SlideShare une entreprise Scribd logo
1  sur  14
Télécharger pour lire hors ligne
Finer control of DNR rules
Felipe Erias
BlinkOn 16 — May 2022
1
Hello!
Felipe Erias
felipeerias in GitHub, Twitter
felipeerias@igalia.com
2
Web Extensions: manifest V3
Privacy: less need to access user data
Security: stricter protocols and requirements
Performance
Follow the Web Platform way of doing things
Keep the platform capable and valuable for users
3
Declarative Net Request
Provide control over network requests (including
blocking resources)
Previously: network requests are intercepted and
evaluated in the extension process
Now: extension declares a set of rules that the
browser uses to evaluate and modify requests
4
Rule resources (1)
Static lists of rules are bundled with the extension
Can only be modified by updating the extension
Enabled and disabled as a whole
Limits: 10 enabled lists, up to 30,000 rules
// Enable ruleset with id "myRules"

chrome.declarativeNetRequest.updateEnabledRulesets(

{

disableRulesetIds: ["unusedList"],

enableRulesetIds: ["myRules"]

}
5
Rule resources (2)
Dynamic rules
Can be added and removed one by one
Lifetimes
only current session, or
across sessions and extensions updates
Limit: up to 5,000 rules
chrome.declarativeNetRequest.updateDynamicRules(…);

chrome.declarativeNetRequest.updateSessionRules(…);
6
The problem
What if one of the rules in these lists has an error?
7
8
Going forward?
With the move to Declarative Net Request, this will
become harder to fix:
Need to update the extension to amend the
problematic static rule
Disabling the whole list breaks functionality
Adding a dynamic rule risks side effects
9
A possible solution
What about disabling that misbehaving static rule?
10
Our proposal
When you enable a static list you may disable some of
its rules
// Enable ruleset with id "myRules",

// but disabling rules 1 and 5

chrome.declarativeNetRequest.updateEnabledRulesets({
disableRulesetIds: ["unusedList"],

enableRulesetIds: ["myRules"],

disableRules: [{

rulesetId: "myRules",

disableRulesIds: [ 1, 5 ]

}]

});
11
Feedback welcome!
Chromium bug

Web Extensions WG

Extension API proposal

https://crbug.com/1225229
https://github.com/w3c/webextensions/issues/162
https://docs.google.com/document/d/1NTOTr6iwm0dJbewWjnABmPo6h1QD1mKTpX60s6Klj-
8/edit?usp=sharing
12
Thank you!
13
14

Contenu connexe

Similaire à Finer Control of Declarative Net Request Rules

Title Fedora Linux OS Access Control__20231104_222610_0000.pptx
Title Fedora Linux OS Access Control__20231104_222610_0000.pptxTitle Fedora Linux OS Access Control__20231104_222610_0000.pptx
Title Fedora Linux OS Access Control__20231104_222610_0000.pptx
kaverizanzane1
 
Automated Inference of Access Control Policies for Web Applications
Automated Inference of Access Control Policies for Web ApplicationsAutomated Inference of Access Control Policies for Web Applications
Automated Inference of Access Control Policies for Web Applications
Lionel Briand
 
0828 Windows Server 2008 新安全功能探討
0828 Windows Server 2008 新安全功能探討0828 Windows Server 2008 新安全功能探討
0828 Windows Server 2008 新安全功能探討
Timothy Chen
 
Teradata online training
Teradata online trainingTeradata online training
Teradata online training
Monster Courses
 

Similaire à Finer Control of Declarative Net Request Rules (20)

Chapter 3 access control fundamental i
Chapter 3   access control fundamental iChapter 3   access control fundamental i
Chapter 3 access control fundamental i
 
Hexatier - MySQL Role-based Security & Data Masking
Hexatier - MySQL Role-based Security & Data MaskingHexatier - MySQL Role-based Security & Data Masking
Hexatier - MySQL Role-based Security & Data Masking
 
2008-10-15 Red Hat Deep Dive Sessions: SELinux
2008-10-15 Red Hat Deep Dive Sessions: SELinux2008-10-15 Red Hat Deep Dive Sessions: SELinux
2008-10-15 Red Hat Deep Dive Sessions: SELinux
 
