Comments (2)
It would still be able to access its own origin (e.g. chrome-extension://randomextid
, all extensions can with zero permissions declared), and I'm not sure there is a meaningful distinction here. Not sure how ftp://
works, but file://
you have to explicitly toggle a setting in the extension's specific chrome://extensions
setting page which seems unlikely to happen/be part of an attack.
For 99% of use cases, I'd imagine if an extension has https://*/*
and http://*/*
then it's basically functionally equivalent to <all_urls>
. Same for if someone used *://*/*
(also a valid host match pattern apparently).
Were you thinking the docs should be a bit more clear on this point?
from cursedchrome.
Yeah, it might not be bad. I thought (and in my own testing, it appears correct) that "https://*/*", "http://*/*"
just works, but I was wondering if there was an edge case I was not considering.
from cursedchrome.
Related Issues (20)
- Duplicate headers are not properly handled HOT 1
- Streaming HTTP responses not handled
- Javascript setting a cookie client-side is not propagated to victim HOT 2
- Cookies already present on the victim not propagated to attacker HOT 3
- Ability to delete Bots
- Show UUID in UI HOT 1
- Requiring `redirect-hack.html` for redirects makes injecting into existing extensions break this functionality HOT 2
- Injecting into strict mode fails
- Blank Screen HOT 2
- Binary Request Body Gets Corrupted HOT 1
- i need help pls showing error HOT 3
- Chrome Plugin Error
- Failed to parse or set cookie named "__Host-xxxxx".
- Unauthenticated WebSocket has disconnected from us.
- Provide way to enable anyproxy logging
- plz i need help WebSocket does not appear to be live HOT 8
- 2023-07-06
- must wait 1000 years to load the pages this Project is waste of time
- Requesting Assistance with Slow Server-Browser Connection 💁👌 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cursedchrome.