Allow remote content in local CEF browsers with approved domains

Abierto
  • ¿Algo no está bien?
#5,281 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 3 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
cpp, javascript
Área
backend, security

Línea de trabajo

Start by tracing how local CEF browser instances handle navigation and resource requests, and how requestBrowserDomains approval is enforced. The issue does not name relevant files or tests, so first locate those entry points and existing browser security tests. Done means approved domains can supply remote assets to local browsers while arbitrary remote-page navigation remains blocked.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement
Is your feature request related to a problem? Please describe.

Currently, MTA does not allow local browser instances to access remote content. This is fine for preventing local browsers from loading arbitrary remote pages, but the restriction also prevents them from loading remote assets such as images, even when the domain is explicitly allowed through requestBrowserDomains.

For example, when building a UI with React, I need to execute my own JavaScript through executeBrowserJavascript. A vehicle or object browser is a simple example: it may contain several thousand images that can be displayed almost instantly by a regular browser, but fetching all of them through fetchRemote would take a significant amount of time. Bundling thousands of images with the resource is also impractical.

Describe the solution you'd like

I propose slightly relaxing this restriction so that local browsers can load remote resources, such as images, when the corresponding domain has been explicitly allowed through requestBrowserDomains.

This would still prevent local browsers from navigating to arbitrary remote pages while allowing them to use approved remote assets. It should not introduce a meaningful security risk, since loading an image or other static resource does not provide the page with capabilities beyond what could already be done through the browser's developer console.

Describe alternatives you've considered

No response

Additional context

No response

Security Policy
  • I have read and understood the Security Policy and this issue is not about a cheat or security vulnerability.
Lenguaje dominante
C++
Estrellas
1.9k
Forks
588
Merge medio
4 d 9 min
PR fusionados (30 d)
11

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de multitheftauto/mtasa-blue

Todos los issues de multitheftauto/mtasa-blue

Issues similares

Más issues de C++

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.