Editing GNOME Web (section)

=== Google Safe Browsing and security sandboxing ===
Since GNOME 3.28, Web has support for [[Google Safe Browsing]], to help prevent users from visiting malicious websites.<ref name="Google Safe Browsing">{{cite web|url=https://www.phoronix.com/scan.php?page=news_item&px=Epiphany-3.27.1-Released|title=Epiphany 3.28 Development Kicks Off With Safe Browsing, Better Flatpak Handling – Phoronix|website=phoronix.com|access-date=April 9, 2018|archive-date=April 9, 2018|archive-url=https://web.archive.org/web/20180409043718/https://www.phoronix.com/scan.php?page=news_item&px=Epiphany-3.27.1-Released|url-status=live}}</ref>

Since GNOME 3.34, Web explicitly requires a minimum of WebKitGTK 2.26 or later.<ref name="auto1"/><ref>{{Cite web|url=https://gitlab.gnome.org/GNOME/epiphany/commit/8c63e4b3c6f04f925c6339ba2fb416ddf21fdad8|title=Require WebKitGTK 2.26.0 (8c63e4b3) · Commits · GNOME / Epiphany|website=GitLab|date=September 13, 2019 |access-date=September 29, 2019|archive-date=September 29, 2019|archive-url=https://web.archive.org/web/20190929183402/https://gitlab.gnome.org/GNOME/epiphany/commit/8c63e4b3c6f04f925c6339ba2fb416ddf21fdad8|url-status=live}}</ref><ref name="auto2"/> This provides the "Bubblewrap Sandbox"<ref>{{Cite web|url=https://lwn.net/Articles/686113/|title=Sandboxing for the unprivileged with bubblewrap [LWN.net]|website=lwn.net|access-date=September 29, 2019|archive-date=September 29, 2019|archive-url=https://web.archive.org/web/20190929183358/https://lwn.net/Articles/686113/|url-status=live}}</ref> for tab processes, which is intended to prevent malicious websites from hijacking the browser and using it to spy on other tabs or run malicious code on the user's computer. If such code found another exploit in the operating system allowing it to become [[Superuser|root]], the result could be a disaster for all users of the system.

Making the sandbox a priority was brought on, according to Michael Catanzaro, because he was particularly concerned with the code quality of [[OpenJPEG]] and the numerous security problems that had been discovered in it, including many years of failing security reviews by Ubuntu.<ref>{{Cite web|url=https://bugs.launchpad.net/ubuntu/+source/openjpeg2/+bug/711061|title=Bug #711061 "[MIR] openjpeg2" : Bugs : openjpeg2 package : Ubuntu|website=bugs.launchpad.net|date=February 2011 |access-date=September 29, 2019|archive-date=September 29, 2019|archive-url=https://web.archive.org/web/20190929211627/https://bugs.launchpad.net/ubuntu/%2Bsource/openjpeg2/%2Bbug/711061|url-status=live}}</ref> He further explained that web compatibility requires that sites believe that Web is a major browser. Sending them the [[user agent]] of [[Safari (web browser)|Apple Safari]] causes fewer broken websites than others (due to sharing the WebKit engine), but also causes caching servers to deliver [[JPEG 2000]] images,<ref>{{Cite web|url=https://bugs.webkit.org/show_bug.cgi?id=186272|title=186272 – [GTK][WPE] Support JPEG 2000 images|website=bugs.webkit.org|access-date=September 29, 2019|archive-date=August 1, 2020|archive-url=https://web.archive.org/web/20200801035259/https://bugs.webkit.org/show_bug.cgi?id=186272|url-status=live}}</ref> of which Safari is the only major browser to support. There is no other usable open source option for JPEG 2000 support. Fixing OpenJPEG, which is the official [[reference software]], will be a massive undertaking that could take years to sort out. Enabling the Bubblewrap Sandbox would cause many vulnerabilities in this and other components to become "minimally useful" to potential attackers.<ref>{{Cite web|url=https://blogs.gnome.org/mcatanzaro/2019/06/09/on-ubuntu-updates/|title=On Ubuntu Updates – Michael Catanzaro|date=June 9, 2019 |access-date=September 29, 2019|archive-date=June 24, 2019|archive-url=https://web.archive.org/web/20190624124815/https://blogs.gnome.org/mcatanzaro/2019/06/09/on-ubuntu-updates/|url-status=live}}</ref>

In GNOME 3.36, Web gained native support for PDF documents by using [[PDF.js]]. Michael Catanzaro explained that having websites open [[Evince]] to display PDF files was insecure, as it could be used to escape the browser's security sandbox. Since Evince was the last user of NPAPI, this allowed the remaining support code for the obsolete plug-in model (where additional vulnerabilities could be hiding) to be removed. Since the NPAPI support had a hard dependency on X11, moving to PDF.js also allowed that dependency to be dropped.<ref name="blogs.gnome.org"/>

Since PDF.js internally converts PDF documents so that they can be displayed by the web browser's engine, it does not add security vulnerabilities to the browser the way that compiled plug-ins such as [[Adobe Acrobat]] or Evince could.<ref name="blogs.gnome.org"/>