This repository has been archived by the owner on Dec 11, 2019. It is now read-only.
Update Brave CSPs #12263
Assignees
Labels
Milestone
Comments
diracdeltas
added a commit
that referenced
this issue
Dec 12, 2017
Removes the following hosts from the connect-src directive: https://s3.amazonaws.com/adblock-data/ https://s3.amazonaws.com/safe-browsing-data/ https://s3.amazonaws.com/tracking-protection-data/ https://s3.amazonaws.com/https-everywhere-data/ https://brave-download.global.ssl.fastly.net https://brave-laptop-updates.global.ssl.fastly.net https://laptop-updates-pre.brave.com https://brave-laptop-updates-pre.brave.com These are not necessary to whitelist in CSP since they are only connected to from the main process, not the renderer process. fix #12263 Test Plan: 1. automated test passes 2. Delete httpse.json, *.dat, and `Extensions/jdbefljfgobbmcidnmpjamcbhnbphjnb/` in your brave APP_DATA directory (ex: `/Users/yan/Library/Application Support/Brave`) 3. Build a package if not running from a pre-packaged version of brave: `CHANNEL=dev npm run build-package` 4. Open the packaged version of Brave 5. Click 'Check for updates' from the file menu. It should show that no updates are available instead of an error. 6. Make sure opening a PDF works 7. Make sure HTTPS Everywhere works using https://https-everywhere.badssl.com/
diracdeltas
added a commit
that referenced
this issue
Dec 12, 2017
Removes all search provider autocomplete hosts and the following hosts from the connect-src directive: https://s3.amazonaws.com/adblock-data/ https://s3.amazonaws.com/safe-browsing-data/ https://s3.amazonaws.com/tracking-protection-data/ https://s3.amazonaws.com/https-everywhere-data/ https://brave-download.global.ssl.fastly.net https://brave-laptop-updates.global.ssl.fastly.net https://laptop-updates-pre.brave.com https://brave-laptop-updates-pre.brave.com These are not necessary to whitelist in CSP since they are only connected to from the main process, not the renderer process. fix #12263 Test Plan: 1. automated test passes 2. Delete httpse.json, *.dat, and `Extensions/jdbefljfgobbmcidnmpjamcbhnbphjnb/` in your brave APP_DATA directory (ex: `/Users/yan/Library/Application Support/Brave`) 3. Build a package if not running from a pre-packaged version of brave: `CHANNEL=dev npm run build-package` 4. Open the packaged version of Brave 5. Click 'Check for updates' from the file menu. It should show that no updates are available instead of an error. 6. Make sure opening a PDF works 7. Make sure HTTPS Everywhere works using https://https-everywhere.badssl.com/ 8. Go to settings -> turn on `Autocomplete search term as you type`. Type some words in the URL bar and you should see the query autocompleted.
8 tasks
diracdeltas
added a commit
that referenced
this issue
Dec 14, 2017
Removes all search provider autocomplete hosts and the following hosts from the connect-src directive: https://s3.amazonaws.com/adblock-data/ https://s3.amazonaws.com/safe-browsing-data/ https://s3.amazonaws.com/tracking-protection-data/ https://s3.amazonaws.com/https-everywhere-data/ https://brave-download.global.ssl.fastly.net https://brave-laptop-updates.global.ssl.fastly.net https://laptop-updates-pre.brave.com https://brave-laptop-updates-pre.brave.com These are not necessary to whitelist in CSP since they are only connected to from the main process, not the renderer process. fix #12263 Test Plan: 1. automated test passes 2. Delete httpse.json, *.dat, and `Extensions/jdbefljfgobbmcidnmpjamcbhnbphjnb/` in your brave APP_DATA directory (ex: `/Users/yan/Library/Application Support/Brave`) 3. Build a package if not running from a pre-packaged version of brave: `CHANNEL=dev npm run build-package` 4. Open the packaged version of Brave 5. Click 'Check for updates' from the file menu. It should show that no updates are available instead of an error. 6. Make sure opening a PDF works 7. Make sure HTTPS Everywhere works using https://https-everywhere.badssl.com/ 8. Go to settings -> turn on `Autocomplete search term as you type`. Type some words in the URL bar and you should see the query autocompleted.
This was referenced Dec 27, 2017
This was referenced Jan 2, 2018
29 tasks
34 tasks
|
@diracdeltas because Linux/Ubuntu doesn't have an update mechanism implemented within the browser, the following step can't be checked:
Is skipping the above step and going through the others sufficient enough to call this verified under Linux? |
|
@kjozwiak yup that should be fine |
This was referenced Jan 24, 2018
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Test plan
#12268 (comment)
They haven't been updated in a while and might include hosts that are no longer used.
in app/extensions/brave/index-dev.html:
in app/extensions/brave/index.html:
Related: #11889 #12190
The text was updated successfully, but these errors were encountered: