tree 92332b59c793365899fd6b11370c07258a3e73bb
parent fd64bd7e5e17010b7c2e55be4e9fcaa8c28c4e6d
author John Ryan <ryjohn@google.com> 1789507068 -0700
committer GitHub <noreply@github.com> 1789507068 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJqqbX8CRC1aQ7uu5UhlAAAxiAQAKr6bsFbyEdkCeMOZvoGf8J9
 w5PTNk+sbXaup06WURqbTmfjAMpYgKCwnPHr5iuXmPzvh/YDnMwlLvDBpzsvYMF1
 nz3TFm0wNg2mvZxQg2bycXxnL/s3VgKT1zOCeqR6+qlGivCZ7CrcT45gtMyrUC2z
 ZlVdkXUhcjjlzeJ78bEpdiUWkBzTcrtZrZzSh9uq0C7QlNENL8er8ZXifUlVZMAd
 +jFrNW9KCp0F/ZTrHlnt6PrGVHreFGHM3wvQQQIm10bpAPRk27+Or6bJk7I0pgy7
 lWtdxySCpwIuzoEyAc9hkATNd1OluY8Dd5Jb1BGSco7izzlwi+v0UznovfgD1tXB
 tcg5B/DX3lIhEF8jRS/QetuhCYeybEPX8EbLxpMlySlFSPXUctbaeUl7XdaBwLHl
 P2wtLUGfJLTvfObpAzZmLsLerY2c+TNzlH4orxW9VehQ/b1PH39qaj767J2S4Vr8
 Jr1RIgVeiViFo9WEW/LvTt3KR7p5jl265odH4txvhjqaSaKo/TEn0dUPTrVw428s
 HHeAf1kqowCGJhsLfJ8Whb3acoRyqP78/ArKUtkwYJHYkdOb7Du9IAIE8WH7Q1b4
 wpY+ft0Gj5ZFdkOZyDI/3HV/9PWA773tvvgmqjrHO9KqUY/OFMPkwO1h9dAlEE7S
 CJKFeYWzDW0ZfnGG+jHZ
 =2HHf
 -----END PGP SIGNATURE-----
 

Add sandbox attribute to extension iframe in DevTools. (#9967)

* Add sandbox attribute to extension iframe in DevTools.

This change grants these permissions:
- `allow-scripts`: enables extension JS / Wasm execution.
- `allow-forms`: permits standard form interactions.
- `allow-downloads`: allows extensions to export files/logs.
- `allow-popups` & `allow-popups-to-escape-sandbox`: allows opening
   external links.

This does not grant `allow-same-origin` permission, so extensions can't
access the parent window's DOM, cookies, or local storage.

* Add pull request URL

* Move string to top-level variable

* Add allow-same-origin to DevTools extension iframe sandbox

Flutter Web extensions require same-origin access for flutter.js to
initialize Service Workers and web storage without throwing a
SecurityError.

This is still secure because the extension must be enabled, and
the sandbox prevents top-level navigation, popups, and modal hijacking.

* Add a timestamp to the extension placeholder

This is to ensure "force reload extension" works.

* Update extension debugging skill

* Revert "Update extension debugging skill"

This reverts commit 4cebdf8cb158d1f8b15e86cd1c5ced930ec75eee.

* Specify permissions for iframe in comment

* Revert "Add a timestamp to the extension placeholder"

This reverts commit 177df19436b9d0face3d23c2c5d15cf25c37940a.