Security: Long extension name allows spoofing of Debugging InfoBar
Reported by
chromium...@gmail.com,
Mar 19 2018
|
|||||||||||||||||
Issue descriptionChrome Version: 67.0.3374.0 (Official Build) canary (64-bit) Operating System: MacOS This is a hyphothetical attack like in issue 673163 . 1. Install the extension. 2. Observe the bubble is over the wrong origin Note: I couldn't repro this on M65.
,
Mar 19 2018
Note that extension is effectively debugging the browser, so we show infobar on every tab. Truncating is a good call though.
,
Mar 20 2018
The Infobar isn't shown in Chrome 65 likely because the call to debugger.attach() in the extension fails with the error "Cannot access contents of the page. Extension manifest must request permission to access the respective host." It's not clear to me whether that call should also be failing in Chrome 67, or whether the failure was a bug in 65. https://cs.chromium.org/chromium/src/chrome/browser/extensions/api/debugger/extension_dev_tools_infobar.cc?l=69&rcl=343599182ba14cb3d98c869c1afb01edc738e296 <message name="IDS_DEV_TOOLS_INFOBAR_LABEL" desc="Label displayed in an infobar when external debugger is attached to the browser"> "<ph name="CLIENT_NAME">$1<ex>Extension Foo</ex></ph>" is debugging this browser </message>
,
Mar 20 2018
Weaknesses in the restrictions on debugger.attach look like a longstanding issue, see e.g. Issue 456994, Issue 805224
,
Mar 20 2018
,
Mar 20 2018
,
Mar 20 2018
,
May 3 2018
dgozman@ - are you the right person to drive this to completion? Otherwise, please re-assign as appropriate.
,
May 7 2018
,
May 9 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/fbeba958bb83c05ec8cc54e285a4a9ca10d1b311 commit fbeba958bb83c05ec8cc54e285a4a9ca10d1b311 Author: Dmitry Gozman <dgozman@chromium.org> Date: Wed May 09 18:14:50 2018 Allow to specify elide behavior for confrim infobar message Used in "<extension name> is debugging this browser" infobar. Bug: 823194 Change-Id: Iff6627097c020cccca8f7cc3e21a803a41fd8f2c Reviewed-on: https://chromium-review.googlesource.com/1048064 Commit-Queue: Dmitry Gozman <dgozman@chromium.org> Reviewed-by: Devlin <rdevlin.cronin@chromium.org> Reviewed-by: Peter Kasting <pkasting@chromium.org> Cr-Commit-Position: refs/heads/master@{#557245} [modify] https://crrev.com/fbeba958bb83c05ec8cc54e285a4a9ca10d1b311/chrome/browser/devtools/global_confirm_info_bar.cc [modify] https://crrev.com/fbeba958bb83c05ec8cc54e285a4a9ca10d1b311/chrome/browser/extensions/api/debugger/extension_dev_tools_infobar.cc [modify] https://crrev.com/fbeba958bb83c05ec8cc54e285a4a9ca10d1b311/chrome/browser/ui/views/infobars/confirm_infobar.cc [modify] https://crrev.com/fbeba958bb83c05ec8cc54e285a4a9ca10d1b311/components/infobars/core/confirm_infobar_delegate.cc [modify] https://crrev.com/fbeba958bb83c05ec8cc54e285a4a9ca10d1b311/components/infobars/core/confirm_infobar_delegate.h
,
May 9 2018
This should be fixed for all platforms which use views (linux and windows atm).
,
May 10 2018
,
May 14 2018
,
May 21 2018
*** Boilerplate reminders! *** Please do NOT publicly disclose details until a fix has been released to all our users. Early public disclosure may cancel the provisional reward. Also, please be considerate about disclosure when the bug affects a core library that may be used by other products. Please do NOT share this information with third parties who are not directly involved in fixing the bug. Doing so may cancel the provisional reward. Please be honest if you have already disclosed anything publicly or to third parties. Lastly, we understand that some of you are not interested in money. We offer the option to donate your reward to an eligible charity. If you prefer this option, let us know and we will also match your donation - subject to our discretion. Any rewards that are unclaimed after 12 months will be donated to a charity of our choosing. *********************************
,
May 21 2018
$500 for this one :-)
,
May 21 2018
,
May 22 2018
Issue 845270 has been merged into this issue.
,
May 29 2018
,
Jul 23
,
Aug 16
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 28
,
Jan 4
|
|||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||
Comment 1 by est...@chromium.org
, Mar 19 2018Components: Platform>Extensions Platform>Apps>DevTools
Labels: Needs-Feedback OS-Linux OS-Mac