Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

Commit

Permalink
Limit web_accessible_resources to about:flash and about:blank
Browse files Browse the repository at this point in the history 
Fix #4913
Fix #4885

Auditors: @bbondy

Test Plan:
1. go to homestarrunner.com and verify that the flash placeholder appears
2. go to http://web.mit.edu/zyan/Public/xframe.html and verify that the iframe is blank
3. open page devtools, load about:preferences, and verify in the Network tab that the `Access-Control-Allow-Origin` response header is not present on about-preferences.html
  • Loading branch information
@diracdeltas
diracdeltas committed Oct 19, 2016
1 parent 4964f0f commit 186113e
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions app/extensions.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,8 +109,9 @@ let generateBraveManifest = () => {
]
},
web_accessible_resources: [
'about-*.html',
'img/favicon.ico'
'img/favicon.ico',
'about-flash.html',
'about-blank.html'
],
incognito: 'spanning',
key: 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAupOLMy5Fd4dCSOtjcApsAQOnuBdTs+OvBVt/3P93noIrf068x0xXkvxbn+fpigcqfNamiJ5CjGyfx9zAIs7zcHwbxjOw0Uih4SllfgtK+svNTeE0r5atMWE0xR489BvsqNuPSxYJUmW28JqhaSZ4SabYrRx114KcU6ko7hkjyPkjQa3P+chStJjIKYgu5tWBiMJp5QVLelKoM+xkY6S7efvJ8AfajxCViLGyDQPDviGr2D0VvIBob0D1ZmAoTvYOWafcNCaqaejPDybFtuLFX3pZBqfyOCyyzGhucyCmfBXJALKbhjRAqN5glNsUmGhhPK87TuGATQfVuZtenMvXMQIDAQAB'
Expand Down

4 comments on commit 186113e

@bbondy
Copy link
Member

@bbondy bbondy commented on 186113e Oct 20, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you need the other fix un-reverted too?

@bbondy
Copy link
Member

@bbondy bbondy commented on 186113e Oct 20, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also would be good to have a test for this to ensure that about:preferences can't be displayed but that about:flash can.

@diracdeltas
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bbondy nope, the other fix is not needed

@bbondy
Copy link
Member

@bbondy bbondy commented on 186113e Oct 20, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

great

Please sign in to comment.