Google web browser kusunungurwa ... Panguva imwe chete kusunungurwa kwakagadzikana kwepurojekiti yemahara , iyo inoshanda sehwaro hweChrome. Chrome browser kushandiswa kweGoogle logos, kuvapo kwehurongwa hwekutumira zviziviso kana yaparara, kugona kudhawunirodha Flash module pakukumbira, ma module ekutamba akachengetedzwa vhidhiyo yemukati (DRM), sisitimu yekuisa otomatiki zvigadziriso uye kutapurirana panguva yekutsvaga. . Kuburitswa kunotevera kweChrome 87 kwakarongerwa Mbudzi 17.
:
- Yakawedzerwa dziviriro kubva kusiri kuendesa mafomu ekuisa pamapeji akaiswa kuburikidza neHTTPS asi kutumira data kuburikidza neHTTP, izvo zvinogadzira kutyisidzira kwekubatwa kwedata uye spoofing panguva yekurwiswa kweMITM. Dziviriro inodzika kune matatu shanduko:
- Kuzadza otomatiki kwechero mafomu akasanganiswa ekuisa kwakavharwa, zvakafanana nekuzadza otomatiki kwemafomu echokwadi pamapeji akavhurwa kuburikidza neHTTP kwakaremara kwenguva yakati rebei. Kana kare chiratidzo chekuremara chaivhura peji ine fomu kuburikidza neHTTPS kana HTTP, iko zvino kushandiswa kwekuvharidzira kana kutumira data kumugadziri wefomu kunotariswa zvakare. Maneja epassword emhando dzakasanganiswa dzehuchokwadi haana kuvharwa, sezvo njodzi yekushandisa password isina kuchengeteka uye kushandisazve mapassword panzvimbo dzakasiyana inodarika njodzi yekubatwa kwetraffic.
- Paunotanga kupinda mumhando dzakasanganiswa, yambiro inoratidzwa ichizivisa mushandisi kuti data rakapedzwa riri kutumirwa kuburikidza neisina kunyoreswa nzira yekutaurirana.
- Paunoyedza kuendesa fomu rakasanganiswa, peji rakasiyana rinoratidzwa richikuzivisa nezve njodzi inogona kuitika yekutumira data pane isina kuvharirwa nzira yekutaurirana. Mushanduro dzakapfuura, chiratidzo chekuvhara mubhawa rekero chaishandiswa kuratidza mafomu akasanganiswa, asi chiratidzo ichi chaive chisiri pachena kune vashandisi uye chaisanyatso ratidza njodzi dziripo.
- Kuvhara (pasina encryption) yemafaira anogona kuitiswa inowedzerwa nekuvharira kurodha zvisina kuchengetedzeka kwezvinyorwa (zip, iso, nezvimwewo) uye kuratidza yambiro yekurodha zvisina kuchengetedzeka.
zvinyorwa (docx, pdf, nezvimwewo). Document blocking uye yambiro yemifananidzo, zvinyorwa, uye midhiya mafaera zvinotarisirwa mukuburitswa kunotevera. Kuvharira kunoitwa nekuti kurodha mafaera pasina encryption kunogona kushandiswa kuita zvakaipa nekutsiva zvirimo panguva yekurwiswa kweMITM. - Iyo yakasarudzika menyu inoratidza iyo "Gara ratidza yakazara URL" sarudzo, yaimboda kushandura marongero pane nezve: mireza peji kuti igone. Iyo yakazara URL inogona zvakare kutariswa nekudzvanya-kaviri pane kero bar. Ngatirangarirei izvozvo kutanga kubva Nekutadza, kero yakatanga kuratidzwa isina protocol uye www subdomain. IN marongero ekudzorera maitiro ekare akabviswa, asi mushure mekusagutsikana nemushandisi Mureza mutsva wekuyedza wawedzerwa iyo inowedzera sarudzo kumenu yemamiriro ekudzima kuhwanda uye kuratidza iyo yakazara URL mune chero mamiriro.
- Yakatangwa kwechikamu chidiki chevashandisi pamusoro Nekumisikidza, iyo kero bar ine chete dura, isina nzira zvinhu uye query paramita. Semuenzaniso, panzvimbo yekuti "https://example.com/secure-google-sign-in/" icharatidza "example.com". Iyo yakatsanangurwa modhi inotarisirwa kuunzwa kune vese vashandisi mune imwe yeinotevera kuburitswa. Kudzima maitiro aya, unogona kushandisa iyo "Gara uchiratidzira URL yakazara" sarudzo, uye kuona iyo URL yese, unogona kudzvanya pakabhati kero. Chinangwa cheshanduko iyi chishuwo chekuchengetedza vashandisi kubva kuhutsotsi hunobata maparamendi muURL - vanorwisa vanotora mukana wekusangwarira kwevashandisi kugadzira chitarisiko chekuvhura imwe saiti uye kuita zviito zvehutsotsi (kana kutsiva kwakadaro kuri pachena kune mushandisi ane hunyanzvi. , vanhu vasina ruzivo vanowira nyore nyore nokuda kwekunyengera kwakadaro).