Gradution Project
Gradution ProjectGradution Project
Gradution Project
 
Title Fedora Linux OS Access Control__20231104_222610_0000.pptx
Title Fedora Linux OS Access Control__20231104_222610_0000.pptxTitle Fedora Linux OS Access Control__20231104_222610_0000.pptx
Title Fedora Linux OS Access Control__20231104_222610_0000.pptx
 
information security(authentication application, Authentication and Access Co...
information security(authentication application, Authentication and Access Co...information security(authentication application, Authentication and Access Co...
information security(authentication application, Authentication and Access Co...
 
Popeye – Fine-grained Network Access Control for Mobile Users
Popeye – Fine-grained Network Access Control for Mobile UsersPopeye – Fine-grained Network Access Control for Mobile Users
Popeye – Fine-grained Network Access Control for Mobile Users
 
Creating a fortress in your active directory environment
Creating a fortress in your active directory environmentCreating a fortress in your active directory environment
Creating a fortress in your active directory environment
 
3 the system architecture
3 the system architecture3 the system architecture
3 the system architecture
 
MCSA 70-412 Chapter 03
MCSA 70-412 Chapter 03MCSA 70-412 Chapter 03
MCSA 70-412 Chapter 03
 
2008 08-12 SELinux: A Key Component in Secure Infrastructures
2008 08-12 SELinux: A Key Component in Secure Infrastructures2008 08-12 SELinux: A Key Component in Secure Infrastructures
2008 08-12 SELinux: A Key Component in Secure Infrastructures
 
Android secuirty permission - upload
Android secuirty   permission - uploadAndroid secuirty   permission - upload
Android secuirty permission - upload
 
Automated Inference of Access Control Policies for Web Applications
Automated Inference of Access Control Policies for Web ApplicationsAutomated Inference of Access Control Policies for Web Applications
Automated Inference of Access Control Policies for Web Applications
 
Database security and security in networks
Database security and security in networksDatabase security and security in networks
Database security and security in networks
 
Hadoop and Data Access Security
Hadoop and Data Access SecurityHadoop and Data Access Security
Hadoop and Data Access Security
 
Controlling Delegation of Windows Servers and Active Directory
Controlling Delegation of Windows Servers and Active DirectoryControlling Delegation of Windows Servers and Active Directory
Controlling Delegation of Windows Servers and Active Directory
 
Building Cyber-infrastructure at UNC-CH
Building Cyber-infrastructure at UNC-CHBuilding Cyber-infrastructure at UNC-CH
Building Cyber-infrastructure at UNC-CH
 
Non-Invasive Elimination of Logical Access Control Vulnerabilities in Web A...
Non-Invasive Elimination of  Logical Access Control  Vulnerabilities in Web A...Non-Invasive Elimination of  Logical Access Control  Vulnerabilities in Web A...
Non-Invasive Elimination of Logical Access Control Vulnerabilities in Web A...
 
0828 Windows Server 2008 新安全功能探討
0828 Windows Server 2008 新安全功能探討0828 Windows Server 2008 新安全功能探討
0828 Windows Server 2008 新安全功能探討
 
Teradata online training
Teradata online trainingTeradata online training
Teradata online training
 

Plus de Igalia

Building End-user Applications on Embedded Devices with WPE
Building End-user Applications on Embedded Devices with WPEBuilding End-user Applications on Embedded Devices with WPE
Building End-user Applications on Embedded Devices with WPE
Igalia
 
Automated Testing for Web-based Systems on Embedded Devices
Automated Testing for Web-based Systems on Embedded DevicesAutomated Testing for Web-based Systems on Embedded Devices
Automated Testing for Web-based Systems on Embedded Devices
Igalia
 
Running JS via WASM faster with JIT
Running JS via WASM      faster with JITRunning JS via WASM      faster with JIT
Running JS via WASM faster with JIT
Igalia
 
Introducción a Mesa. Caso específico dos dispositivos Raspberry Pi por Igalia
Introducción a Mesa. Caso específico dos dispositivos Raspberry Pi por IgaliaIntroducción a Mesa. Caso específico dos dispositivos Raspberry Pi por Igalia
Introducción a Mesa. Caso específico dos dispositivos Raspberry Pi por Igalia
Igalia
 

