Subject: bug#43071: closed (Re: bug#43071: Enable WebKit sandboxing)

From: [email-masked] (GNU bug Tracking System)
Date: Sun, 25 Oct 2020 00:28:02 +0000

Your bug report

#43071: Enable WebKit sandboxing

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
43071: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=43071
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#43071: Enable WebKit sandboxing
From: Paul Eggert <[email-masked]>
To: Stefan Kangas <[email-masked]>, [email-masked]
Cc: [email-masked], Qiantan Hong <[email-masked]>, Jaesup Kwak <[email-masked]>, Robert Pluim <[email-masked]>, Jimmy Aguilar Mena <[email-masked]>, Sungbin Jo <[email-masked]>
Date: Sat, 24 Oct 2020 17:27:08 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

No further comment, so I installed the WebKit sandboxing patch into the emacs-27 
branch on Savannah 
<https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-27&id=71661b287297f328c2c5ad67e180a760f80850cb>. 
After the next merge from emacs-27 to master, this patch should appear in the 
master branch. I am closing Bug#43071.

While testing the fix, I ran into a problem with xwidgets and filed Bug#44204 
"Emacs --with-xwidgets complains under Ubuntu 20.04" which you can see here:

https://bugs.gnu.org/44204

Has anyone had luck running Emacs --with-xwidgets under Ubuntu 20.04 or later? 
I'll cc. this to [email-masked] to try to move that part of the 
discussion there.

Subject: Enable WebKit sandboxing
From: Paul Eggert <[email-masked]>
To: Emacs bug reports and feature requests <[email-masked]>
Cc: Robert Pluim <[email-masked]>, Jimmy Aguilar Mena <[email-masked]>, Jaesup Kwak <[email-masked]>, Qiantan Hong <[email-masked]>, Sungbin Jo <[email-masked]>
Date: Thu, 27 Aug 2020 06:14:37 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

Qiantan Hong suggested that Emacs should enable sandboxing in WebKit, for all 
the usual security reasons. (Thanks, Qiantan!)

Attached is a proposed patch to implement that suggestion; it's a bit fancier 
than what Qiantan originally proposed in 
<https://lists.gnu.org/r/emacs-devel/2020-08/msg00896.html> because it checks 
that WebKit 2.26 or later is in use, and it avoids a duplicate call to 
webkit_web_context_get_default. I'm cc'ing this to Qiantan and to other recent 
committers to xwidget.c, to get their opinions.
>From 1ca9d47923813e536753c18aa15194f15f39ab3d Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Thu, 27 Aug 2020 06:00:52 -0700
Subject: [PATCH] Use WebKit sandboxing

* src/xwidget.c (Fmake_xwidget): Enable sandboxing if WebKit 2.26
or later.  Do this early, as required for sandboxing.
Co-authored-by: Qiantan Hong <[email-masked]>
Copyright-paperwork-exempt: yes
---
 src/xwidget.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/xwidget.c b/src/xwidget.c
index 154b3e9c82..851f96952c 100644
--- a/src/xwidget.c
+++ b/src/xwidget.c
@@ -114,6 +114,13 @@ DEFUN ("make-xwidget",
   if (EQ (xw->type, Qwebkit))
     {
       block_input ();
+      WebKitWebContext *webkit_context = webkit_web_context_get_default ();
+
+# if WEBKIT_CHECK_VERSION (2, 26, 0)
+      if (!webkit_web_context_get_sandbox_enabled (webkit_context))
+	webkit_web_context_set_sandbox_enabled (webkit_context, TRUE);
+# endif
+
       xw->widgetwindow_osr = gtk_offscreen_window_new ();
       gtk_window_resize (GTK_WINDOW (xw->widgetwindow_osr), xw->width,
                          xw->height);
@@ -152,7 +159,7 @@ DEFUN ("make-xwidget",
                             "load-changed",
                             G_CALLBACK (webkit_view_load_changed_cb), xw);
 
-          g_signal_connect (G_OBJECT (webkit_web_context_get_default ()),
+          g_signal_connect (G_OBJECT (webkit_context),
                             "download-started",
                             G_CALLBACK (webkit_download_cb), xw);
 
-- 
2.25.4