Ukukhishwa kwe-Chrome 78

Google kwethulwe ukukhishwa kwesiphequluli sewebhu I-Chrome 78... Kanyekanye iyatholakala ukukhishwa okuzinzile kwephrojekthi yamahhala Chromium, esebenza njengesisekelo se-Chrome. Isiphequluli se-Chrome okuhlukile ukusetshenziswa kwezimpawu ze-Google, ukuba khona kwesistimu yokuthumela izaziso uma kwenzeka ingozi, ikhono lokulanda imojula ye-Flash uma ucelwa, amamojula wokudlala okuqukethwe kwevidiyo evikelekile (DRM), uhlelo lokufaka ngokuzenzakalelayo izibuyekezo kanye nokudlulisa ngesikhathi sokusesha Izilinganiso ze-RLZ. Ukukhishwa okulandelayo kwe-Chrome 79 kuhlelelwe uDisemba 10.

main shintsha в Chrome 78:

• Kwenziwa usekelo lokuhlola lwe-“DNS phezu kwe-HTTPS” (DoH, DNS phezu kwe-HTTPS), oluzonikwa amandla ngokukhetha ezigabeni ezithile zabasebenzisi labo izilungiselelo zabo zesistimu sezivele zibonisa abahlinzeki be-DNS abasekela i-DoH. Isibonelo, uma umsebenzisi ene-DNS 8.8.8.8 ecaciswe kuzilungiselelo zesistimu, isevisi ye-DoH ye-Google (“https://dns.google.com/dns-query”) izokwenziwa isebenze ku-Chrome; uma i-DNS ithi 1.1.1.1. XNUMX, bese kuba yisevisi ye-DoH Cloudflare (“https://cloudflare-dns.com/dns-query”), njll.

  Ukuze ulawule ukuthi i-DoH ivuliwe yini, kunikezwa isilungiselelo esithi “chrome://flags/#dns-over-https”. Kusekelwa izindlela ezintathu zokusebenza: zivikelekile, ziyazenzakalela futhi zivaliwe. Kumodi "evikelekile", ababungazi banqunywa kuphela ngokusekelwe kumanani avikelekile agcinwe kunqolobane yangaphambilini (atholwe ngoxhumano oluvikelekile) kanye nezicelo nge-DoH; ukubuyela emuva ku-DNS evamile akusetshenziswa. Kumodi "ezenzakalelayo", uma i-DoH nenqolobane evikelekile ingatholakali, idatha ingabuyiswa kunqolobane engavikelekile futhi ifinyelelwe nge-DNS evamile. Kumodi "yokucisha", inqolobane eyabiwe iqala ihlolwe futhi uma ingekho idatha, isicelo sithunyelwa ngohlelo lwe-DNS.

• Amathuluzi okuvumelanisa manje anosekelo lokuqala lwamabhodi wokunamathisela okwabelwana ngawo, kodwa awakakanikwa amandla kubo bonke abasebenzisi. Ezimweni ze-Chrome exhunywe ku-akhawunti eyodwa, ungakwazi manje ukufinyelela okuqukethwe ebhodini lokunamathisela lenye idivayisi, okuhlanganisa ukwabelana ngebhodi lokunamathisela phakathi kwesistimu yeselula neyedeskithophu. Okuqukethwe ebhodini lokunamathisela kubethelwe kusetshenziswa ukubethela ngasemaphethelweni, okungakuvumeli ukufinyelela umbhalo kumaseva we-Google;
• Ezigabeni ezithile zabasebenzisi, inketho yokuhlola inikwe amandla ukushintsha itimu nokwenza ngendlela oyifisayo isikrini esiboniswa lapho kuvulwa ithebhu entsha. Ngaphezu kokukhetha isithombe sangemuva, imenyu ethi “Enza ngendlela oyifisayo”, eboniswa ekhoneni elingezansi kwesokudla kwesikrini sethebhu entsha, manje isekela ukushintsha indlela yesakhiwo sezinqamuleli kanye nekhono lokushintsha itimu. Izinqamuleli zingaphakanyiswa ngokuzenzakalelayo ngokusekelwe kumasayithi avakashelwa kakhulu, enziwe ngokwezifiso umsebenzisi, noma akhutshazwe ngokuphelele. Ungakhetha itimu yedizayini kusethi yamatimu achazwe ngaphambilini noma udale eyakho ngokusekelwe ekukhethweni kwemibala oyifunayo kuphalethi. Ukuze unike amandla izici ezintsha, ungasebenzisa amafulegi okuthi “chrome://flags/#ntp-customization-menu-v2” futhi
  "chrome://flags/#chrome-colors";

