chromium/src
0
Fork 0
Code Activity

Mention os: URLs, too

Browse Source 
ChromiumOS uses `os:` for privileged pages, too.

BUG=1015882

Change-Id: Iaf0056151c2306d1146581839a58c9ee4479a7c3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4544872
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Commit-Queue: Chris Palmer <palmer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1146274}
This commit is contained in:
Chris Palmer
2023-05-18 23:59:28 +00:00
committed by Chromium LUCI CQ
parent d336ff20cf
commit 6f1314093c
1 changed files with 6 additions and 5 deletions

11
docs/special_case_urls.md

@ -73,13 +73,14 @@ important for most security checks to look at the origin rather than the URL
(see [Origin vs URL](security/origin-vs-url.md)).
## chrome: URLs
## chrome: and os: URLs
`chrome:` URLs are used for privileged pages that are part of Chromium, such as
`chrome://settings`. Web pages are not allowed to navigate to them, to reduce
the risk of privilege escalation attacks. Note that there are a subset of
`chrome:` URLs that are used for debug commands, described under
[Debug URLs](#debug-urls) below.
`chrome://settings`. Similarly, `os:` URLs are privileged pages that are part of
ChromiumOS. Web pages are not allowed to navigate to them, to reduce the risk of
privilege escalation attacks. Note that there are a subset of `chrome:` URLs
that are used for debug commands, described under [Debug URLs](#debug-urls)
below.
## Debug URLs