Plus de Igalia (20)

A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Building End-user Applications on Embedded Devices with WPE
Building End-user Applications on Embedded Devices with WPEBuilding End-user Applications on Embedded Devices with WPE
Building End-user Applications on Embedded Devices with WPE
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
 
Automated Testing for Web-based Systems on Embedded Devices
Automated Testing for Web-based Systems on Embedded DevicesAutomated Testing for Web-based Systems on Embedded Devices
Automated Testing for Web-based Systems on Embedded Devices
 
Embedding WPE WebKit - from Bring-up to Maintenance
Embedding WPE WebKit - from Bring-up to MaintenanceEmbedding WPE WebKit - from Bring-up to Maintenance
Embedding WPE WebKit - from Bring-up to Maintenance
 
Optimizing Scheduler for Linux Gaming.pdf
Optimizing Scheduler for Linux Gaming.pdfOptimizing Scheduler for Linux Gaming.pdf
Optimizing Scheduler for Linux Gaming.pdf
 
Running JS via WASM faster with JIT
Running JS via WASM      faster with JITRunning JS via WASM      faster with JIT
Running JS via WASM faster with JIT
 
To crash or not to crash: if you do, at least recover fast!
To crash or not to crash: if you do, at least recover fast!To crash or not to crash: if you do, at least recover fast!
To crash or not to crash: if you do, at least recover fast!
 
Implementing a Vulkan Video Encoder From Mesa to GStreamer
Implementing a Vulkan Video Encoder From Mesa to GStreamerImplementing a Vulkan Video Encoder From Mesa to GStreamer
Implementing a Vulkan Video Encoder From Mesa to GStreamer
 
8 Years of Open Drivers, including the State of Vulkan in Mesa
8 Years of Open Drivers, including the State of Vulkan in Mesa8 Years of Open Drivers, including the State of Vulkan in Mesa
8 Years of Open Drivers, including the State of Vulkan in Mesa
 
Introducción a Mesa. Caso específico dos dispositivos Raspberry Pi por Igalia
Introducción a Mesa. Caso específico dos dispositivos Raspberry Pi por IgaliaIntroducción a Mesa. Caso específico dos dispositivos Raspberry Pi por Igalia
Introducción a Mesa. Caso específico dos dispositivos Raspberry Pi por Igalia
 
2023 in Chimera Linux
2023 in Chimera                    Linux2023 in Chimera                    Linux
2023 in Chimera Linux
 
Building a Linux distro with LLVM
Building a Linux distro        with LLVMBuilding a Linux distro        with LLVM
Building a Linux distro with LLVM
 
turnip: Update on Open Source Vulkan Driver for Adreno GPUs
turnip: Update on Open Source Vulkan Driver for Adreno GPUsturnip: Update on Open Source Vulkan Driver for Adreno GPUs
turnip: Update on Open Source Vulkan Driver for Adreno GPUs
 
Graphics stack updates for Raspberry Pi devices
Graphics stack updates for Raspberry Pi devicesGraphics stack updates for Raspberry Pi devices
Graphics stack updates for Raspberry Pi devices
 
Delegated Compositing - Utilizing Wayland Protocols for Chromium on ChromeOS
Delegated Compositing - Utilizing Wayland Protocols for Chromium on ChromeOSDelegated Compositing - Utilizing Wayland Protocols for Chromium on ChromeOS
Delegated Compositing - Utilizing Wayland Protocols for Chromium on ChromeOS
 
MessageFormat: The future of i18n on the web
MessageFormat: The future of i18n on the webMessageFormat: The future of i18n on the web
MessageFormat: The future of i18n on the web
 
Replacing the geometry pipeline with mesh shaders
Replacing the geometry pipeline with mesh shadersReplacing the geometry pipeline with mesh shaders
Replacing the geometry pipeline with mesh shaders
 
I'm not an AMD expert, but...
I'm not an AMD expert, but...I'm not an AMD expert, but...
I'm not an AMD expert, but...
 