• Emabhizinisini, ibha yekheli ezenzakalelayo inikwe amandla ukusesha amafayela kusitoreji se-Google Drayivu. Ukusesha akwenziwa kuphela ngezihloko, kodwa futhi nokuqukethwe kwemibhalo, kucatshangelwa umlando wokutholwa kwawo esikhathini esidlule;
  

• Ingxenye yokuhlolwa kwephasiwedi ifakiwe, ezokwenziwa isebenze ngokuqhubekayo ezigabeni ezithile zabasebenzisi (ukwenza kusebenze ngempoqo, ifulegi elithi “chrome://flags/#password-leak-detection” liyanikezwa). Ukuhlola Iphasiwedi ngaphambili enikeziwe ngesimo ukwengeza kwangaphandle, eklanyelwe ukuhlaziya amandla amaphasiwedi asetshenziswa umsebenzisi. Uma uzama ukungena kunoma iyiphi iwebhusayithi, Ukuhlola Iphasiwedi kuhlola ukungena kwakho kanye nephasiwedi ngokumelene nesizindalwazi sama-akhawunti onakalisiwe, kubonisa isexwayiso uma izinkinga zitholwa (hlola kwenziwe ngokusekelwe kusiqalo se-hashi sohlangothi lomsebenzisi). Ukuhlolwa kwenziwa ngokumelene nesizindalwazi esimboza ama-akhawunti onakalisiwe angaphezu kwezigidigidi ezi-4 avele kuzigcinilwazi zabasebenzisi eziputshuziwe. Isexwayiso siyavezwa futhi uma uzama ukusebenzisa amagama ayimfihlo angasho lutho njengokuthi "abc123";
• Kwengezwe amandla okuqalisa ikholi esuka kudivayisi ye-Android exhunywe ku-akhawunti efanayo ye-Google. Kusiphequluli sedeskithophu, umsebenzisi angagqamisa inombolo yocingo embhalweni, chofoza kwesokudla futhi aqondise kabusha ukusebenza kwekholi kudivayisi ye-Android, ngemva kwalokho kuzovela isaziso ocingweni esibavumela ukuthi baqale ucingo;
• Ifomethi yethiphu yamathuluzi eboniswa lapho uhambisa igundane phezu kwesihloko sethebhu ishintshiwe. Ithulithiphu manje selivela njengebhulokhi ephumayo ebonisa umbhalo wesihloko ogcwele kanye ne-URL yekhasi. Ibhulokhi ilungele ukusetshenziswa ukuze uthole ngokushesha ikhasi olifunayo lapho uvula inombolo enkulu kakhulu yamathebhu (esikhundleni sokudlula kumathebhu, ungahambisa imawusi phezu kwephaneli ngamathebhu futhi uthole ikhasi olifunayo). Ngokuzayo, kuhlelwe ukuthi kuboniswe isithonjana sekhasi kuleli bhulokhi;
• Kwengezwe isici sokuhlola (chrome://flags/#enable-force-dark) ukuze kuphoqelelwe ukusetshenziswa kwetimu emnyama lapho ubuka amawebhusayithi. Ukuqinisekisa isethulo esimnyama sesayithi, imibala iyahlanekezelwa;
• Kwengeziwe ukusekela imininingwane I-CSS Properties and Values ​​​​API Level 1, okukuvumela ukuthi ubhalise izakhiwo zakho ze-CSS ezihlala ziwuhlobo oluthile, zikuvumela ukuthi usethe inani elizenzakalelayo, futhi ikuvumela ukuthi ubophe imiphumela yokugqwayiza. Ukuze ubhalise isakhiwo, ungasebenzisa indlela yerejistaProperty() noma umthetho we-CSS othi “@property”, isibonelo:

