Chromium Code Reviews Chromium Code Reviews
Issue 10810054:
Describing the `sandbox` workflow for extension developers. (Closed)
Base URL: http://git.chromium.org/git/chromium.git@trunk| OLD | NEW |
|---|---|
| (Empty) | |
| 1 <!DOCTYPE html><!-- This page is a placeholder for generated extensions api doc. Note: | |
| 2 1) The <head> information in this page is significant, should be uniform | |
| 3 across api docs and should be edited only with knowledge of the | |
| 4 templating mechanism. | |
| 5 3) All <body>.innerHTML is genereated as an rendering step. If viewed in a | |
| 6 browser, it will be re-generated from the template, json schema and | |
| 7 authored overview content. | |
| 8 4) The <body>.innerHTML is also generated by an offline step so that this | |
| 9 page may easily be indexed by search engines. | |
| 10 --><html xmlns="http://www.w3.org/1999/xhtml"><head> | |
| 11 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> | |
| 12 <link href="../css/print.css" rel="stylesheet" type="text/css" media="print" > | |
| 13 <script type="text/javascript" src="../../../../third_party/jstemplate/jstem plate_compiled.js"> | |
| 14 </script> | |
| 15 <script type="text/javascript" src="../../../../../third_party/json_minify/m inify-sans-regexp.js"> | |
| 16 </script> | |
| 17 <script type="text/javascript" src="../js/api_page_generator.js"></script> | |
| 18 <script type="text/javascript" src="../js/bootstrap.js"></script> | |
| 19 <script type="text/javascript" src="../js/sidebar.js"></script> | |
| 20 <title>Using eval in Chrome Extensions. Safely. - Google Chrome Extensions - G oogle Code</title></head> | |
| 21 <body doc-family="apps"> <link href="../css/ApiRefStyles_apps.css" rel="style sheet" type="text/css"> | |
| 22 <link href="../css/prettify.css" rel="stylesheet" type="text/css"> | |
| 23 <link href="../css/shared.css" rel="stylesheet" type="text/css"> | |
| 24 <div id="devModeWarning" class="displayModeWarning"> | |
| 25 You are viewing extension docs in chrome via the 'file:' scheme: are you exp ecting to see local changes when you refresh? You'll need run chrome with --allo w-file-access-from-files. | |
| 26 </div> | |
| 27 <div id="branchWarning" class="displayModeWarning"> | |
| 28 <span>WARNING: This is the <span id="branchName">BETA</span> documentation. | |
| 29 It may not work with the stable release of Chrome.</span> | |
| 30 <select id="branchChooser"> | |
| 31 <option>Choose a different version... | |
| 32 </option><option value="">Stable | |
| 33 </option><option value="beta">Beta | |
| 34 </option><option value="dev">Dev | |
| 35 </option><option value="trunk">Trunk | |
| 36 </option></select> | |
| 37 </div> | |
| 38 <div id="unofficialWarning" class="displayModeWarning"> | |
| 39 <span>WARNING: This is unofficial documentation. It may not work with the | |
| 40 current release of Chrome.</span> | |
| 41 <button id="goToOfficialDocs">Go to the official docs</button> | |
| 42 </div> | |
| 43 <div id="gc-container" class="labs"> | |
| 44 <!-- SUBTEMPLATES: DO NOT MOVE FROM THIS LOCATION --> | |
| 45 <!-- In particular, sub-templates that recurse, must be used by allowing | |
| 46 jstemplate to make a copy of the template in this section which | |
| 47 are not operated on by way of the jsskip="true" --> | |
| 48 <!-- /SUBTEMPLATES --> | |
| 49 <a id="top"></a> | |
| 50 <div id="skipto"> | |
| 51 <a href="#gc-pagecontent">Skip to page content</a> | |
| 52 <a href="#gc-toc">Skip to main navigation</a> | |
| 53 </div> | |
| 54 <!-- API HEADER --> | |
| 55 <table id="header" width="100%" cellspacing="0" border="0"> | |
