Content Security Policy: If set, cannot load script from bookmarklet. Is a browser extension granted clearance? - google-chrome

I'm working on browser automation tools (working at the JS level). It's pretty clear that loading external script can be considered an XSS attack. A few months ago I was able to run my scripts on Github.com so long as I served my js resources over HTTPS.
But this is no longer the case, i.e. Github has implemented an elegant standards-compliant barrier to this:
This is a great step forward I think: we can specify to the clients that we want them to put a more secure perimeter around our site's sandbox.
On the other hand it is making the options more limited on mobile platforms, though that's not entirely true because it's entirely possible to produce a standalone browser app which has these extension features built-in. Not exactly gonna be easy to accomplish compared to a browser extension, though.
Is it still possible to work around this with a (codesigned and reviewed) browser extension? What sort of user experience impact might this have? My hope is that it will be possible to set this up so that end-users only have to go through a short one-time setup. It's apparent to me that at least Google is making it so that Extensions published through their portal is distributed at least "reasonably" securely, and I imagine Apple (and eventually Microsoft) would be following suit for Safari and IE. I am only interested in Chrome and Safari for now (primarily Chrome for now).
If it turns out that somehow even extensions are subject to the content security policy, how might I write an extension that can reliably manipulate a page for me? I'm fairly sure this can't be the case as it would be the death of something like Tampermonkey.

Oh I just needed to read a little further (oh Github, you're awesome):
https://github.com/blog/1477-content-security-policy
The answer is yes! User configured scripts should always be granted clearance! (but we are off to a rocky start it seems)
I actually think there's significant opportunity for social engineering happening here; "Install this bookmark in your browser to use our cute emoticons in forums!" "oh bookmarks can't be viruses, right?"

As a workaround, you can tell your bookmarklet to load an external CSS stylesheet with your JS code injected. This bypasses CSP. Have a look at my answer to a similar question.

Related

Is it possible to hide network traffic from a browsers developer console?

I want to hide a download link from a common user that knows how to use a developer console and look at their network tab. I know they would have other means to detect the traffic but as long as they cannot see evidence of a web request within the dev console I'm satisfied. Is this possible or will every request made within a web page show up? I'm agnostic to any tool that can provide this service.
There's really no way to do this that would be reliable. You can obfuscate all you like, but the DevTools can see everything, and if they couldn't it would be a bug that the browser developers will go fix.
(The idea of using a WebSocket is a fun one, but even websocket frames are visible in DevTools these days).
Stepping back a bit, you should elaborate on what exactly you're trying to do and why you think preventing the use of Developer Tools would be useful. There is likely to be another solution that works better for what you want to achieve.

Maintain consistent design & chrome across multiple websites

In the same vein as the microservice architecture approach we're currently looking at splitting our legacy marketplace application into multiple, smaller sites. We've already carved off the checkout portion and soon to follow will be the seller portal, user portal and registration pages. Each site will be completely separate and have its own domain, data access etc.
The problem is: how do we maintain consistent site chrome (i.e. header & footer) across multiple websites? For the checkout site that we've already split off we were prepared to drop the site chrome but that's going to be a much less acceptable solution for future projects.
The ideas I've had so far are (assuming we don't want to simply duplicate the header and footer in each site):
Put the necessary HTML in a nuget package and install it in each site that needs it. This should be fairly easy to do but has the disadvantage that any change to the chrome means every site needs to be updated and redeployed. Also, it limits us to .NET for all future sites (maybe not a real concern?).
Serve all our sites through some kind of proxy site that injects the site chrome into the HTML before serving to the client. This way the site chrome is actually its own application and can be deployed independently of anything else. Disadvantage: I haven't really got any idea of how to implement this; I wasn't able to find anyone else trying anything similar on Google. Also, it might be fragile even once it's up and running due to interplay between the chrome app and the content app.
Has anyone else solved this problem before? If so, what approach did you use?

Is it possible to detect a HTML video playing on a browser?

I want to know if a html video is being displayed on a browser, from outside said browser, ideally without any plugins or such.
Motivation - I am trying to add this feature to Caffeine which is a Linux utility which disables the OS screensaver if, say, you are watching a movie.
The flash support was done I believe by detecting the presence of particular files or folders created by the plugin.
Ideally I would like 1 solution, but if I get 2 solutions for Firefox and Chrome, that's good enough.
p.s. Ultimately this would involve python code, but I am not sure if that is sufficient to make this question on-topic, or if this belongs on Superuser or Unix&Linux
This reminds me of something a web browser I was building in VB .Net which needed to detect if there where web pages that had tags like <a href="tel: or <a href="smsI know you said you didn't want a plugin but I would think you could easily right a browser plugin for for just this. In fact not exactly what your looking for but theirs a script monkey script called Hangouts Unlimited which prevents you from getting annoying messages asking if your still awake while in a G+ hangout. I don't know much about python but I would recomennd trying to identify the elements of the tags and when ever it finds such tags to disable the screen saver. Obviously the hangouts unlimited doesn't affect the web browser and that is most likely why you prefer not to have a browser plugin because you need to access system files outside of the browser. But I hope this helps a bit.