Status of Vulkan on Raspberry
Status of Vulkan on RaspberryStatus of Vulkan on Raspberry
Status of Vulkan on Raspberry
 

Dernier

JustNaik Solution Deck (stage bus sector)
JustNaik Solution Deck (stage bus sector)JustNaik Solution Deck (stage bus sector)
JustNaik Solution Deck (stage bus sector)
Max Lee
 

Dernier (20)

AI/ML Infra Meetup | ML explainability in Michelangelo
AI/ML Infra Meetup | ML explainability in MichelangeloAI/ML Infra Meetup | ML explainability in Michelangelo
AI/ML Infra Meetup | ML explainability in Michelangelo
 
APVP,apvp apvp High quality supplier safe spot transport, 98% purity
APVP,apvp apvp High quality supplier safe spot transport, 98% purityAPVP,apvp apvp High quality supplier safe spot transport, 98% purity
APVP,apvp apvp High quality supplier safe spot transport, 98% purity
 
The Impact of PLM Software on Fashion Production
The Impact of PLM Software on Fashion ProductionThe Impact of PLM Software on Fashion Production
The Impact of PLM Software on Fashion Production
 
Secure Software Ecosystem Teqnation 2024
Secure Software Ecosystem Teqnation 2024Secure Software Ecosystem Teqnation 2024
Secure Software Ecosystem Teqnation 2024
 
GraphSummit Stockholm - Neo4j - Knowledge Graphs and Product Updates
GraphSummit Stockholm - Neo4j - Knowledge Graphs and Product UpdatesGraphSummit Stockholm - Neo4j - Knowledge Graphs and Product Updates
GraphSummit Stockholm - Neo4j - Knowledge Graphs and Product Updates
 
COMPUTER AND ITS COMPONENTS PPT.by naitik sharma Class 9th A mittal internati...
COMPUTER AND ITS COMPONENTS PPT.by naitik sharma Class 9th A mittal internati...COMPUTER AND ITS COMPONENTS PPT.by naitik sharma Class 9th A mittal internati...
COMPUTER AND ITS COMPONENTS PPT.by naitik sharma Class 9th A mittal internati...
 
Entropy, Software Quality, and Innovation (presented at Princeton Plasma Phys...
Entropy, Software Quality, and Innovation (presented at Princeton Plasma Phys...Entropy, Software Quality, and Innovation (presented at Princeton Plasma Phys...
Entropy, Software Quality, and Innovation (presented at Princeton Plasma Phys...
 
AI Hackathon.pptx
AI                        Hackathon.pptxAI                        Hackathon.pptx
AI Hackathon.pptx
 
AI/ML Infra Meetup | Perspective on Deep Learning Framework
AI/ML Infra Meetup | Perspective on Deep Learning FrameworkAI/ML Infra Meetup | Perspective on Deep Learning Framework
AI/ML Infra Meetup | Perspective on Deep Learning Framework
 
Agnieszka Andrzejewska - BIM School Course in Kraków
Agnieszka Andrzejewska - BIM School Course in KrakówAgnieszka Andrzejewska - BIM School Course in Kraków
Agnieszka Andrzejewska - BIM School Course in Kraków
 
JustNaik Solution Deck (stage bus sector)
JustNaik Solution Deck (stage bus sector)JustNaik Solution Deck (stage bus sector)
JustNaik Solution Deck (stage bus sector)
 
IT Software Development Resume, Vaibhav jha 2024
IT Software Development Resume, Vaibhav jha 2024IT Software Development Resume, Vaibhav jha 2024
IT Software Development Resume, Vaibhav jha 2024
 
Facemoji Keyboard released its 2023 State of Emoji report, outlining the most...
Facemoji Keyboard released its 2023 State of Emoji report, outlining the most...Facemoji Keyboard released its 2023 State of Emoji report, outlining the most...
Facemoji Keyboard released its 2023 State of Emoji report, outlining the most...
 
