fix security manager blocking dataurl extensions

Author: Mistium

src/extension-support/extension-manager.js

@@ -225,6 +225,15 @@ class ExtensionManager {
      * @param {string} extensionURL - the URL for the extension to load OR the ID of an internal extension
      * @returns {Promise} resolved once the extension is loaded and initialized or rejected on failure
      */
+    _isLocalExtensionURL (extensionURL) {
+        try {
+            const parsedURL = new URL(extensionURL);
+            return parsedURL.protocol === 'data:' || parsedURL.protocol === 'file:';
+        } catch (e) {
+            return false;
+        }
+    }
+
     async loadExtensionURL (extensionURL) {
         if (this.isBuiltinExtension(extensionURL)) {
             this.loadExtensionIdSync(extensionURL);
@@ -244,12 +253,14 @@ class ExtensionManager {
 
         this.loadingAsyncExtensions++;
 
-        const sandboxMode = await this.securityManager.getSandboxMode(extensionURL);
-        const rewritten = await this.securityManager.rewriteExtensionURL(extensionURL);
+        // data: and file: URLs are local (inline text or local file) — no sandbox, no security checks
+        const isLocal = this._isLocalExtensionURL(extensionURL);
+        const sandboxMode = isLocal ? 'unsandboxed' : await this.securityManager.getSandboxMode(extensionURL);
+        const rewritten = isLocal ? extensionURL : await this.securityManager.rewriteExtensionURL(extensionURL);
 
         if (sandboxMode === 'unsandboxed') {
             const {load} = require('./tw-unsandboxed-extension-runner');
-            const extensionObjects = await load(rewritten, this.vm)
+            const extensionObjects = await load(rewritten, this.vm, {bypassSecurity: isLocal})
                 .catch(error => this._failedLoadingExtensionScript(error));
             const fakeWorkerId = this.nextExtensionWorker++;
             this.workerURLs[fakeWorkerId] = extensionURL;

src/extension-support/tw-unsandboxed-extension-runner.js

@@ -21,9 +21,10 @@ const parseURL = url => {
 /**
  * Sets up the global.Scratch API for an unsandboxed extension.
  * @param {VirtualMachine} vm
+ * @param {{bypassSecurity?: boolean}} [options]
  * @returns {Promise<object[]>} Resolves with a list of extension objects when Scratch.extensions.register is called.
  */
-const setupUnsandboxedExtensionAPI = vm => new Promise(resolve => {
+const setupUnsandboxedExtensionAPI = (vm, options = {}) => new Promise(resolve => {
     const extensionObjects = [];
     const register = extensionObject => {
         extensionObjects.push(extensionObject);
@@ -39,7 +40,10 @@ const setupUnsandboxedExtensionAPI = vm => new Promise(resolve => {
     Scratch.vm = vm;
     Scratch.renderer = vm.runtime.renderer;
 
+    const bypass = options.bypassSecurity === true;
+
     Scratch.canFetch = async url => {
+        if (bypass) return true;
         const parsed = parseURL(url);
         if (!parsed) {
             return false;
@@ -52,6 +56,7 @@ const setupUnsandboxedExtensionAPI = vm => new Promise(resolve => {
     };
 
     Scratch.canOpenWindow = async url => {
+        if (bypass) return true;
         const parsed = parseURL(url);
         if (!parsed) {
             return false;
@@ -65,6 +70,7 @@ const setupUnsandboxedExtensionAPI = vm => new Promise(resolve => {
     };
 
     Scratch.canRedirect = async url => {
+        if (bypass) return true;
         const parsed = parseURL(url);
         if (!parsed) {
             return false;
@@ -77,17 +83,33 @@ const setupUnsandboxedExtensionAPI = vm => new Promise(resolve => {
         return vm.securityManager.canRedirect(parsed.href);
     };
 