| 56 <tbody><tr> | |
| 57 <td valign="middle"><a href="http://code.google.com/"><img src="../image s/chrome_logo.gif" alt="Google Code" style="border:0; margin:0;"></a></td> | |
| 58 <td valign="middle" width="100%" style="padding-left:0.6em;"> | |
| 59 <form action="http://www.google.com/cse" id="cse" style="margin-top:0. 5em"> | |
| 60 <div id="gsc-search-box"> | |
| 61 <input type="hidden" name="cx" value="002967670403910741006:61_cvz fqtno"> | |
| 62 <input type="hidden" name="ie" value="UTF-8"> | |
| 63 <input id="gsc-search-input" type="text" name="q" value="" size="5 5"> | |
| 64 <button class="gsc-search-button" type="submit" name="sa"> | |
| 65 <img class="gsc-search-button-lens" src="../images/search.png" a lt="Search"> | |
| 66 </button> | |
| 67 <br> | |
| 68 <span class="greytext">e.g. "event page" or "alarms"</span> | |
| 69 </div> | |
| 70 </form> | |
| 71 <script type="text/javascript" src="https://www.google.com/jsapi"></sc ript> | |
| 72 <script type="text/javascript">google.load("elements", "1", {packages: "transliteration"});</script> | |
| 73 <script type="text/javascript" src="https://www.google.com/coop/cse/t1 3n?form=cse&t13n_langs=en"></script> | |
| 74 <script type="text/javascript" src="https://www.google.com/coop/cse/br and?form=cse&lang=en"></script> | |
| 75 </td> | |
| 76 </tr> | |
| 77 </tbody></table> | |
| 78 <div id="codesiteContent" class=""> | |
| 79 <a id="gc-topnav-anchor"></a> | |
| 80 <div id="gc-topnav"> | |
| 81 <h1>Packaged Apps</h1> | |
| 82 <ul id="home" class="gc-topnav-tabs"> | |
| 83 <li id="home_link"> | |
| 84 <a href="about_apps.html" title="Packaged Apps home page"><span>Home </span></a> | |
| 85 </li> | |
| 86 <li id="docs_link"> | |
| 87 <a href="develop_apps.html" title="Packaged apps developer documenta tion"><span>Docs</span></a> | |
| 88 </li> | |
| 89 <li id="samples_link"> | |
| 90 <a href="https://github.com/GoogleChrome/chrome-app-samples" title=" Packaged apps samples repository"><span>Samples</span></a> | |
| 91 </li> | |
| 92 <li id="group_link"> | |
| 93 <a href="http://groups.google.com/a/chromium.org/group/chromium-apps " title="Google Chrome Apps developer forum"><span>Group</span></a> | |
| 94 </li> | |
| 95 <li id="so_link"> | |
| 96 <a href="http://stackoverflow.com/questions/tagged/google-chrome-ext ension" title="[google-chrome-extension] tag on Stack Overflow"><span>Questions? </span></a> | |
| 97 </li> | |
| 98 </ul> | |
| 99 </div> <!-- end gc-topnav --> | |
| 100 <div class="g-section g-tpl-170"> | |
| 101 <!-- SIDENAV --> | |
| 102 <div class="g-unit g-first" id="gc-toc"> | |
| 103 <ul> | |
| 104 <li><h2>Getting Started</h2> | |
| 105 <ul> | |
| 106 <li><a href="about_apps.html">What Are Packaged Apps?</a></li> | |
| 107 <li><a href="app_architecture.html">Understand the Architecture</a ></li> | |
| 108 <li><a href="first_app.html">Create Your First App</a></li> | |
| 109 </ul> | |
| 110 </li> | |
| 111 <li><h2>Developing</h2> | |
| 112 <ul> | |
| 113 <li><a href="develop_apps.html">Before You Start</a></li> | |
| 114 <li><span>The Fundamentals</span> | |
| 115 <ul> | |
| 116 <li><a href="app_lifecycle.html">Manage App Lifecycle</a></li> | |
| 117 <li><a href="app_storage.html">Manage Data</a></li> | |
| 118 <li><a href="offline_apps.html">Offline First</a></li> | |
| 119 <li><a href="app_external.html">Embed Content</a></li> | |
| 120 </ul> | |
| 121 </li> | |
| 122 <li><span>Security & Privacy</span> | |
| 123 <ul> | |
| 124 <li><a href="app_identity.html">Identify User</a></li> | |
| 125 <li><a href="app_csp.html">Comply with CSP</a></li> | |