- Resumed kubvisa FTP rutsigiro. MuChrome 86, FTP inovharwa nekusarudzika kune vangangoita 1% yevashandisi, uye muChrome 87 huwandu hwekuremara huchawedzerwa kusvika pa50%, asi rutsigiro runogona kudzoserwa uchishandisa "--enable-ftp" kana "- -enable-features=FtpProtocol" mureza. MuChrome 88, rutsigiro rweFTP rucharemara zvachose.
- Mushanduro yeAndroid, yakafanana neshanduro yedesktop masisitimu, maneja wepassword anoisa cheki yeakachengetwa logins nemapassword achipesana nedhatabhesi yemaakaundi akakanganiswa, achiratidza yambiro kana matambudziko aonekwa kana kuyedza kushandisa mapassword mashoma. Cheki inoitwa ichipokana nedhatabhesi inofukidza anopfuura mabhiriyoni mana akakanganiswa maakaundi akaonekwa mune akaburitswa mushandisi dhatabhesi. Kuchengetedza zvakavanzika Iyo hash prefix inosimbiswa kudivi remushandisi, uye mapassword pachawo uye akazara hashes haafambiswe kunze.
- Inowanikwawo mu Android vhezheni bhatani rekuti "Chengetedza Cheki" uye nzira yekudzivirira yakakwidziridzwa kubva kunzvimbo dzine njodzi (Yakawedzerwa Safe Browsing). Bhatani re "Safety cheki" rinoratidza pfupiso yezvingangoitika zvekuchengetedza, sekushandiswa kwemapassword akakanganisika, mamiriro ekutarisa mawebhusaiti ane hutsinye (Safe Browsing), kuvapo kwezvigadziriso zvisina kuvhurwa, uye kuzivikanwa kweawedzero yakaipa. Yepamberi yekudzivirira modhi inovhura mamwe macheki kudzivirira kubva mukubira, kuita zvakaipa uye kumwe kutyisidzira paWebhu, uye zvakare inosanganisira imwe dziviriro yeakaundi yako yeGoogle neGoogle masevhisi (Gmail, Drive, nezvimwewo). Kana mune yakajairwa Safe Browsing mode macheki anoitwa munharaunda uchishandisa dhatabhesi nguva nenguva inoiswa pane yevatengi sisitimu, ipapo muEnhanced Safe Browsing ruzivo nezvemapeji uye kudhawunirodha munguva chaiyo inotumirwa kuti iongororwe kudivi reGoogle, iyo inokutendera iwe kukurumidza kupindura kutyisidzira nekukurumidza mushure mekunge vazivikanwa, pasina kumirira kusvika rondedzero yemuno yagadziridzwa.
- tsigiro ye ".well-known/ change-password" indicator file, iyo varidzi vesaiti vanogona kutsanangura kero yefomu rewebhu rekushandura password. Kana magwaro emushandisi akakanganiswa, Chrome zvino ichakurumidza kusimudzira mushandisi nefomu rekuchinja password zvichienderana neruzivo rwuri mufaira iri.
- Nyevero itsva ye "Safety Tip" yaitwa, inoratidzwa pakuvhura nzvimbo dzine dhomeini yakafanana neimwe saiti uye heuristics inoratidza kuti pane mukana wakakura we spoofing (semuenzaniso, goog0le.com inovhurwa pachinzvimbo chegoogle.com).
- Tsigiro yeBack-forward cache, iyo inopa kufamba nekukurumidza kana uchishandisa "Kumashure" uye "Pamberi" mabhatani kana pakufamba nemapeji aimboonekwa esaiti iripo. Iyo cache inogoneswa uchishandisa iyo chrome://flags/#back-forward-cache setting.
