且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

从网页链接到chrome://网址

更新时间:2023-01-01 17:43:55



chrome:// 是一个特权来源和任何尝试打开它都会导致重定向到 about:blank



Chrome会这样做减少攻击面:即使只是打开这些网址应该是无害的,但***不要让网站和外部程序尝试。



此外,它并不是无害的,例如调试URL如 chrome:// crash chrome:// hang (小心,那些真的 em>做你期望的)。



显然,你不能使用 chrome.tabs ,因为它是一个扩展名API不公开给网站。但是,它可以打开特权来源。

UPDATE

chrome://about/ has direct links to chrome://settings and others, so it can be done.

How can I link/redirect to a chrome:// URL in a webpage? For example, chrome://settings. When attempting to click a link to a chrome:// URL,

<a href="chrome://settings">link</a>

I get an error in the console:

Not allowed to load local resource: chrome://settings/

According to this answer, it is possible:

Link to chrome://chrome/extensions from extension options page

I've tried this script:

<a href="#" id="test">test</a>
<script>
document.addEventListener('DOMContentLoaded', function () {
    document.getElementById('test').addEventListener('click', function () {
        chrome.tabs.update({
            url: 'chrome://chrome/extensions'
        });
    });
});
</script>

And also this one:

<a href="#" onclick="chrome.tabs.create({url:'chrome://settings/clearBrowserData'});">click me</a>

Neither works. In addition to those, I've tried:

  • Linking to it using <a href="chrome://newtab">
  • Redirect the user using window.location.

However, I believe there may be a JavaScript workaround. When the user presses a link, is it possible to change the URL to chrome://settings? The user would have to press Enter after, but this seems like the best I'd get.

Nope, there is no way to do it from a webpage.

chrome:// is a privileged origin, and any attempt to open it will result in a redirect to about:blank.

Chrome does that to reduce the attack surface: even though just opening those URLs should be harmless, it's better not to allow websites and external programs to even try.

Besides, it's not that harmless, e.g. debug URLs like chrome://crash, chrome://hang (careful, those really do what you expect).

Obviously, you can't use chrome.tabs as it's an extension API not exposed to websites. It is, however, capable of opening privileged origins.