davidben/embedded-emacs — Issue #12: Launcher should validate window id
Author: davidben
Created: 2012-02-15 01:12:44+00:00
State: open

Right now the launcher plugin does not validate the window id in any way. This means that a compromised renderer can, if embedded-emacs is installed, launch a copy of the user's editor with an arbitrary integer as the parent window id. This is probably not horrible, but it's still not nice. Better would be if the container plugin reported an opaque handle to the particular and the launcher could somehow convert that handle to a window id by communicating with the container. (Maybe by querying some control instance of the container, instantiated on the background page.) Or the handle doesn't have to be opaque and just provide an isValidWindow hook?

Unfortunately, this would complicate the container plugin, and I'm not too happy about making the public plugin more complex.

Also, this means I should probably care about race conditions between container instance destroy and editor launch.