- Kugonesa kweCPU zviwanikwa kushandiswa nemahwindo kwaitwa
kunze kwenzvimbo. Chrome inotarisa kana hwindo rebrowser rakaputirwa nemamwe mahwindo uye inodzivirira kudhirowa pixels munzvimbo dzinopindirana. Iyi optimization yakagoneswa kune diki muzana yevashandisi muChrome 84 uye 85 uye ikozvino yavepo kwese kwese. Zvichienzaniswa nezvakaburitswa zvakaburitswa, kusapindirana nemasisitimu ekuonana kwakaita kuti mapeji machena asina kujeka aoneke akagadziriswa. - Kuwedzera kwekugadzirisa zviwanikwa zvema tabhu ekumashure. Matebu akadaro haachakwanise kushandisa zvinopfuura 1% zveCPU zviwanikwa uye anogona kuitwa kwete kanopfuura kamwe paminiti. Mushure memaminitsi mashanu ekumashure, ma tabo anoomeswa nechando, kunze kwematabo ari kutamba multimedia zvemukati kana kurekodha.
- Shanda mberi HTTP musoro Wekushandisa-Mumiririri. Mushanduro itsva, tsigiro yemuchina inobatiswa kune vese vashandisi , yakagadziridzwa sechinzvimbo cheMushandisi-Mumiriri. Iyo nzira nyowani inosanganisira kusarudza kudzorera data nezve chaiyo browser uye system paramita (vhezheni, chikuva, nezvimwewo) chete mushure mekukumbira neserver uye kupa vashandisi mukana wekusarudza kupa ruzivo rwakadaro kune varidzi vesaiti. Paunenge uchishandisa Mazano eMutengi-Mutengi, chiziviso hachifambiswe nekusarudzika pasina chikumbiro chakajeka, izvo zvinoita kuti kusazivikanwa kusingaite (nekusarudzika, zita rebhurawuza chete rinoratidzwa).
- Chiratidzo chekuvapo kwekuvandudza uye kukosha kwekutangazve bhurawuza kuti uiise yakashandurwa. Panzvimbo pemuseve weruvara, "Kugadziridza" ikozvino yaonekwa muakaundi avatar ndima.
- Basa rakaitwa kushandura browser kuti ishandise inclusive terminology. Mumazita emitemo, mazwi ekuti "whitelist" uye "blacklist" akatsiviwa ne "allowlist" uye "blocklist" (akatowedzerwa marongero acharamba achishanda, asi anozoratidza yambiro nezvekudzikiswa). IN ΠΈ mareferensi e "blacklist" akatsiviwa ne "blocklist".
Manongedzo anoonekwa emushandisi e "blacklist" uye "whitelist" akatsiviwa pakutanga kwa2019. - Yakawedzera hunyanzvi hwekuyedza kugadzirisa mapassword akachengetwa, akabatidzwa uchishandisa "chrome://flags/#edit-passwords-in-settings" mureza.
- Yakashandurwa kuita yakagadzikana uye yeruzhinji API , iyo inokubvumira kuti ugadzire mapurogiramu ewebhu anopindirana nemafaira ari munharaunda yefaira system. Semuenzaniso, iyo API nyowani inogona kunge iri kudiwa mubrowser-based integrated development environments, zvinyorwa, mufananidzo uye vhidhiyo edhita. Kuti ukwanise kunyora zvakananga uye kuverenga mafaera kana kushandisa dialog kuvhura uye kuchengetedza mafaera, pamwe nekufamba kuburikidza nemukati medhairekitori, application inokumbira mushandisi kusimbiswa kwakakosha.
- Yakawedzera CSS selector "", iyo inoshandisa iyo yakafanana heuristics inoshandiswa nebrowser pakusarudza kana kuratidza chinongedzo chekuchinja chiratidzo (kana uchifambisa tarisa kune bhatani uchishandisa mapfupi ekhibhodi, chiratidzo chinooneka, asi kana uchidzvanya negonzo, hazviite). Iyo yaimbove iripo CSS selector ":focus" inogara ichiratidza kutarisa.
Uye zvakare, iyo "Quick Focus Highlight" sarudzo yakawedzerwa kune zvigadziriso, kana yagoneswa, imwe yekuwedzera yekutarisa inotaridzwa padivi pezvinhu zvinoshanda, izvo zvinoramba zvichionekwa kunyangwe zvimiro zvechimiro chekutarisa kwekutarisa zvakavharwa pane peji kuburikidza. CSS. - MaAPI matsva akati wandei akawedzerwa kune Origin Miyedzo modhi (yekuyedza maficha anoda kupatsanurwa activation). Origin Trial inoreva kugona kushanda neiyo API yakatarwa kubva kune yakatorwa kubva kune localhost kana 127.0.0.1, kana mushure mekunyoresa uye kugamuchira yakakosha tokeni iyo inoshanda kwenguva shoma kune yakatarwa saiti.