What are Chrome apps vs plugins vs extensions and how to develop them

I am trying to understand about Chrome (browser) development. I am very new to this and trying to figure out where to start in order to develop for Chrome Browser.
Just have a couple of questions:
What is the difference between Chrome Browser apps vs. plugins vs. extensions (not sure, if this question make sense. But, hope you got what I am asking for)
What kind of applications can I develop for Chrome Browser
What technologies do I need to learn in order to develop for Chrome Browser.
To answer your first question this explains the differences between apps and extensions (I think there's no better way to explain their nature):
https://developers.google.com/chrome/web-store/articles/apps_vs_extensions
What do you mean with "what kind of apps"?
You can develop both hosted and packaged apps if is that what you intended, give a look at this:
https://developers.google.com/chrome/apps/docs/index
Anyway the easiest way to start would be by building an extension, how-tos and
good documentation makes it good to start with:
http://developer.chrome.com/extensions/getstarted.html
Just to add to the above answer which was missing difference between Plugin and Extension is:
Plugin is a third-party library that is plugged-in to the browser and allows for being embedded on a webpage. It affects only the web page that is using the plugin.
Extensions change the browser UI, add menus or change overall look of the browser and can process each page that gets loaded.
So to sum it up - plugins add functionality and extra features to a particular webpage while extensions add functionality and features to the whole browser and change the behavior of the browser.
Just to add on new information since people may continue to hit this question: Chrome has basically deprecated plugins as of March 2017 (Chrome 57). If you go to chrome://plugins now, you won't see anything (you used to see a list of installed plugins with enable-disable links like for extensions).
It seems the reasoning is that the only plugins they actually wanted to allow you to enable/disable are Flash and PDF Viewer, both of which were moved to the Settings menus (if they weren't already there, not sure). The rest are considered to be integral parts of the browser. https://www.ghacks.net/2017/01/29/google-removes-plugin-controls-from-chrome/
Makes things a bit simpler to think about now.

Where is the chink in Google Chrome's armor?

While browsing with Chrome, I noticed that it responds extremely fast (in comparison with IE and Firefox on my laptop) in terms of rendering pages, including JavaScript heavy sites like gmail.
This is what googlebook on Chrome has to say
tabs are hosted in process rather than thread.
compile javascript using V8 engine as opposed to interpreting.
Introduce new virtual machine to support javascript heavy apps
introduce "hidden class transitions" and apply dynamic optimization to speed up things.
Replace inefficient "Conservative garbage colllection" scheme with more precise garbage collection scheme.
Introduce their own task scheduler and memory manager to manage the browser environment.
All this sounds so familiar, and Microsoft has been doing such things for long time.. Windows os, C++, C# etc compilers, CLR, and so on.
So why isn't Microsoft or any other browser vendor taking Chrome's approach? Is there a flaw in Chrome's approach? If not, is the rest of browser vendor community caught unaware with Google's approach?
Chrome's approach is difficult to write, and requires forethought from the developers. IE and Firefox are both attempting to move to a process-per-tab model, but due to backwards compatibility are not able to transition quickly. Chrome, being an entirely new browser build on a clean rendering engine (WebKit), was easier to write in this way.
They have crossed over from a web browser as a tool to view web pages, to a tool optimized to work for web applications. There may be some flaws in this initial release, but they are changing the game.
IE8 uses a similar individual process per tab module, though they do not use a single process per tab, but instead spread all tabs across a process pool.
#pix0r but they added a little thing in the bottom right corner so you can expand the text box any direction you want, which I love because I use a wide display and prefer to type in a wider screen.
Thats actually a WebKit feature, Chrome just inherited it.
Virtually all of these features existed in other browsers before Chrome. IE8 had process isolation for tabs. Firefox / Safari had most of the JavaScript stuff. Most browsers do their own memory management.
Chrome has a few unique features (hyperrestricted render processes, etc) which are difficult to put into other browsers due to add-on/application compatibility concerns.
The primary thing Chrome has going for it is an extremely hardcore focus on minimalism and high-performance. By focusing on these as their competitive advantages, they can appeal to users who find this area of focus compelling.
As time passes, I'm sure you will see the homogenization of features as the browsers attempt to one-up each other.
In the meanwhile, I still stick with Firefox over Chrome for the simple reason that Firefox is (i) non-profit and has a (ii) huge addon community.
Addons such as NoScript and AdBlockPlus are almost essential for me.
One chink in Chrome's armor is the fact that it renders these darned textareas on StackOverflow are so small that it's making my eyes bleed!
One chink in Chrome's armor is the fact that it renders these darned textareas on StackOverflow are so small that it's making my eyes bleed!
Yeah. I mentioned this on uservoice and got declined because the current size is evidently the default under webkit. Every other site I've tried with Chrome that uses textboxes to compose content manages to have a decent sized font. The default definitely doesn't work, but there's obviously some way to override it. Jeff needs to fix this!
Edit:
Jeff was nice enough to point out how to fix this problem yourself.
#pix0r but they added a little thing in the bottom right corner so you can expand the text box any direction you want, which I love because I use a wide display and prefer to type in a wider screen.
I also wanted to point out that Google completely built Chrome from the ground up, with the exception of using webkit, so they have some of the advantages of not having to not deal with old-code. And of course there is the INSANLELY cool/smart developers.
The biggest chink I've found is its lousy proxy support compared to IE, FF and Opera. So it's pretty much useless at work, render pages at random, and requesting authentication for the proxy, where the others pass it seamlessly.
That said on my home machine it works great, if it wasn't for the OTT EULA I'd use it now.
thing2k
One "flaw" about Chrome is that it uses more memory upfront than all of the other browsers. I'm just guessing that this is due to the overhead associated with all the separate tab management.
After it's been open for some time, however, it doesn't use more memory than other browsers.
Many companies play a game of "What's the least we can do to get the leg up?" Marketing creates a laundry list of features needed to be better than the competitors. Project management ensures engineers stick to those features for fear that the project will exceed the time allocated... which of course it will. There's not a whole lot of room in such a system for a big picture leap-ahead. The incremental improvements you see in products, and browsers, is a consequence.
You have to keep in mind that Microsoft primary business is Rich environement (GUI) Application. Web tool is a threat to them as it is platform independant (not promoting they main product).
Of course the IE team probably had figured something like that but... Microsoft definetly won't invest a lot of money in IE if what they are selling is a Rich application platform.