Add sandbox attribute to extension iframe in DevTools. - #9967
Conversation
Sorry, something went wrong.
This change grants these permissions: - `allow-scripts`: enables extension JS / Wasm execution. - `allow-forms`: permits standard form interactions. - `allow-downloads`: allows extensions to export files/logs. - `allow-popups` & `allow-popups-to-escape-sandbox`: allows opening external links. This does not grant `allow-same-origin` permission, so extensions can't access the parent window's DOM, cookies, or local storage.
There was a problem hiding this comment.
Code Review
This pull request introduces iframe sandboxing for embedded DevTools extensions to enforce origin isolation, and updates the release notes. The reviewer recommended extracting the raw sandbox configuration string into a descriptive named constant to avoid magic strings, in accordance with the repository style guide.
Sorry, something went wrong.
|
Does this fix a specific issue that's been opened? |
Sorry, something went wrong.
|
See b/535724008 |
Sorry, something went wrong.
kenzieschmoll
left a comment
There was a problem hiding this comment.
How was this tested? The iFrame does need to talk back and forth with the parent for the DevTools extension API, so just want to make sure everything here still works.
Sorry, something went wrong.
|
This should still allow postMessage communication with DevTools, but I only tested this with the foo_ext mock package, I will test this with a real-world package and let you know if anything stops working. |
Sorry, something went wrong.
Reviewers
At least 1 approving review is required to merge this pull request.
This change grants these permissions:
This does not grant allow-same-origin permission, so extensions can't access the parent window's DOM, cookies, or local storage.