- kune yakaderera-level yekuwana kuHID zvishandiso (Human interface zvishandiso, keyboards, mbeva, gamepads, touch panels), zvichikubvumidza iwe kuita pfungwa yekushanda neHID mudziyo muJavaScript kuronga basa neasingawanzo HID zvishandiso pasina kuvapo kwevatyairi chaivo. muhurongwa.
Chekutanga pane zvese, iyo API nyowani yakanangana nekupa rutsigiro rwemagamepads. - , inotambanudza Window Placement API kuti itsigire akawanda-screen zvigadziriso. Kusiyana nehwindo.screen, iyo API nyowani inokutendera iwe kuti ushandise kuiswa kwehwindo mune yakazara skrini nzvimbo yeakawanda-monitor masisitimu, pasina kuganhurirwa kune yazvino skrini.
- Meta tag , iyo saiti inogona kuzivisa bhurawuza nezve kudiwa kwekuita modes kudzikisa simba rekushandisa uye optimize CPU mutoro.
- API kuzivisa kukanganisa kunogona kuitika kwemitemo yekuzviparadzanisa nevamwe (COEP) uye (COOP), pasina kushandisa zvirambidzo chaizvo.
- Mune API mhando itsva yezvitupa yakarongwa , ichipa humwe husimbiso hwekutengeserana kwekubhadhara kuri kuitwa. Bato rinovimbika, rakadai sebhangi, rinokwanisa kugadzira kiyi yeruzhinji, PublicKeyCredential, iyo inogona kukumbirwa nemutengesi kuti awedzere kubhadhara kwakachengeteka.
- kune yakaderera-level yekuwana kuHID zvishandiso (Human interface zvishandiso, keyboards, mbeva, gamepads, touch panels), zvichikubvumidza iwe kuita pfungwa yekushanda neHID mudziyo muJavaScript kuronga basa neasingawanzo HID zvishandiso pasina kuvapo kwevatyairi chaivo. muhurongwa.
- Mune API kuti uone kurereka kwechinyoreso, rutsigiro rwakawedzerwa kumakona ehurefu (iyo kona iri pakati pechinyoreso nechidzitiro) uye azimuth (iyo kona iri pakati peiyo X axis uye kuratidzwa kwechinyoreso pachiratidziro), pachinzvimbo cheTiltX uye. TiltY angles (makona ari pakati pendege kubva pachinyoreso uye imwe yemasanhu nendege kubva kuY uye Y axes Z). Zvakare yakawedzera kushandura mabasa pakati pealtitude/azimuth uye TiltX/TiltY.
- Yakachinja encoding yenzvimbo muma URL paiverengerwa mumaprotocol handlers - the navigator.registerProtocolHandler() nzira yava kutsiva nzvimbo ne "%20" pachinzvimbo che "+", iyo inobatanidza maitiro nemamwe mabhurawuza akaita seFirefox.
- Yakawedzera CSS pseudo-element "", iyo inokutendera kuti ugadzirise ruvara, saizi, chimiro uye mhando yenhamba uye mapoinzi ezvinyorwa mumabhuroko Uye .
- Yakawedzera HTTP musoro wetsigiro , mitemo yekuwana magwaro, yakafanana nebhokisi rejecha rekuparadzanisa nzira ye iframes, asi yakawanda pasi rose. Semuenzaniso, kuburikidza neGwaro-Policy unogona kudzikamisa kushandiswa kwemifananidzo yakaderera, kudzima zvishoma nezvishoma JavaScript APIs, gadzirisa mitemo yekurodha iframes, mifananidzo uye zvinyorwa, kudzikisira saizi yegwaro rese uye traffic, inorambidza nzira dzinotungamira kudhirowa peji, kudzima. basa .
- To element yakawedzera tsigiro ye 'inline-grid', 'grid', 'inline-flex' uye 'flex' paramita akaiswa kuburikidza ne'kuratidza' CSS chivakwa.
- Yakawedzerwa nzira kutsiva vana vese venode yemubereki neimwe DOM node. Kare, waigona kushandisa musanganiswa wenode.removeChild() ne node.append() kana node.innerHTML uye node.append() kutsiva node.
- huwandu hwezvirongwa zveURL zvinotenderwa kudhindwa uchishandisa registerProtocolHandler(). Rondedzero yezvirongwa inosanganisira decentralized protocols cabal, dat, did, dweb, ethereum, hyper, ipfs, ipns uye ssb, iyo inokutendera iwe kutsanangura zvinongedzo kune zvinhu zvisinei nenzvimbo kana gedhi rinopa mukana kune iyo sosi.
- Mune API yakawedzera rutsigiro rwechinyorwa/html fomati yekukopa nekunamira HTML kuburikidza ne clipboard (ine njodzi HTML inovaka inocheneswa kana uchinyora nekuverenga kune clipboard). Shanduko, semuenzaniso, inobvumidza iwe kuronga kuisirwa uye kukopa zvinyorwa zvakafometwa nemifananidzo uye zvinongedzo muwebhu edhita.
- MuWebRTC iko kugona kubatanidza yako wega data handlers inodaidzwa paencoding kana decoding matanho eWebRTC MediaStreamTrack. Semuenzaniso, kugona uku kunogona kushandiswa kuwedzera rutsigiro rwekupedzisira-kusvika-kumagumo encryption yedata inofambiswa kuburikidza nepakati maseva.
- MuJavaScript injini V8 ne75% kushandiswa kweNhamba.prototype.toString. Yakawedzerwa .name property kumakirasi asynchronous ane value isina chinhu. Nzira yeAtomics.wake yakabviswa, iyo pane imwe nguva yakatumidzwa zita rokuti Atomics.zivisa kuti ienderane ne ECMA-262 tsanangudzo. Fuzzing yekuyedza toolkit kodhi yakavhurwa .
- Iyo Liftoff baseline compiler yeWebAssembly, yakaburitswa mukuburitswa kwekupedzisira, inosanganisira kugona kushandisa vector mirairo. kukurumidza kuverenga. Tichitarisa nemiedzo, optimization yakaita kuti zvikwanise kumhanyisa mimwe bvunzo ne2.8 nguva. Imwe optimization yakaita kuti ikurumidze kudaidza kunze kwenyika JavaScript mabasa kubva kuWebAssembly.
- zvishandiso zvevagadziri vewebhu: Iyo Media pani yakawedzera ruzivo nezvevatambi vakashandiswa kutamba vhidhiyo pane peji, kusanganisira chiitiko data, matanda, hupfumi hwezvivakwa, uye furemu decoding paramita (semuenzaniso, unogona kuona zvikonzero zvekurasikirwa kwefuremu uye matambudziko ekudyidzana. kubva kuJavaScript).
Mune menyu yemamiriro eiyo Elements pani, kugona kugadzira zvidzitiro zvechinhu chakasarudzwa kwakawedzerwa (semuenzaniso, unogona kugadzira skrini yetafura yezviri mukati kana tafura).
Muwebhu console, dambudziko rekunyevera pani rakatsiviwa nemeseji yenguva dzose, uye matambudziko ane wechitatu-bato Cookies akavanzwa nekusarudzika muIssues tab uye anogoneswa neakakosha bhokisi rekutarisa.
MuRendering tab, bhatani re "Dzima mafonti emunharaunda" rawedzerwa, iro rinokutendera kuti utevedzere kusavapo kwemafonti emunharaunda, uye muSensors tebhu iwe unogona ikozvino kutevedzera kusaita kwemushandisi (yekushandisa uchishandisa Idle Detection API).
Iyo Chishandiso pani inopa ruzivo rwakadzama nezve imwe neimwe iframe, yakavhurika hwindo, uye pop-up, kusanganisira ruzivo nezve Cross-Origin yekuzviparadzanisa nevamwe uchishandisa COEP uye COOP.
- protocol kushandiswa kutsiva kune iyo sarudzo yakagadziridzwa muIETF yakatarwa, panzvimbo yeGoogle QUIC sarudzo.
Kuwedzera kune hutsva uye bug kugadzirisa, iyo nyowani vhezheni inobvisa . Kuwanda kwekusagadzikana kwakaonekwa semhedzisiro yekuongorora otomatiki nematurusi , , , ΠΈ . Kusagadzikana kumwe (CVE-2020-15967, kuwana yakasunungurwa ndangariro mukodhi yekudyidzana neGoogle Payments) inomisikidzwa yakaoma, i.e. inokutendera kuti upfuure ese mazinga ebrowser kuchengetedza uye kuita kodhi pane system kunze kwesandbox nharaunda. Sechikamu chechirongwa chekubhadhara mibairo yemari yekuwana kusasimba kwekuburitswa kwazvino, Google yakabhadhara mibairo makumi maviri nenomwe inokosha $27 (mubairo mumwe chete wemadhora zviuru gumi nezvishanu, mibairo mitatu yemadhora zviuru zvishanu, mibairo mishanu yemadhora zviuru zvishanu, mibairo yemadhora zviuru zvitatu, mubairo mumwe wemadhora mazana maviri, uye mibairo miviri yemadhora mazana mashanu). Saizi yegumi nematatu mibairo haisati yazivikanwa.
Source: opennet.ru