fix(chromium): refuse WebUI navigations that crash the browser - #41986
Open
krishpranav wants to merge 1 commit into
Open
fix(chromium): refuse WebUI navigations that crash the browser#41986krishpranav wants to merge 1 commit into
krishpranav wants to merge 1 commit into
Conversation
Chromium does not allow a handful of WebUI hosts in off-the-record profiles and redirects them to a normal window in the original profile. That redirect segfaults the browser process when the profile was created over CDP, which is the case for every non-persistent context. Refuse the navigation instead. Fixes: microsoft#41935
Author
|
@microsoft-github-policy-service agree |
| // "chrome:" is not a special scheme, so the URL parser leaves the host case alone | ||
| // while Chromium resolves it case-insensitively. | ||
| const { protocol, hostname } = new URL(url); | ||
| if (protocol === 'chrome:' && kWebUIHostsUnavailableOffTheRecord.has(hostname.toLowerCase())) |
Member
There was a problem hiding this comment.
what about edge://? others?
|
|
||
| export type WindowBounds = { top?: number, left?: number, width?: number, height?: number }; | ||
|
|
||
| // Chromium does not allow these WebUI hosts in off-the-record profiles, and instead redirects them |
Member
There was a problem hiding this comment.
We discourage heavy useless comments, make it brief.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
page.goto('chrome://extensions')segfaults the Chromium browser process. The trigger is navigating inside a CDP-created off-the-record browser context — every non-persistent context — to one of the WebUIs Chromium disallows in incognito (IsURLAllowedInIncognito). Those redirect to a normal window in the original profile, and that path null-derefs.connectOverCDP, and inlaunchPersistentContext.apps,extensions,help,history,password-manager,settings) in non-persistent contexts with an error pointing atlaunchPersistentContext(). Hosts that do work (version,gpu,bookmarks,downloads,flags,policy, …) are untouched, as ischrome://crash.page.gotopath only — a click orwindow.locationstill reaches Chromium directly. Measurements and the raw-CDP repro are in [Bug]:page.goto(chrome://extensions)crashes browser #41935 (comment).Fixes #41935