| 126 </ul> | |
| 127 </li> | |
| 128 <li><span>Advanced Technologies</span> | |
| 129 <ul> | |
| 130 <li><a href="app_network.html">Network Communications</a></li> | |
| 131 <li><a href="app_hardware.html">Access Hardware Devices</a></l i> | |
| 132 <li><a href="app_intents.html">Connect Apps with Web Intents</ a></li> | |
| 133 </ul> | |
| 134 </li> | |
| 135 <li><a href="app_frameworks.html">MVC Architecture</a></li> | |
| 136 </ul> | |
| 137 </li> | |
| 138 <li><h2>Deploying</h2> | |
| 139 <ul> | |
| 140 <li><a href="publish_app.html">Publish</a></li> | |
| 141 </ul> | |
| 142 </li> | |
| 143 <li><h2>Reference</h2> | |
| 144 <ul> | |
| 145 <li><a href="manifest.html">Manifest Files</a></li> | |
| 146 <li><a href="api_index.html">Chrome JavaScript APIs</a></li> | |
| 147 <li><a href="api_other.html">Supported Libraries</a></li> | |
| 148 <li><a href="app_deprecated.html">Disabled Web Features</a></li> | |
| 149 </ul> | |
| 150 </li> | |
| 151 <li><h2><a href="https://github.com/GoogleChrome/chrome-app-samples">S amples</a></h2></li> | |
| 152 <li><h2><a href="app_known_issues.html">Known Issues</a></h2></li> | |
| 153 </ul> | |
| 154 </div> | |
| 155 <script> | |
| 156 initToggles(); | |
| 157 </script> | |
| 158 <div class="g-unit" id="gc-pagecontent"> | |
| 159 <div id="pageTitle"> | |
| 160 <h1 class="page_title">Using eval in Chrome Extensions. Safely.</h1> | |
| 161 </div> | |
| 162 <!-- TABLE OF CONTENTS --> | |
| 163 <div id="toc"> | |
| 164 <h2>Contents</h2> | |
| 165 <ol> | |
| 166 <li> | |
| 167 <a href="#H2-0">Why sandbox?</a> | |
| 168 <ol> | |
| 169 </ol> | |
| 170 </li><li> | |
| 171 <a href="#H2-1">Creating and using a sandbox.</a> | |
| 172 <ol> | |
| 173 <li> | |
| 174 <a href="#H3-2">List files in manifest</a> | |
| 175 </li><li> | |
| 176 <a href="#H3-3">Load the sandboxed file</a> | |
| 177 </li><li> | |
| 178 <a href="#H3-4">Do something dangerous</a> | |
| 179 </li><li> | |
| 180 <a href="#H3-5">Pass the result back</a> | |
| 181 </li> | |
| 182 </ol> | |
| 183 </li> | |
| 184 </ol> | |
| 185 </div> | |
| 186 <!-- /TABLE OF CONTENTS --> | |
| 187 <!-- Standard content lead-in for experimental API pages --> | |
| 188 <!-- STATIC CONTENT PLACEHOLDER --> | |
| 189 <div id="static"><div id="pageData-name" class="pageData">Using eval in Chrome Extensions. Safely.</div> | |
| 190 <div id="pageData-showTOC" class="pageData">true</div> | |
| 191 <p> | |
| 192 Chrome's extension system enforces a fairly strict default | |
| 193 <a href="contentSecurityPolicy.html"> | |
| 194 <strong>Content Security Policy (CSP)</strong> | |
| 195 </a>. The policy restrictions are straightforward: script must be moved | |
| 196 out-of-line into separate JavaScript files, inline event handlers must be | |
| 197 converted to use <code>addEventListener</code>, and <code>eval()</code> is | |
| 198 disabled. Chrome Apps have an | |
| 199 <a href="http://developer.chrome.com/trunk/apps/app_csp.html">even more strict | |
| 200 policy</a>, and we're quite happy with the security properties these policies | |
| 201 provide. | |
| 202 </p> | |
| 203 <p> | |
| 204 We recognize, however, that a variety of libraries use <code>eval()</code> and | |
| 205 <code>eval</code>-like constructs such as <code>new Function()</code> for | |
| 206 performance optimization and ease of expression. Templating libraries are | |
| 207 especially prone to this style of implementation. While some (like | |
| 208 <a href="http://angularjs.com/">Angular.js</a>) support CSP out of the box, | |
|
Jorge Lucangeli Obes
2012/07/26 18:28:05
.org
Mike West
2012/07/27 07:58:57
Done.
| |
| 209 many popular frameworks haven't yet updated to a mechanism that is compatible | |
| 210 with extensions' <code>eval</code>-less world. Removing support for that | |
| 211 functionality has therefore proven <a href="http://crbug.com/107538">more | |
| 212 problematic than expected</a> for developers. | |
| 213 </p> | |
| 214 <p> | |
| 215 This document introduces sandboxing as a safe mechanism to include these | |
| 216 libraries in your projects without compromising on security. For brevity, | |
| 217 we'll be using the term <em>extensions</em> throughout, but the concept | |
| 218 applies equally to applications. | |
| 219 </p> | |
| 220 <a name="H2-0"></a><h2>Why sandbox?</h2> | |
| 221 <p> | |
| 222 <code>eval</code> is dangerous inside an extension because the code it | |
| 223 executes has access to everything in the extension's high-permission | |
| 224 environment. A slew of powerful <code>chrome.*</code> APIs are available that | |
| 225 could severely impact a user's security and privacy; simple data exfiltration | |
| 226 is the least of our worries. The solution on offer is a sandbox in which | |
| 227 <code>eval</code> can execute code without access either to the extension's | |
| 228 data or the extension's high-value APIs. No data, no APIs, no problem. | |
| 229 </p> | |
| 230 <p> | |
| 231 We accomplish this by listing specific HTML files inside the extension package | |
| 232 as being sandboxed. Whenever a sandboxed page is loaded, it will be moved to a | |
| 233 <a href="http://www.whatwg.org/specs/web-apps/current-work/multipage/origin-0. html#sandboxed-origin-browsing-context-flag">unique origin</a>, | |
| 234 and will be denied access to <code>chrome.*</code> APIs. If we load this | |
| 235 sandboxed page into our extension via an <code>iframe</code>, we can pass it | |
| 236 messages, let it act upon those messages in some way, and wait for it to pass | |
| 237 us back a result. This simple messaging mechanism gives us everything we need | |
| 238 to safely include <code>eval</code>-driven code in our extension's workflow. | |
| 239 </p> | |
| 240 <a name="H2-1"></a><h2>Creating and using a sandbox.</h2> | |
| 241 <p> | |
| 242 If you'd like to dive straight into code, please grab the | |
| 243 <a href="#TODO">sandboxing sample extension and take off</a>. It's a working | |
| 244 example of a tiny messaging API built on top of the | |
| 245 <a href="http://handlebarsjs.com">Handlebars</a> templating library, and it | |
| 246 should give you everything you need to get going. For those of you who'd like | |
| 247 a little more explanation, let's walk through it together here. | |
| 248 </p> | |
| 249 <a name="H3-2"></a><h3>List files in manifest</h3> | |
| 250 <p> | |
| 251 Each file that ought to be run inside a sandbox must be listed in the | |
| 252 extension manifest by adding a <code>sandbox</code> property. This is a | |
| 253 critical step, and it's easy to forget, so please double check that your | |
| 254 sandboxed file is listed in the manifest. In this sample, we're sandboxing the | |
| 255 file cleverly named "sandbox.html". The manifest entry looks like this: | |
| 256 </p> | |
| 257 <pre>{ | |
| 258 ..., | |
| 259 "sandbox": { | |
| 260 "pages": ["sandbox.html"] | |
| 261 }, | |
| 262 ... | |
| 263 }</pre> | |
| 264 <a name="H3-3"></a><h3>Load the sandboxed file</h3> | |
| 265 <p> | |
| 266 In order to do something interesting with the sandboxed file, we need to load | |
| 267 it in a context where it can be addressed by the extension's code. Here, | |
| 268 <a href="#TODO">sandbox.html</a> has been loaded into the extension's | |
| 269 <a href="http://code.google.com/chrome/extensions/dev/event_pages.html">Event | |
| 270 Page</a> (<a href="#TODO">eventpage.html</a>) via an <code>iframe</code>. | |
| 271 <a href="#TODO">eventpage.js</a> contains code that sends a message into the | |
| 272 sandbox whenever the browser action is clicked by finding the | |
| 273 <code>iframe</code> on the page, and executing the <code>postMessage</code> | |
| 274 method on its <code>contentWindow</code>. The message is an object containing | |
| 275 two properties: <code>context</code> and <code>command</code>. We'll dive into | |
| 276 both in a moment. | |
| 277 </p> | |
| 278 <pre>chrome.browserAction.onClicked.addListener(function() { | |
| 279 var iframe = document.getElementById('theFrame'); | |
| 280 var message = { | |
| 281 command: 'render', | |
| 282 context: {thing: 'world'} | |
| 283 }; | |
| 284 iframe.contentWindow.postMessage(message, '*'); | |
| 285 });</pre> | |
| 286 <p class="note">For general information about the <code>postMessage</code> API, | |
| 287 take a look at the <a href="https://developer.mozilla.org/en/DOM/window.postMess age"> | |
| 288 <code>postMessage</code> documentation on MDN | |
| 289 </a>. It's quite complete and worth reading. In particular, note that data can | |
| 290 only be passed back and forth if it's serializable. Functions, for instance, are | |
| 291 not.</p> | |
| 292 <a name="H3-4"></a><h3>Do something dangerous</h3> | |
| 293 <p> | |
| 294 When <a href="#TODO">sandbox.html</a> is loaded, it loads the Handlebars | |
| 295 library, and creates and compiles an inline template in the way Handlebars | |
| 296 suggests: | |
| 297 </p> | |
| 298 <pre><script src="handlebars-1.0.0.beta.6.js"></script> | |
| 299 <script id="hello-world-template" type="text/x-handlebars-template"> | |
| 300 <div class="entry"> | |
| 301 <h1>Hello, {{thing}}!</h1> | |
| 302 </div> | |
| 303 </script> | |
| 304 <script> | |
| 305 var templates = []; | |
| 306 var source = document.getElementById('hello-world-template').innerHTML; | |
| 307 templates['hello'] = Handlebars.compile(source); | |
| 308 </script></pre> | |
| 309 <p> | |
| 310 This doesn't fail! Even though <code>Handlebars.compile</code> ends up using | |
| 311 <code>new Function</code>, things work exactly as expected, and we end up with | |
| 312 a compiled template in <code>templates[‘hello']</code>. | |
| 313 </p> | |
| 314 <a name="H3-5"></a><h3>Pass the result back</h3> | |
| 315 <p> | |
| 316 We'll make this template available for use by setting up a message listener | |
| 317 that accepts commands from the Event Page. We'll use the <code>command</code> | |
| 318 passed in to determine what ought to be done (you could imagine doing more | |
| 319 than simply rendering; perhaps creating templates? Perhaps managing them in | |
| 320 some way?), and the <code>context</code> will be passed into the template | |
| 321 directly for rendering. The rendered HTML will be passed back to the Event | |
| 322 Page so the extension can do something useful with it later on: | |
| 323 </p> | |
| 324 <pre>window.addEventListener('message', function(event) { | |
| 325 var command = event.data.command; | |
| 326 var name = event.data.name || 'hello'; | |
| 327 switch(command) { | |
| 328 case 'render': | |