  I-CSS.registerProperty({
  igama: "--usayizi-wefonti yami",
  i-syntax: "‹ubude›",
  Inani lokuqala: "0px",
  ifa: amanga
  });

• Kumodi Yezilingo Zomsuka (izici zokuhlola ezidinga ukuhlukaniswa ukwenza kusebenze) kuphakanyiswe ama-API amasha ambalwa. I-Origin Trial isho amandla okusebenza ne-API eshiwo ezinhlelweni ezilandwe ku-localhost noma 127.0.0.1, noma ngemva kokubhalisa nokwamukela ithokheni elikhethekile elisebenza isikhathi esilinganiselwe sesayithi elithile.
  • API Isistimu Yefayela Yomdabu, okukuvumela ukuthi udale izinhlelo zokusebenza zewebhu ezisebenzisana namafayela ohlelweni lwamafayela wendawo. Isibonelo, i-API entsha ingase idingeke ezindaweni ezihlanganisiwe zokuthuthukiswa okusekelwe kusiphequluli, umbhalo, izithombe nabahleli bevidiyo. Ukuze ukwazi ukubhala ngokuqondile nokufunda amafayela, sebenzisa izingxoxo ukuze uvule futhi ulondoloze amafayela, kanye nokuzulazula ngokuqukethwe kwezinkomba, uhlelo lokusebenza lucela umsebenzisi ukuqinisekiswa okukhethekile;
    

  • Indlela I-HTTP Exchanges (SXG) esayiniwe, okukuvumela ukuthi ubeke amakhophi aqinisekisiwe amakhasi ewebhu kwamanye amasayithi afana namakhasi oqobo kumsebenzisi (ngaphandle kokushintsha i-URL), enwetshiwe ikhono lokulanda izinsiza ezingaphansi (CSS, JS, izithombe, njll.) kusayithi lokuqala. Umthombo wangempela wesisetshenziswa ucaciswa ngesihloko se-Link HTTP, esiphinda ucacise i-hash yokuqinisekisa ukuze kuqinisekiswe insiza ngayinye. Ngalesi sici esisha, abahlinzeki bokuqukethwe bangakha ifayela elilodwa le-HTML esayiniwe elihlanganisa zonke izinsiza ezingaphansi ezihambisanayo;
  • API Isamukeli se-SMS, ukuvumela uhlelo lokusebenza lwewebhu ukuthi lufinyelele imilayezo ye-SMS, isibonelo, ukwenza ngokuzenzakalelayo ukuqinisekiswa komsebenzi kusetshenziswa ikhodi yesikhathi esisodwa ethunyelwe nge-SMS. Ukufinyelela kunikezwa kuphela ku-SMS equkethe ithegi ekhethekile enquma ukubophezela komlayezo kuhlelo lokusebenza oluthile lwewebhu;
• Ukusebenza kokulayisha izinto ze-ArrayBuffer ngeWeb Socket kuthuthukiswe kakhulu. Ku-platform ye-Linux kukhona ukwanda kwejubane lokulanda izikhathi ezingu-7.5, ku-Windows - ngezikhathi ezingu-4.1, ku-macOS - izikhathi ezingu-7.8;
• Kwengezwe amandla okuchaza inani lokubonisa ngale njengephesenti ku-opacity yezakhiwo ze-CSS, i-stop-opacity, i-fill-opacity, i-stroke-opacity, kanye ne-shape-image-threshold. Isibonelo, esikhundleni sokuthi "i-opacity: 0.5" ungakwazi manje ukucacisa "i-opacity: 50%";
• Ku-API Isikhathi somsebenzisi Ivumela ukudlulisa izitembu zesikhathi ngokunganaki ku-performance.measure() kanye ne-performance.mark() izingcingo ukuze kwenziwe izilinganiso phakathi kwazo, kanye nokucacisa imethadatha engafanele;
• Ku-API Media Session kwengezwe ukusekelwa kokuchaza izibambi zokushintsha indawo emfudlaneni (seekto), ngaphezu kokumiswa okwesikhashana okutholakala ngaphambilini bese uqala izibambi zokudlala;
• Enjinini ye-JavaScript V8 kuhlanganisiwe imodi yangemuva yokudlulisa imibhalo ngokuhamba kwesikhathi njengoba ilayishwa ngenethiwekhi. Ukuthuthukisa okufakiwe kusivumele ukuthi sehlise isikhathi sokuhlanganiswa kombhalo ngo-5–20%. Ukukhishwa okusha futhi kuthuthukisa ukusebenza kokuchithwa kwento (ukuguqula okuthi "const {x, y} = into;" kuya ku-"const x = object.x; const y = object.y;"). Isivinini sokucubungula esithuthukisiwe sezengezo ze-RegExp ezinokumamephu okungafani.
  Ijubane lokubiza imisebenzi ye-JavaScript kusuka ku-WebAssembly futhi ngokuphambene nalokho liye lenyuka kakhulu (ngo-9-20%). Lapho kuhlanganiswa i-bytecode, ukusebenza kahle kokwakhiwa kwamatafula okubopha ezindaweni zokuqala kuye kwandiswa, okunciphise ukusetshenziswa kwenkumbulo
  1-2.5%.
  

