Restrict to local files only

[lexnicolaes]

I'm embedding a QCefView into my application, which I will use to render HTML+JS based plugins. This works great so far, but I'm wondering it is possible to restrict the CEF context to only allow loading local files, so plugins cannot connect externally (to the internet). Looking at the following struct, it seems like CEF at least partially supports this,but I'm unsure how it relates to your wrapper of the CefCore. https://github.com/chromiumembedded/cef/blob/113a96be0d3b125798145d74bc03148a03f67e5b/include/internal/cef_types.h#L2780

Thanks.

[tishion]

I believe you can achieve this by the following setting:
CefSettings.file_access_from_file_urls_allowed = true
CefSettings.universal_access_from_file_urls_allowed = false
(CefSetting is wrapped as QCefConfig in QCefView)

But these two values seem to have been removed from the lates CEF (at least missing from the one QCefView refere to)
I don't konw why they have removed this, will look into it and find whether there is a replacement.

[tishion]

Please refere to this:
https://bitbucket.org/chromiumembedded/cef/issues/2820/remove-cefbrowsersettings

I will add the method to add cmdline args.

[tishion]

QCefView/example/QCefViewTest/main.cpp

Lines 8 to 29 in 31e69c8

	main(int argc, char* argv[])
	{
	QApplication a(argc, argv);
	// build QCefConfig
	QCefConfig config(argc, argv);
	config.setUserAgent("QCefViewTest");
	config.setLogLevel(QCefConfig::LOGSEVERITY_DEFAULT);
	config.setBridgeObjectName("CallBridge");
	config.setRemoteDebuggingPort(9000);
	// add command line args
	// config.addCommandLineSwitch("allow-universal-access-from-files");
	config.addCommandLineSwitch("allow-file-access-from-files");
	config.addCommandLineSwitch("disable-spell-checking");
	config.addCommandLineSwitch("disable-site-isolation-trials");
	config.addCommandLineSwitch("enable-aggressive-domstorage-flushing");
	config.addCommandLineSwitchWithValue("renderer-process-limit", "1");
	config.addCommandLineSwitchWithValue("disable-features", "BlinkGenPropertyTrees,TranslateUI,site-per-process");
	// initialize QCefContext instance with config
	QCefContext cefContext(&a, &config);

Hope the new method could help you.
QCefConfig.addCommandLineSwitch
QCefConfig.addCommandLineSwitchWithValue

[lexnicolaes]

Thank you so much, this looks like a valuable addition. I don't think the "allow-file-access-from-files" is the way to go, but I can use the command like args to restrict to localhost only.

[tishion]

but I can use the command like args to restrict to localhost only.

can you show me what command line switch can do this?

if you load your web app with file:// schema, then it will not be able to access the internet by default (according to the CEF documentation), if you set "allow-universal-access-from-files" switch it will be able to do that.

allow-file-access-from-files flag only gets your local web app (loaded by file:// schema) the ability to access the local file resources.

sorry for no help :(

[lexnicolaes]

I'm planning on running one or multiple React webapps in my Qt application. So i'm thinking of running a small embedded webserver to serve these and use QCefView to display them and use the bridge object to provide said webapps with data.

From a security point of view, it'd be nice to have these run in a kind of soft 'sandbox'. Simply restricting the view to only accept localhost might to the trick. To achieve this i see a couple of options;

1. Use the command line args, it seems i can restrict the host (https://superuser.com/questions/322062/can-i-lock-a-user-to-one-site-only-in-chrome). I have not tried this yet.
2. IDK if Cef provides a callback for each request, so i can construct a filter to accept/deny a certain request. I have not looked into this yet.

[tishion]

Hi @lexnicolaes, I see what you are doing now. And I have one suggestion on your work.

1. you don't really need to run a local web server, because CEF can server your webapp naturally. you just write your React webapp and compile it. what you get from the building process is only a package of static web resources(HTML, JavaScript, pictures and so on). Just put your webapp artifact as a folder or zip file(you can set password) in your native application resources directory.
2. Then you have two choices to server the webapp:
   • load the webapp index file with absolute path (start with file://schema). In this way you may face the CORS problems calling your webapi service at running time. you could solve this by allowing access from all origins on your webapi code.
   • add a mapping (url to local folder/zip file), for example you can add a mapping with the following value:
     https://yourdomain.com -> your webapp artifact path(either a folder or zip file). Then all the request in the CEF to the yourdomain.com will be redirect to the local webapp resources, and there will be no CORS problem if your webapi service was really deployed on yourdomain.com/api/v1/xxxxx.

obviously, the second approach is better.

There are two sample products with the second technology:

• Garena Game Platform : The webapp developed with Angular
• START Cloud Game. The webapp is developed with Vue

From a security point of view, it'd be nice to have these run in a kind of soft 'sandbox'. Simply restricting the view to only accept localhost might to the trick. To achieve this i see a couple of options;

I don't know why you think the user can change the view to other site without exposing any navigation interface. Because the native view and the webapp are both written by you, you just don't provide any user interface to do this then you and your webapp will be safe. :)

IDK if Cef provides a callback for each request, so i can construct a filter to accept/deny a certain request. I have not looked into this yet.

sure, there is.

https://github.com/CefView/CefViewCore/blob/main/src/CefView/CefBrowserApp/CefViewBrowserClient_ResourceRequestHandler.cpp

if you really need to do this you can look into this file.

[lexnicolaes]

• load the webapp index file with absolute path (start with file://schema). In this way you may face the CORS problems calling your webapi service at running time. you could solve this by allowing access from all origins on your webapi code.
• add a mapping (url to local folder/zip file), for example you can add a mapping with the following value:
  https://yourdomain.com -> your webapp artifact path(either a folder or zip file). Then all the request in the CEF to the yourdomain.com will be redirect to the local webapp resources, and there will be no CORS problem if your webapi service was really deployed on yourdomain.com/api/v1/xxxxx.

obviously, the second approach is better.

Thank you, that clears things up significantly. I'll go that route.

I don't know why you think the user can change the view to other site without exposing any navigation interface. Because the native view and the webapp are both written by you, you just don't provide any user interface to do this then you and your webapp will be safe. :)

In this use-case the webapps/plugin can be developed by someone different and dynamically loaded in the application. I simply want to prevent any "hacky" constructions like loading online resources or something outside the plugin bundle. But i now have all the tools i need, thanks.