Workforce Efficiency with Employee Time Tracking Software.pdf
Workforce Efficiency with Employee Time Tracking Software.pdfWorkforce Efficiency with Employee Time Tracking Software.pdf
Workforce Efficiency with Employee Time Tracking Software.pdf
 
CompTIA Security+ (Study Notes) for cs.pdf
CompTIA Security+ (Study Notes) for cs.pdfCompTIA Security+ (Study Notes) for cs.pdf
CompTIA Security+ (Study Notes) for cs.pdf
 
KLARNA - Language Models and Knowledge Graphs: A Systems Approach
KLARNA -  Language Models and Knowledge Graphs: A Systems ApproachKLARNA -  Language Models and Knowledge Graphs: A Systems Approach
KLARNA - Language Models and Knowledge Graphs: A Systems Approach
 
A Comprehensive Appium Guide for Hybrid App Automation Testing.pdf
A Comprehensive Appium Guide for Hybrid App Automation Testing.pdfA Comprehensive Appium Guide for Hybrid App Automation Testing.pdf
A Comprehensive Appium Guide for Hybrid App Automation Testing.pdf
 
Implementing KPIs and Right Metrics for Agile Delivery Teams.pdf
Implementing KPIs and Right Metrics for Agile Delivery Teams.pdfImplementing KPIs and Right Metrics for Agile Delivery Teams.pdf
Implementing KPIs and Right Metrics for Agile Delivery Teams.pdf
 
AI/ML Infra Meetup | Reducing Prefill for LLM Serving in RAG
AI/ML Infra Meetup | Reducing Prefill for LLM Serving in RAGAI/ML Infra Meetup | Reducing Prefill for LLM Serving in RAG
AI/ML Infra Meetup | Reducing Prefill for LLM Serving in RAG
 
Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)
Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)
Tree in the Forest - Managing Details in BDD Scenarios (live2test 2024)
 

Finer Control of Declarative Net Request Rules

  • 1. Finer control of DNR rules Felipe Erias BlinkOn 16 — May 2022 1
  • 2. Hello! Felipe Erias felipeerias in GitHub, Twitter felipeerias@igalia.com 2
  • 3. Web Extensions: manifest V3 Privacy: less need to access user data Security: stricter protocols and requirements Performance Follow the Web Platform way of doing things Keep the platform capable and valuable for users 3
  • 4. Declarative Net Request Provide control over network requests (including blocking resources) Previously: network requests are intercepted and evaluated in the extension process Now: extension declares a set of rules that the browser uses to evaluate and modify requests 4
  • 5. Rule resources (1) Static lists of rules are bundled with the extension Can only be modified by updating the extension Enabled and disabled as a whole Limits: 10 enabled lists, up to 30,000 rules // Enable ruleset with id "myRules" chrome.declarativeNetRequest.updateEnabledRulesets( { disableRulesetIds: ["unusedList"], enableRulesetIds: ["myRules"] } 5
  • 6. Rule resources (2) Dynamic rules Can be added and removed one by one Lifetimes only current session, or across sessions and extensions updates Limit: up to 5,000 rules chrome.declarativeNetRequest.updateDynamicRules(…); chrome.declarativeNetRequest.updateSessionRules(…); 6
  • 7. The problem What if one of the rules in these lists has an error? 7
  • 8. 8
  • 9. Going forward? With the move to Declarative Net Request, this will become harder to fix: Need to update the extension to amend the problematic static rule Disabling the whole list breaks functionality Adding a dynamic rule risks side effects 9
  • 10. A possible solution What about disabling that misbehaving static rule? 10
  • 11. Our proposal When you enable a static list you may disable some of its rules // Enable ruleset with id "myRules", // but disabling rules 1 and 5 chrome.declarativeNetRequest.updateEnabledRulesets({ disableRulesetIds: ["unusedList"], enableRulesetIds: ["myRules"], disableRules: [{ rulesetId: "myRules", disableRulesIds: [ 1, 5 ] }] }); 11
  • 12. Feedback welcome! Chromium bug Web Extensions WG Extension API proposal https://crbug.com/1225229 https://github.com/w3c/webextensions/issues/162 https://docs.google.com/document/d/1NTOTr6iwm0dJbewWjnABmPo6h1QD1mKTpX60s6Klj- 8/edit?usp=sharing 12
  • 14. 14