Issue 240002: Hook up external protocol handler to user gestures to prevent malicious sites...

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Issue 240002: Hook up external protocol handler to user gestures to prevent malicious sites... (Closed)

Created:
11 years, 3 months ago by Evan Stade

Modified:
9 years, 6 months ago

Reviewers:
SkyLined

CC:
chromium-reviews_googlegroups.com, brettw, Ben Goodger (Google)

Base URL:
svn://chrome-svn/chrome/trunk/src/

Visibility:
Public.

Description

Hook up external protocol handler to user gestures to prevent malicious sites from popping up a lot of dialogs (or in the case of whitelisted protocols, launching a lot of programs). BUG=3628 TEST=test.html from crbug.com/21049 Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=27237

Patch Set 1 #

Created: 11 years, 3 months ago

Download [raw] [tar.bz2]

	Unified diffs	Side-by-side diffs	Stats (+26 lines, -1 line)			Patch
M	chrome/browser/external_protocol_handler.h	View	1 chunk	+3 lines, -0 lines	0 comments	Download
M	chrome/browser/external_protocol_handler.cc	View	6 chunks	+19 lines, -1 line	0 comments	Download
M	chrome/browser/gtk/external_protocol_dialog_gtk.cc	View	2 chunks	+2 lines, -0 lines	0 comments	Download
M	chrome/browser/tab_contents/tab_contents.cc	View	2 chunks	+2 lines, -0 lines	0 comments	Download

Messages

Total messages: 3 (0 generated)

Expand Messages | Collapse Messages

SkyLined

LGTM. Unfortunately, there is an open bug in WebKit that will probably allow bypassing this ...

11 years, 3 months ago (2009-09-25 08:34:31 UTC) #2

Evan Stade

11 years, 3 months ago (2009-09-25 18:30:41 UTC) #3

Well I can't view that bug, but I'd be pretty surprised if user gestures could
be faked for us because we only hook into events being sent to the renderer, and
don't care about anything the renderer sends back to us.

Expand Messages | Collapse Messages