News for hackers. Stuff that matters.

A comment on I no longer trust The Great Suspender. Parent comment

Re:I no longer trust The Great Suspender by nitrogen on Wednesday January 20, 2021 @12:59PM (#25849584)
Trying to sandbox an extension that can modify arbitrary webpages in arbitrary ways is near futile.

Just don't let them create script elements, or add any URLs that don't come from within the extension bundle itself. Browsers already have to do a ton of bookkeeping to track the origins of requests anyway. Doesn't seem hard, you just have to be thorough.

[ Parent | on HN ]
Re:I no longer trust The Great Suspender by Dylan16807 on Wednesday January 20, 2021 @02:24PM (#25850735)
Restricting the extension to pre-baked URLs means it takes several page loads to exfiltrate something, but doesn't stop it.
[ Parent | on HN ]
Re:I no longer trust The Great Suspender by londons_explore on Wednesday January 20, 2021 @01:03PM (#25849639)
There would be ways to trick the original page into adding stuff for you.

For example, you could patch some of the original script of the page and wait for it to be run.

[ Parent | on HN ]