Separate enabling/disabling of WASM for extensions and sites

ungoogled-software / ungoogled-chromium

Google Chromium, sans integration with Google

BSD 3-Clause "New" or "Revised" License

20.76k stars 843 forks source link

Separate enabling/disabling of WASM for extensions and sites #945

Open emanruse opened 4 years ago

emanruse commented 4 years ago

Is your feature request related to a problem? Please describe. Some extensions like uBlockOrigin use WebAssembly. However a security minded person may want to disable WASM (through command line option --js-flags=--noexpose_wasm) because of:

https://www.infoq.com/news/2019/10/WebAssembly-wasm-malicious-usage/ https://www.dimva2019.org/wp-content/uploads/sites/31/2019/06/DIMVA19-slides-2-R.pdf

Unfortunately this also disables WASM for extensions.

Describe the solution you'd like 2 flags:

enable/disable WASM for extensions
enable/disable WASM for websites

wchen342 commented 4 years ago

Just out of curiosity, what feature of uBlockOrigin requires WASM? Because I am using it without WebAssembly on both Firefox and Ungoogled-Chromium and I wonder what I missed.

EDIT: I saw the issue you opened. An interesing discovery. If I understand correctly in the specific case of uBlockOrigin it only means it cannot do blocking with WASM (which is useless anyway since you disabled WASM completely).

emanruse commented 4 years ago

Just out of curiosity, what feature of uBlockOrigin requires WASM?

You should probably ask the developers as I am not familiar with the source code. All I know is that they started using it at some point in time for performance optimization.

jstkdng commented 4 years ago

probably rule parsing as some rule sets tend to be thousands of lines long, maybe millions

Eloston commented 4 years ago

I suppose this could be useful, but we still need to see how feasible this is to implement. These flags would toggle features at the core of the browser (V8 perhaps?) so it may not be easy.