From 11e2820c7ebc22d771f8e60394cc6b8f2bdfdfae Mon Sep 17 00:00:00 2001 From: John Ryan Date: Tue, 18 Aug 2026 11:59:00 -0700 Subject: [PATCH 1/3] Add sandbox attribute to extension iframe in DevTools. This change grants these permissions: - `allow-scripts`: enables extension JS / Wasm execution. - `allow-forms`: permits standard form interactions. - `allow-downloads`: allows extensions to export files/logs. - `allow-popups` & `allow-popups-to-escape-sandbox`: allows opening external links. This does not grant `allow-same-origin` permission, so extensions can't access the parent window's DOM, cookies, or local storage. --- .../lib/src/extensions/embedded/_controller_web.dart | 4 +++- packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart b/packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart index ab96f867ec0..03106e13c6f 100644 --- a/packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart +++ b/packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart @@ -123,7 +123,9 @@ class EmbeddedExtensionControllerImpl extends EmbeddedExtensionController // This url is safe because we built it ourselves and it does not include // any user input. ..src = extensionUrl - ..allow = 'usb'; + ..allow = 'usb' + ..sandbox.value = + 'allow-scripts allow-forms allow-downloads allow-popups allow-popups-to-escape-sandbox'; _extensionIFrame.style ..border = 'none' ..height = '100%' diff --git a/packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md b/packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md index 0d7aeb830ce..ef01d2ce7e7 100644 --- a/packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md +++ b/packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md @@ -79,6 +79,8 @@ TODO: Remove this section if there are not any updates. * Hide the DevTools extensions menu button in single-screen embedded mode (`EmbedMode.embedOne`) on standard screens. [#8507](https://github.com/flutter/devtools/issues/8507) +* Added iframe sandboxing for embedded DevTools extensions to enforce origin + isolation. [#TODO](https://github.com/flutter/devtools/pull/TODO) ## Advanced developer mode updates From 0de5535f4f72b8033c82f11ac98c47c57e474e42 Mon Sep 17 00:00:00 2001 From: John Ryan Date: Tue, 18 Aug 2026 13:04:18 -0700 Subject: [PATCH 2/3] Add pull request URL --- packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md b/packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md index ef01d2ce7e7..21e70e2bbcc 100644 --- a/packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md +++ b/packages/devtools_app/release_notes/NEXT_RELEASE_NOTES.md @@ -80,7 +80,7 @@ TODO: Remove this section if there are not any updates. * Hide the DevTools extensions menu button in single-screen embedded mode (`EmbedMode.embedOne`) on standard screens. [#8507](https://github.com/flutter/devtools/issues/8507) * Added iframe sandboxing for embedded DevTools extensions to enforce origin - isolation. [#TODO](https://github.com/flutter/devtools/pull/TODO) + isolation. [#9967](https://github.com/flutter/devtools/pull/9967) ## Advanced developer mode updates From 7c5b804cad6763c1ba4d6d29348d452e3cdcb293 Mon Sep 17 00:00:00 2001 From: John Ryan Date: Tue, 18 Aug 2026 13:11:44 -0700 Subject: [PATCH 3/3] Move string to top-level variable --- .../lib/src/extensions/embedded/_controller_web.dart | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart b/packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart index 03106e13c6f..ebc2855aea0 100644 --- a/packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart +++ b/packages/devtools_app/lib/src/extensions/embedded/_controller_web.dart @@ -59,6 +59,14 @@ String _debugExtensionPlaceholderHtml(String name) { '''; } +/// The sandbox permissions granted to embedded extension iframes. +/// +/// Restricts the extension from accessing same-origin resources such as +/// the parent window DOM, cookies, or local storage, while allowing +/// javascript execution, forms, downloads, and popup windows. +const _extensionSandboxRules = + 'allow-scripts allow-forms allow-downloads allow-popups allow-popups-to-escape-sandbox'; + class EmbeddedExtensionControllerImpl extends EmbeddedExtensionController with AutoDisposeControllerMixin { EmbeddedExtensionControllerImpl(super.extensionConfig); @@ -124,8 +132,7 @@ class EmbeddedExtensionControllerImpl extends EmbeddedExtensionController // any user input. ..src = extensionUrl ..allow = 'usb' - ..sandbox.value = - 'allow-scripts allow-forms allow-downloads allow-popups allow-popups-to-escape-sandbox'; + ..sandbox.value = _extensionSandboxRules; _extensionIFrame.style ..border = 'none' ..height = '100%'