Adding POCs.

Deleted: extension_with_rtl_name.zip 1.1 KB

extension_with_rtl_name.zip 1.1 KB Download

Deleted: extension_with_whitespace_name.zip 929 bytes

extension_with_whitespace_name.zip 929 bytes Download

It seems like, at a minimum, we could do (Python example):

    name = re.sub(r"\s+", " ", name).strip()
    assert len(name) > 1

Also relevant:  bug 685750 

This is relevant for our security review for https://bugs.chromium.org/p/chromium/issues/detail?id=677165, is anyone able to take this on in the near future to unblock?

I can take this one, we probably want to address this along with crbug.com/677165 (display extension chip).

Currently, RTL characters also affect the extension chip, but the chip properly strips off whitespace characters.

Not sure what the right approach is for RTL characters, both in the extension chip and elsewhere. Perhaps Webstore should scan for RTL characters and reject them outright?

ericdingle: Is that something we could do?

Rejecting RTL seems a bit too restrictive. What about Arabic- or Hebrew-specific extensions (surely, there are some)? If you want to be strict about it, which is probably good, maybe require that the extension name be 100% LTR or RTL?

I'm probably not the right owner for this bug.

Catherine, I think you recently fixed bugs with extension permission strings. Could this be of interest to you?

I have a CL out fixing the whitespace and new line issue.

Currently I'm investigating approaches to fix the RTL character issue.

+jshin@, just fyi in case you would like more context on the RTL CL.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7af24b97fe4f69e15aa03ea2334be167355257c4

commit 7af24b97fe4f69e15aa03ea2334be167355257c4
Author: Catherine Mullings <catmullings@chromium.org>
Date: Tue Jan 23 18:16:11 2018

[Extensions] Sanitize extension names: collapse whitespaces and new lines

Ensure new lines and multiple whitespaces are collapsed in an
extension's name.

Bug:  685747 
Change-Id: I1ddccacbbfa6c491c9ac83e7d529a3d5871e6cd7
Reviewed-on: https://chromium-review.googlesource.com/818457
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: catmullings <catmullings@chromium.org>
Commit-Queue: catmullings <catmullings@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531281}
[modify] https://crrev.com/7af24b97fe4f69e15aa03ea2334be167355257c4/chrome/common/extensions/extension_unittest.cc
[modify] https://crrev.com/7af24b97fe4f69e15aa03ea2334be167355257c4/extensions/common/extension.cc
[modify] https://crrev.com/7af24b97fe4f69e15aa03ea2334be167355257c4/extensions/common/extension.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/867fbaacc16ed58d5a7c8cb682bf5fafc79d47f9

commit 867fbaacc16ed58d5a7c8cb682bf5fafc79d47f9
Author: Catherine Mullings <catmullings@chromium.org>
Date: Tue Feb 13 16:28:18 2018

[Extensions] Handle RTL and directional characters in extension names

This CL introduces base::i18n::EnsureTerminatedDirectionalFormatting
to ensure that the supplied text contains no unterminated directional
formatting characters. Additionally, this CL introduces
base::i18n::SanitizeUserSuppliedString which adjusts the supplied text
according to the locale direction and relies on the previous method
to handle unterminated directional formatting characters.

The SanitizeUserSuppliedString is applied to sanitize RTL and
directional characters in extension names.

Bug:  685747 
Change-Id: I48db3a37b8a54d5c4ca5556d56cde4c9da31abe3
Reviewed-on: https://chromium-review.googlesource.com/876522
Commit-Queue: catmullings <catmullings@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Jungshik Shin <jshin@chromium.org>
Reviewed-by: Matt Giuca <mgiuca@chromium.org>
Cr-Commit-Position: refs/heads/master@{#536375}
[modify] https://crrev.com/867fbaacc16ed58d5a7c8cb682bf5fafc79d47f9/base/i18n/rtl.cc
[modify] https://crrev.com/867fbaacc16ed58d5a7c8cb682bf5fafc79d47f9/base/i18n/rtl.h
[modify] https://crrev.com/867fbaacc16ed58d5a7c8cb682bf5fafc79d47f9/base/i18n/rtl_unittest.cc
[modify] https://crrev.com/867fbaacc16ed58d5a7c8cb682bf5fafc79d47f9/chrome/common/extensions/extension_unittest.cc
[modify] https://crrev.com/867fbaacc16ed58d5a7c8cb682bf5fafc79d47f9/extensions/common/extension.cc

Is there any more work to do here?

I think this was completed.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot