll do it later:

The idea is that after clearing settings previous value is restored, but what if extension responsible for previous value was deleted long ago?

1. Install extension that sets PAC script via data property.
2. Install second extension that does the same and overrides previous settings.
3. Delete first extension.
4. Clear settings via second extension.
5. Delete second extension.
6. Notice that proxy configs are not restored to defaults.

Could you please help with the sample Extensions to triage further from Chrome TE side.

I've tried following the steps from comment #2. Unfortunately they don't reproduce the bug.

I attach a sample extension that allows getting/setting/clearing proxy settings, but it's useless unless you know the steps that reproduce the bug.

To see outputs of extension, open console of its background page:
1. open chrome://extensions
2. tick "Developer mode"
3. under extension click "background page"
4. select tab "Console" and don't close it
5. open popup by clicking icon with "M" and click a button
6. see outputs in console.

Deleted: mess-with-proxy.zip 1.2 KB

mess-with-proxy.zip 1.2 KB Download

Thank you for providing more feedback. Adding requester "durga.behera@chromium.org" for another review and adding "Needs-Review" label for tracking.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Cleaning up "Needs-Review" label as we are not using this label for triage. Ref  bug 684919 

I'm not sure if this is related but I was seeing odd behavior related to extensions and proxies.  Around March 4th, a dev account was compromised and pushed a hacked version of the extension that started asking for permission to change the proxy settings.  I immediately pushed a corrected version of the extension, but unfortunately some users did receive the hacked version before the new code was deployed.  Oddly today some of my users are saying that they are being prompted by chrome in a dialog box that my extension is trying to change their proxy settings.

Between testing on Chrome for Windows 10, Chrome for Mac (56) and Chrome Canary for Mac (59), I was only able to get the dialog to appear once for the Chrome for Mac (56).  Now I can't reproduce again at all.  I never actually saw evidence that the proxies were actually being changed or that my code had been compromised again in any way.  According to the chrome://extensions page, the extension still didn't actually have any unexpected permissions granted to it.

My initial theory was that maybe internally chrome had a bug that resulted in a long delay before the original proxy permissions warning was delivered.  In other words, I think the warning was just a false alarm.  But then again, because I am unable to prove this at the network level myself so I remain open-minded.

Of course, I'll continue to look into this on my end, but I'm eager to hear back on this thread as this issue could potentially be a security risk for my users.

Deleted: Screen Shot 2017-03-17 at 11.07.55 AM.png 301 KB

	Screen Shot 2017-03-17 at 11.07.55 AM.png 301 KB View Download

I forgot to mention that I think the reason why my Chrome 56 browser showed the issue is because that one as far as I remember is the only one that had had the original hacked extension installed.  The screenshot I just sent was submitted by a user in a bug report.  It appears that she was using a windows computer.

I just noticed this in my chrome settings.  However, if I examine the extension code itself as downloaded into the chrome directory ("~/Library/Application Support/Google/Chrome/Default/Extensions/[extension_id]/[extension_version]"), I can see that it's the correct version number and that it doesn't even ask for permission to change any proxy settings. 

This image would indicate that the bug is not related to delayed notifications but is related to how permissions are stored and passed around in internal chrome settings.

Deleted: Screen Shot 2017-03-17 at 11.29.29 AM.png 18.9 KB

	Screen Shot 2017-03-17 at 11.29.29 AM.png 18.9 KB View Download

Issue has not been modified or commented on in the last 365 days, please re-open or file a new bug if this is still an issue.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot