RequestPolicy/tractest — Issue #55: Update Scanner: all cross-site request from old versions/diffs of pages are blocked
Author: jsamuel
Created: 2011-12-22 02:33:49+00:00
State: open
Labels: extension

A user asks:
Is there any way to enable the links in Update Scanner while Request Policy is enabled? I tried whitelisting chrome://updatescan/content/, but that did not help.

Here's what I can see from some quick testing:

Update Scanner saves old versions of pages one wants to monitor. When looking at the old versions of pages or at the differences, all cross-site requests are blocked. The url will be something like:

{{{
chrome://updatescan/content/diffPage.xul?id=63&title=Slashdot%20-%20News%20for%20nerds%2C%20stuff%20that%20matters
&newDate=today%20at%209%3A28&oldDate=today%20at%209%3A28&url=http%3A//slashdot.org/&view=old
}}}

However, the blocked requests will be from two origins:
* about:blank
* data:text/html,then the entire page's html here

So that's why the user's attempt at whitelisting "chrome://updatescan/content/" failed: the requests aren't coming from that origin even though that's what's in the visible url when using Update Scanner. Because the blocked requests have non-chrome origins, they don't get automatically allowed. However, there may not be an easy way to whitelist these without being at risk from attacks whose origins involve `about:blank` or `data:`.

The additionally sad thing here is that the user points out that the breakage only happens with the newer version of Update Scanner that fixed their highly-publicized vulnerability from August. This may lead some people to want to keep using the old version of Update Scanner if they aren't aware of the vulnerability.