Allow remote content in local CEF browsers with approved domains

Aperta
  • Qualcosa non va?
#5,281 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
cpp, javascript
Ambito
backend, security

Direzione di ricerca

Start by tracing how local CEF browser instances handle navigation and resource requests, and how requestBrowserDomains approval is enforced. The issue does not name relevant files or tests, so first locate those entry points and existing browser security tests. Done means approved domains can supply remote assets to local browsers while arbitrary remote-page navigation remains blocked.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement
Is your feature request related to a problem? Please describe.

Currently, MTA does not allow local browser instances to access remote content. This is fine for preventing local browsers from loading arbitrary remote pages, but the restriction also prevents them from loading remote assets such as images, even when the domain is explicitly allowed through requestBrowserDomains.

For example, when building a UI with React, I need to execute my own JavaScript through executeBrowserJavascript. A vehicle or object browser is a simple example: it may contain several thousand images that can be displayed almost instantly by a regular browser, but fetching all of them through fetchRemote would take a significant amount of time. Bundling thousands of images with the resource is also impractical.

Describe the solution you'd like

I propose slightly relaxing this restriction so that local browsers can load remote resources, such as images, when the corresponding domain has been explicitly allowed through requestBrowserDomains.

This would still prevent local browsers from navigating to arbitrary remote pages while allowing them to use approved remote assets. It should not introduce a meaningful security risk, since loading an image or other static resource does not provide the page with capabilities beyond what could already be done through the browser's developer console.

Describe alternatives you've considered

No response

Additional context

No response

Security Policy
  • I have read and understood the Security Policy and this issue is not about a cheat or security vulnerability.
Lingua principale
C++
Stelle
1.9k
Fork
588
Merge medio
4g 9m
PR unite (30g)
11

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di multitheftauto/mtasa-blue

Tutte le issue di multitheftauto/mtasa-blue

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.