• Kunwetshiwe amathuluzi abathuthukisi bewebhu. Ideshibhodi Yokucwaningwa Kwamabhuku manje ingasetshenziswa ngokuhambisana nezinye izici ezifana nokuvinjwa kwesicelo kanye nokubhala ngaphezulu kokulanda. Ukwesekwa okwengeziwe kokulungisa amaphutha abacubungula izinkokhelo nge-Payment API. Amalebula e-LCP (Upende Okuqukethwe Okukhulu Kakhulu) engezwe kuphaneli yokuhlaziya ukusebenza, abonisa isikhathi sokunikezela sezinto ezinkulu kakhulu;
  

• Kususiwe I-XSS Auditor Auditor blocking mechanism ye-cross-site scripting blocking, ebonwa njengengasebenzi (abahlaseli kudala basebenzisa izindlela zokudlula ukuvikelwa koMcwaningi Mabhuku we-XSS) futhi yengeza ama-vector amasha okuvuza kolwazi;
• Inguqulo ye-Android inikeza amandla okusebenzisa itimu emnyama kumamenyu, izilungiselelo, nemodi yokuzulazula kumasayithi avuliwe.

Ngokungeziwe ezenzweni ezintsha nokulungiswa kweziphazamisi, inguqulo entsha iyaqeda 37 ubuthakathaka. Ubungozi obuningi buhlonzwe njengomphumela wokuhlola okuzenzakalelayo ngamathuluzi IkheliSanitizer, I-MemorySanitizer, Lawula Ubuqotho Bokugeleza, I-LibFuzzer и AFL. Azikho izinkinga ezibucayi ezitholiwe ezingavumela umuntu ukuthi adlule wonke amazinga okuvikela isiphequluli futhi akhiphe ikhodi kusistimu engaphandle kwendawo ye-sandbox. Njengengxenye yohlelo lokukhokha imiklomelo yemali ngokuthola ubungozi ekukhishweni kwamanje, i-Google ikhokhele imiklomelo engu-21 ebiza u-$59500 (umklomelo owodwa ongu-$20000, umklomelo owodwa ongu-$15000, umklomelo owodwa ka-$5000, imiklomelo emibili engu-$3000, imiklomelo emithathu engu-$2000, imiklomelo emihlanu engu-$1000 ). Usayizi wemiklomelo emi-500 awukakanqunywa.

Source: opennet.ru