extension apis would be vulnerable to malicious extensions if we allowed webstore installs

brave / muon

[DEPRECATED] Build browsers and browser like applications with HTML, CSS, and JavaScript

https://discord.gg/TcT5tX2

MIT License

971 stars 114 forks source link

extension apis would be vulnerable to malicious extensions if we allowed webstore installs #110

Open bridiver opened 7 years ago

bridiver commented 7 years ago

https://github.com/brave/electron/issues/109 protects the apis from the main world, but if we opened up extensions and allowed installs from the chrome webstore a malicious extension could exploit similar vulnerabilities. We should audit and update all of the extension code to ensure that it uses safe versions of all at-risk methods (safe builtins)

frankhale commented 7 years ago

I'd like to install React Devtools in my Muon app but the BrowserWindow.addDevToolsExtension has been removed apparently. Is there any way to add devtools extensions currently?