New issue
Advanced search Search tips

Issue 801861 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 1
Type: Bug-Security



Sign in to add a comment

Web Store extensions can be made to have no toolbar icon

Reported by tobias...@gmail.com, Jan 13 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36

Steps to reproduce the problem:
1. Install this extension: https://chrome.google.com/webstore/detail/fbfluffbustingpurity/nmkinhboiljjkhaknpaeaicmdjhagpep
2. Look at the browser toolbar

What is the expected behavior?
A icon for the extension should be added to the toolbar.

What went wrong?
Neither in the toolbar nor the Chrome menu is an icon for the extension. This is because the extension has converted_from_user_script set to true in its manifest.

This makes Chrome hide the icon even though the extension was not legitimately converted by the browser from a userscript, but installed from the Web Store.

Did this work before? N/A 

Chrome version: 63.0.3239.132  Channel: stable
OS Version: 10.0
Flash Version:
 

Comment 1 by tobias...@gmail.com, Jan 13 2018

To clarify:  The extension seems to have been converted from a userscript initially, on the extension author's PC, which resulted in the flag being added. So they acted 100% morally.
Cc: rdevlin....@chromium.org
Components: Platform>Extensions
Labels: OS-Chrome OS-Linux OS-Mac
Interesting, thanks for the report!
Labels: -Pri-2 Security_Impact-Head Security_Severity-Low Pri-1
Owner: proberge@chromium.org
Status: Assigned (was: Unconfirmed)
[security-sheriffing] I repro'd this on Linux M63.  I expect this could be used by UwSy extensions, and we should test if it affects side-loaded extensions as well.

proberge -- Can you take this?
Yes, I'll take care of it.

To partially protect users from side-loaded extensions, we should put the protections in Chrome instead of during the CWS upload.

This is only a partial protection: binary UwS may still be able to modify the extension settings in the pref file to add the flag.

Alternatively, we could try removing the converted-from-user-script flag and make these extensions behave the same UI-wise as other extensions. I don't know if this is reasonable - @devlin do we have some documentation about the TYPE_USER_SCRIPT extensions? There's some weird related code like set_emulate_greasemonkey. Also weird: Manifest::Type Extension::GetType(). 
Project Member

Comment 5 by bugdroid1@chromium.org, Jan 29 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b4de3afbcc0a25e6043ba7c1a2b5ef60101d0694

commit b4de3afbcc0a25e6043ba7c1a2b5ef60101d0694
Author: proberge <proberge@chromium.org>
Date: Mon Jan 29 16:40:57 2018

Make ExtensionActionHandler manifest handler parse userscript extensions

This effectively makes user script extensions show up in the tab bar.

Bug:  801861 
Change-Id: I8fd4df034eee07403cda0a0eabef2d68ff5f272a
Reviewed-on: https://chromium-review.googlesource.com/886651
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Commit-Queue: proberge <proberge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#532457}
[modify] https://crrev.com/b4de3afbcc0a25e6043ba7c1a2b5ef60101d0694/chrome/browser/ui/toolbar/toolbar_actions_model_unittest.cc
[modify] https://crrev.com/b4de3afbcc0a25e6043ba7c1a2b5ef60101d0694/chrome/common/extensions/manifest_handlers/extension_action_handler.cc

Labels: Merge-Request-65
Project Member

Comment 7 by sheriffbot@chromium.org, Feb 6 2018

Labels: -Merge-Request-65 Hotlist-Merge-Approved Merge-Approved-65
Your change meets the bar and is auto-approved for M65. Please go ahead and merge the CL to branch 3325 manually. Please contact milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), bhthompson@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Pls merge your change to M65 branch 3325 before 2:00 PM PT tomorrow, Wednesday (02/07/18). Thank you.
Will do. Thank you @govind.
Project Member

Comment 10 by bugdroid1@chromium.org, Feb 6 2018

Labels: -merge-approved-65 merge-merged-3325
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6b7297fa4e7e916f1059b877d924e9b769c23c10

commit 6b7297fa4e7e916f1059b877d924e9b769c23c10
Author: proberge <proberge@chromium.org>
Date: Tue Feb 06 22:24:51 2018

Make ExtensionActionHandler manifest handler parse userscript extensions

This effectively makes user script extensions show up in the tab bar.

(Merging into M65)

Bug:  801861 
Change-Id: I8fd4df034eee07403cda0a0eabef2d68ff5f272a
Reviewed-on: https://chromium-review.googlesource.com/886651
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Commit-Queue: proberge <proberge@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#532457}(cherry picked from commit b4de3afbcc0a25e6043ba7c1a2b5ef60101d0694)
Reviewed-on: https://chromium-review.googlesource.com/905580
Reviewed-by: proberge <proberge@chromium.org>
Cr-Commit-Position: refs/branch-heads/3325@{#353}
Cr-Branched-From: bc084a8b5afa3744a74927344e304c02ae54189f-refs/heads/master@{#530369}
[modify] https://crrev.com/6b7297fa4e7e916f1059b877d924e9b769c23c10/chrome/browser/ui/toolbar/toolbar_actions_model_unittest.cc
[modify] https://crrev.com/6b7297fa4e7e916f1059b877d924e9b769c23c10/chrome/common/extensions/manifest_handlers/extension_action_handler.cc

Status: Fixed (was: Assigned)
Project Member

Comment 12 by sheriffbot@chromium.org, Feb 8 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: reward-topanel
Labels: -reward-topanel reward-0
Project Member

Comment 15 by sheriffbot@chromium.org, May 16 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment