OLD | NEW |
1 <h1>NPAPI Plugins</h1> | 1 <h1>NPAPI Plugins</h1> |
2 | 2 |
3 <p> | 3 <p> |
4 Leveraging HTML and JavaScript | 4 Leveraging HTML and JavaScript |
5 makes developing new extensions really easy, | 5 makes developing new extensions really easy, |
6 but what if you have existing legacy or proprietary code | 6 but what if you have existing legacy or proprietary code |
7 that you want to reuse in your extension? | 7 that you want to reuse in your extension? |
8 You can bundle an NPAPI plugin with your extension, | 8 You can bundle an NPAPI plugin with your extension, |
9 allowing you to call into native binary code from JavaScript. | 9 allowing you to call into native binary code from JavaScript. |
10 </p> | 10 </p> |
11 | 11 |
12 <h2 id="warning">Warning</h2> | 12 <h2 id="warning">Warning</h2> |
13 | 13 |
14 <p align="center"><b><a href="http://blog.chromium.org/2013/09/saying-goodbye-to
-our-old-friend-npapi.html">NPAPI is being phased out.</a> | 14 <p align="center"><b><a href="http://blog.chromium.org/2013/09/saying-goodbye-to
-our-old-friend-npapi.html">NPAPI is being phased out.</a> |
15 Consider using alternatives.</b></p> | 15 Consider using alternatives.</b></p> |
16 | 16 |
17 <p align="center"><b>NPAPI is a really big hammer that should only be used when
no other approach will work.</b> | 17 <p align="center"><b>NPAPI is a really big hammer that should only be used when
no other approach will work.</b> |
18 | 18 |
19 <p>Code running in an NPAPI plugin has the full permissions of the current user
and is not sandboxed or shielded from malicious input by Google Chrome in any wa
y. You should be especially cautious when processing input from untrusted source
s, such as when working with <a href="content_scripts.html#security-consideratio
ns">content scripts</a> or XMLHttpRequest. | 19 <p>Code running in an NPAPI plugin has the full permissions of the current user
and is not sandboxed or shielded from malicious input by Google Chrome in any wa
y. You should be especially cautious when processing input from untrusted source
s, such as when working with <a href="content_scripts#security-considerations">c
ontent scripts</a> or XMLHttpRequest. |
20 | 20 |
21 <p>Because of the additional security risks NPAPI poses to users, extensions tha
t use it will require manual review before being accepted in the | 21 <p>Because of the additional security risks NPAPI poses to users, extensions tha
t use it will require manual review before being accepted in the |
22 <a href="https://chrome.google.com/webstore">Chrome Web Store</a>.</p> | 22 <a href="https://chrome.google.com/webstore">Chrome Web Store</a>.</p> |
23 | 23 |
24 <h2 id="details">Details</h2> | 24 <h2 id="details">Details</h2> |
25 | 25 |
26 <p> | 26 <p> |
27 How to develop an NPAPI plugin is outside the scope of this document. | 27 How to develop an NPAPI plugin is outside the scope of this document. |
28 See <a href="https://developer.mozilla.org/en/Plugins">Mozilla's | 28 See <a href="https://developer.mozilla.org/en/Plugins">Mozilla's |
29 NPAPI plugin reference</a> for information on how to do that. | 29 NPAPI plugin reference</a> for information on how to do that. |
(...skipping 66 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
96 to install malicious software on the user's machine. Instead, avoid | 96 to install malicious software on the user's machine. Instead, avoid |
97 including an NPAPI plugin whenever possible. | 97 including an NPAPI plugin whenever possible. |
98 </p> | 98 </p> |
99 | 99 |
100 <p> | 100 <p> |
101 Marking your NPAPI plugin "public" increase the attack surface of your | 101 Marking your NPAPI plugin "public" increase the attack surface of your |
102 extension because the plugin is exposed directly to web content, making | 102 extension because the plugin is exposed directly to web content, making |
103 it easier for a malicious web site to manipulate your plugin. Instead, | 103 it easier for a malicious web site to manipulate your plugin. Instead, |
104 avoid making your NPAPI plugin public whenever possible. | 104 avoid making your NPAPI plugin public whenever possible. |
105 </p> | 105 </p> |
OLD | NEW |