Google apps whitelist hardcoded into Chromium open source project

#1

Post by RyanZAG » Wed, Nov 13, 2013, 7:08 AM UTC

Google apps whitelist hardcoded into Chromium open source project
code.google.com

Re: Google apps whitelist hardcoded into Chromium open source project

#2

Post by rurounijones » Wed, Nov 13, 2013, 7:42 AM UTC

What whitelist?

JS Execution? No popup blocking? Something else?

Re: Google apps whitelist hardcoded into Chromium open source project

#3

Post by [deleted] » Wed, Nov 13, 2013, 7:43 AM UTC

[deleted]

Re: Google apps whitelist hardcoded into Chromium open source project

#4

Post by darren_ » Wed, Nov 13, 2013, 7:44 AM UTC

rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

Just a guess but there's a comment:

// Temporarily allow these whitelisted apps and WebUIs to use NaCl.

And it's in a function called "IsNaClAllowed"

Re: Google apps whitelist hardcoded into Chromium open source project

#5

Post by jpx_ » Wed, Nov 13, 2013, 7:44 AM UTC

rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

Looks like it's a whitelist for Native Client.

Re: Google apps whitelist hardcoded into Chromium open source project

#6

Post by millstone » Wed, Nov 13, 2013, 7:44 AM UTC

rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

The function name is "bool ChromeContentRendererClient::IsNaClAllowed", so I guess that.

Re: Google apps whitelist hardcoded into Chromium open source project

#7

Post by mhlakhani » Wed, Nov 13, 2013, 7:44 AM UTC

rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

      // Temporarily allow these whitelisted apps and WebUIs to use NaCl.

For NaCl, presumably.

Re: Google apps whitelist hardcoded into Chromium open source project

#8

Post by WestCoastJustin » Wed, Nov 13, 2013, 7:49 AM UTC

rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

To me, it looks like they are allowing https @ plus.google.com, plus.sandbox.google.com, ssl.gstatic.com, talk.google.com, talkgadget.google.com, and ssl.gstatic.com to use WebUIs (most likely Dart web apps) [1] and NaCl [2].

  // Temporarily allow these whitelisted apps and WebUIs to use NaCl.

> Google Native Client (NaCl) is a sandboxing technology for running a subset of Intel x86 or ARM native code in a sandbox. It is proposed for safely running native code from a web browser, allowing web-based applications to run at near-native speeds,[2] which aligns well with Google's plans with Chrome OS. It may also be used for securing browser plugins, and in the future parts of other applications or full applications. [2]

[1] https://www.dartlang.org/articles/web-ui/

[2] http://en.wikipedia.org/wiki/Google_Native_Client

Re: Google apps whitelist hardcoded into Chromium open source project

#9

Post by rurounijones » Wed, Nov 13, 2013, 7:50 AM UTC

darren_ wrote: post #4

rurounijones wrote: post #2

What whitelist? JS Execution? No popup blocking? Something else?

Just a guess but there's a comment: // Temporarily allow these whitelisted apps and WebUIs to use NaCl. And it's in a function called "IsNaClAllowed"

I am not 100% familiar with NaCL but it this a download / install whitelist then for NaCL programs?

[EDIT] answered by https://news.ycombinator.com/item?id=6723930

Re: Google apps whitelist hardcoded into Chromium open source project

#10

Post by steve-slicify » Wed, Nov 13, 2013, 7:51 AM UTC

From the source: Allow Chrome Web Store extensions, built-in extensions and extensions under development (for calls from whitelisted apps amongst others)