-    Scratch.canRecordAudio = async () => vm.securityManager.canRecordAudio();
+    Scratch.canRecordAudio = async () => {
+        if (bypass) return true;
+        return vm.securityManager.canRecordAudio();
+    };
 
-    Scratch.canRecordVideo = async () => vm.securityManager.canRecordVideo();
+    Scratch.canRecordVideo = async () => {
+        if (bypass) return true;
+        return vm.securityManager.canRecordVideo();
+    };
 
-    Scratch.canReadClipboard = async () => vm.securityManager.canReadClipboard();
+    Scratch.canReadClipboard = async () => {
+        if (bypass) return true;
+        return vm.securityManager.canReadClipboard();
+    };
 
-    Scratch.canNotify = async () => vm.securityManager.canNotify();
+    Scratch.canNotify = async () => {
+        if (bypass) return true;
+        return vm.securityManager.canNotify();
+    };
 
-    Scratch.canGeolocate = async () => vm.securityManager.canGeolocate();
+    Scratch.canGeolocate = async () => {
+        if (bypass) return true;
+        return vm.securityManager.canGeolocate();
+    };
 
     Scratch.canEmbed = async url => {
+        if (bypass) return true;
         const parsed = parseURL(url);
         if (!parsed) {
             return false;
@@ -96,6 +118,7 @@ const setupUnsandboxedExtensionAPI = vm => new Promise(resolve => {
     };
 
     Scratch.canDownload = async (url, name) => {
+        if (bypass) return true;
         const parsed = parseURL(url);
         if (!parsed) {
             return false;
@@ -200,9 +223,10 @@ const teardownUnsandboxedExtensionAPI = () => {
  * Load an unsandboxed extension from an arbitrary URL. This is dangerous.
  * @param {string} extensionURL
  * @param {Virtualmachine} vm
+ * @param {{bypassSecurity?: boolean}} [options]
  * @returns {Promise<object[]>} Resolves with a list of extension objects if the extension was loaded successfully.
  */
-const loadUnsandboxedExtension = (extensionURL, vm) => new Promise((resolve, reject) => {
+const loadUnsandboxedExtension = (extensionURL, vm, options = {}) => new Promise((resolve, reject) => {
     let isResolved = false;
     let registrationTimeout = null;
     let overallTimeout = null;
@@ -215,7 +239,7 @@ const loadUnsandboxedExtension = (extensionURL, vm) => new Promise((resolve, rej
         fn(arg);
     };
 
-    setupUnsandboxedExtensionAPI(vm)
+    setupUnsandboxedExtensionAPI(vm, options)
         .then(extensionObjects => settle(resolve, extensionObjects))
         .catch(error => {
             error.url = extensionURL;
@@ -293,9 +317,9 @@ const prefetchExtensionScript = extensionURL => {
 // only let one extension register at a time. The script download is started up front (in
 // parallel across extensions) so only the registration step is serialized.
 const limiter = new AsyncLimiter(loadUnsandboxedExtension, 1);
-const load = (extensionURL, vm) => {
+const load = (extensionURL, vm, options = {}) => {
     prefetchExtensionScript(extensionURL);
-    return limiter.do(extensionURL, vm);
+    return limiter.do(extensionURL, vm, options);
 };
 
 module.exports = {

src/virtual-machine.js

@@ -904,7 +904,9 @@ class VirtualMachine extends EventEmitter {
                 if (!url) {
                     throw new Error(`Unknown extension: ${extensionID}`);
                 }
-                if (await this.securityManager.canLoadExtensionFromProject(url)) {
+                // data: and file: URLs are local — always allow without security manager check
+                const isLocal = url.startsWith('data:') || url.startsWith('file:');
+                if (isLocal || await this.securityManager.canLoadExtensionFromProject(url)) {
                     extensionPromises.push(this.extensionManager.loadExtensionURL(url));
                 } else {
                     throw new Error(`Permission to load extension denied: ${extensionID}`);