chrome-devtools-frontend 1.0.1380117 → 1.0.1402249

package/front_end/models/extensions/ExtensionServer.test.ts

@@ -72,7 +72,7 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
     const resources =
         await new Promise<Chrome.DevTools.Resource[]>(r => context.chrome.devtools!.inspectedWindow.getResources(r));
 
-    assert.deepStrictEqual(resources.map(r => r.url), ['https://example.com/', 'http://example.com']);
+    assert.deepEqual(resources.map(r => r.url), ['https://example.com/', 'http://example.com']);
   });
 });
 
@@ -98,7 +98,7 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
     await context.chrome.devtools?.recorder.registerRecorderExtensionPlugin(extensionPlugin, 'Test', 'text/javascript');
 
     const manager = Extensions.RecorderPluginManager.RecorderPluginManager.instance();
-    assert.strictEqual(manager.plugins().length, 1);
+    assert.lengthOf(manager.plugins(), 1);
     const plugin = manager.plugins()[0];
 
     const result = await plugin.stringify({
@@ -110,12 +110,12 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
       type: 'scroll',
     });
 
-    assert.strictEqual(manager.plugins().length, 1);
+    assert.lengthOf(manager.plugins(), 1);
     assert.strictEqual(manager.plugins()[0].getMediaType(), 'text/javascript');
     assert.strictEqual(manager.plugins()[0].getName(), 'Test');
-    assert.deepStrictEqual(manager.plugins()[0].getCapabilities(), ['export']);
-    assert.deepStrictEqual(result, '{"name":"test","steps":[]}');
-    assert.deepStrictEqual(stepResult, '{"type":"scroll"}');
+    assert.deepEqual(manager.plugins()[0].getCapabilities(), ['export']);
+    assert.deepEqual(result, '{"name":"test","steps":[]}');
+    assert.deepEqual(stepResult, '{"type":"scroll"}');
 
     await context.chrome.devtools?.recorder.unregisterRecorderExtensionPlugin(extensionPlugin);
   });
@@ -130,7 +130,7 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
     await context.chrome.devtools?.recorder.registerRecorderExtensionPlugin(extensionPlugin, 'Replay');
 
     const manager = Extensions.RecorderPluginManager.RecorderPluginManager.instance();
-    assert.strictEqual(manager.plugins().length, 1);
+    assert.lengthOf(manager.plugins(), 1);
     const plugin = manager.plugins()[0];
 
     await plugin.replay({
@@ -138,8 +138,8 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
       steps: [],
     });
 
-    assert.strictEqual(manager.plugins().length, 1);
-    assert.deepStrictEqual(manager.plugins()[0].getCapabilities(), ['replay']);
+    assert.lengthOf(manager.plugins(), 1);
+    assert.deepEqual(manager.plugins()[0].getCapabilities(), ['replay']);
     assert.strictEqual(manager.plugins()[0].getName(), 'Replay');
 
     await context.chrome.devtools?.recorder.unregisterRecorderExtensionPlugin(extensionPlugin);
@@ -157,7 +157,7 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
     await context.chrome.devtools?.recorder.registerRecorderExtensionPlugin(extensionPlugin, 'Replay');
     const manager = Extensions.RecorderPluginManager.RecorderPluginManager.instance();
 
-    assert.strictEqual(manager.plugins().length, 1);
+    assert.lengthOf(manager.plugins(), 1);
 
     const plugin = manager.plugins()[0];
 
@@ -183,8 +183,8 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
     await context.chrome.devtools?.recorder.registerRecorderExtensionPlugin(extensionPlugin, 'Replay');
     const manager = Extensions.RecorderPluginManager.RecorderPluginManager.instance();
 
