ungoogled-software/ungoogled-chromium

Separate enabling/disabling of WASM for extensions and sites

Open

#945 opened on Feb 21, 2020

View on GitHub
 (4 comments) (0 reactions) (0 assignees)Python (771 forks)batch import
enhancementhelp wanted

Repository metrics

Stars
 (18,674 stars)
PR merge metrics
 (Avg merge 1d 11h) (9 merged PRs in 30d)

Description

Is your feature request related to a problem? Please describe. Some extensions like uBlockOrigin use WebAssembly. However a security minded person may want to disable WASM (through command line option --js-flags=--noexpose_wasm) because of:

https://www.infoq.com/news/2019/10/WebAssembly-wasm-malicious-usage/ https://www.dimva2019.org/wp-content/uploads/sites/31/2019/06/DIMVA19-slides-2-R.pdf

Unfortunately this also disables WASM for extensions.

Describe the solution you'd like 2 flags:

  • enable/disable WASM for extensions
  • enable/disable WASM for websites

Contributor guide

Research direction
Locate where the js flags= noexpose wasm flag is handled in the Chromium source code, then create two separate flags (e.g., disable wasm for extensions and disable wasm for sites) to selectively disable WebAssembly for extensions and websites respectively.
Tech stack
ccpp
Domain
web devsecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitC++
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75