| 329 event.source.postMessage({ | |
| 330 name: name, | |
| 331 html: templates[name](event.data.context) | |
| 332 }, event.origin); | |
| 333 break; | |
| 334 // case 'somethingElse': | |
| 335 // ... | |
| 336 } | |
| 337 });</pre> | |
| 338 <p> | |
| 339 Back in the Event Page, we'll receive this message, and do something | |
| 340 interesting with the <code>html</code> data we've been passed. In this case, | |
| 341 we'll just echo it out via a <a href="notifications.html">Desktop | |
| 342 Notification</a>, but it's entirely possible to use this HTML safely as part | |
| 343 of the extension's UI. Inserting it via <code>innerHTML</code> doesn't pose a | |
|
Jorge Lucangeli Obes
2012/07/26 18:28:05
The risks introduced by innerHTML don't completely
Mike West
2012/07/27 07:58:57
Good point. We should be careful about the securit
| |
| 344 security risk, as we're protected in this context from unintentional execution | |
| 345 of inline script. | |
| 346 </p> | |
| 347 <p> | |
| 348 This mechanism makes templating straightforward, but it of course isn't | |
| 349 limited to templating. For example, the | |
| 350 <a href="https://github.com/GoogleChrome/chrome-app-samples/blob/master/regex- tester/">Regex Tester</a> | |
| 351 application uses <code>eval</code> to dynamically generate and test regular | |
| 352 expressions. It's built similarly, and would also be good for you to take a | |
| 353 look at before building your own sandboxed application or extension. | |
| 354 </p> | |
| 355 </div> | |
| 356 <!-- API PAGE --> | |
| 357 <!-- /apiPage --> | |
| 358 </div> <!-- /gc-pagecontent --> | |
| 359 </div> <!-- /g-section --> | |
| 360 </div> <!-- /codesiteContent --> | |
| 361 <div id="gc-footer" --=""> | |
| 362 <div class="text"> | |
| 363 <p> | |
| 364 Except as otherwise <a href="http://code.google.com/policies.html#restrictions ">noted</a>, | |
| 365 the content of this page is licensed under the <a rel="license" href="http://c reativecommons.org/licenses/by/3.0/">Creative Commons | |
| 366 Attribution 3.0 License</a>, and code samples are licensed under the | |
| 367 <a rel="license" href="http://code.google.com/google_bsd_license.html">BSD Lic ense</a>. | |
| 368 </p> | |
| 369 <p> | |
| 370 ©2012 Google | |
| 371 </p> | |
| 372 <!-- begin analytics --> | |
| 373 <script src="https://www.google-analytics.com/urchin.js" type="text/javascript"> </script> | |
| 374 <script src="https://www.google-analytics.com/ga.js" type="text/javascript"></sc ript> | |
| 375 <script src="../js/prettify.js" type="text/javascript"></script> | |
| 376 <script> | |
| 377 // Auto syntax highlight all pre tags. | |
| 378 var pres = document.querySelectorAll('pre'); | |
| 379 for (var i = 0, pre; pre = pres[i]; ++i) { | |
| 380 pre.className += ' prettyprint'; | |
| 381 }; | |
| 382 prettyPrint(); | |
| 383 </script> | |
| 384 <script type="text/javascript"> | |
| 385 // chrome doc tracking | |
| 386 try { | |
| 387 var engdocs = _gat._getTracker("YT-10763712-2"); | |
| 388 engdocs._trackPageview(); | |
| 389 } catch(err) {} | |
| 390 // code.google.com site-wide tracking | |
| 391 try { | |
| 392 _uacct="UA-18071-1"; | |
| 393 _uanchor=1; | |
| 394 _uff=0; | |
| 395 urchinTracker(); | |
| 396 } | |
| 397 catch(e) {/* urchinTracker not available. */} | |
| 398 </script> | |
| 399 <!-- end analytics --> | |
| 400 </div> | |
| 401 </div> <!-- /gc-footer --> | |
| 402 </div> <!-- /gc-container --> | |
| 403 </body></html> | |
| OLD | NEW |