-    assert.strictEqual(manager.plugins().length, 1);
-    assert.strictEqual(manager.views().length, 1);
+    assert.lengthOf(manager.plugins(), 1);
+    assert.lengthOf(manager.views(), 1);
 
     const plugin = manager.plugins()[0];
     const onceShowRequested = manager.once(Extensions.RecorderPluginManager.Events.SHOW_VIEW_REQUESTED);
@@ -193,7 +193,7 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
       steps: [],
     });
     const viewDescriptor = await onceShowRequested;
-    assert.deepStrictEqual(viewDescriptor.title, 'Test');
+    assert.deepEqual(viewDescriptor.title, 'Test');
 
     await context.chrome.devtools?.recorder.unregisterRecorderExtensionPlugin(extensionPlugin);
   });
@@ -211,8 +211,8 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
     await context.chrome.devtools?.recorder.registerRecorderExtensionPlugin(extensionPlugin, 'Replay');
     const manager = Extensions.RecorderPluginManager.RecorderPluginManager.instance();
 
-    assert.strictEqual(manager.plugins().length, 1);
-    assert.strictEqual(manager.views().length, 1);
+    assert.lengthOf(manager.plugins(), 1);
+    assert.lengthOf(manager.views(), 1);
 
     const events: object[] = [];
     manager.addEventListener(Extensions.RecorderPluginManager.Events.SHOW_VIEW_REQUESTED, event => {
@@ -224,7 +224,7 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
     // that the ShowViewRequested command was not actually dispatched.
     await new Promise(resolve => context.chrome.devtools?.inspectedWindow.eval('1', undefined, resolve));
 
-    assert.deepStrictEqual(events, []);
+    assert.deepEqual(events, []);
     await context.chrome.devtools?.recorder.unregisterRecorderExtensionPlugin(extensionPlugin);
   });
 
@@ -255,7 +255,7 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
       steps: [],
     });
     const viewDescriptor = await onceShowRequested;
-    assert.deepStrictEqual(viewDescriptor.title, 'Test');
+    assert.deepEqual(viewDescriptor.title, 'Test');
 
     const descriptor = manager.getViewDescriptor(viewDescriptor.id);
 
@@ -301,7 +301,7 @@ describeWithDevtoolsExtension('Extensions', {}, context => {
     }));
     target.setInspectedURL('http://example.com' as Platform.DevToolsPath.UrlString);
 
-    assert.deepStrictEqual(addExtensionSpy.returnValues, [undefined, true]);
+    assert.deepEqual(addExtensionSpy.returnValues, [undefined, true]);
   });
 
   it('correcly reenables extensions after navigation', async () => {
@@ -368,7 +368,6 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
     target.setInspectedURL(allowedUrl);
     {
       const result = await new Promise<object>(cb => context.chrome.devtools?.network.getHAR(cb));
-      // eslint-disable-next-line rulesdir/compare_arrays_with_assert_deepequal
       assert.hasAnyKeys(result, ['entries']);
     }
   });
@@ -378,7 +377,6 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
     target.setInspectedURL('http://example.com2' as Platform.DevToolsPath.UrlString);
     {
       const result = await new Promise<object>(cb => context.chrome.devtools?.network.getHAR(cb));
-      // eslint-disable-next-line rulesdir/compare_arrays_with_assert_deepequal
       assert.hasAnyKeys(result, ['entries']);
     }
   });
@@ -388,11 +386,11 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
     const target = createTarget({type: SDK.Target.Type.FRAME});
     target.setInspectedURL(blockedUrl);
     assert.isTrue(addExtensionSpy.calledOnce, 'addExtension called once');
-    assert.deepStrictEqual(addExtensionSpy.returnValues, [undefined]);
+    assert.deepEqual(addExtensionSpy.returnValues, [undefined]);
 
     target.setInspectedURL(allowedUrl);
     assert.isTrue(addExtensionSpy.calledTwice, 'addExtension called twice');
-    assert.deepStrictEqual(addExtensionSpy.returnValues, [undefined, true]);
+    assert.deepEqual(addExtensionSpy.returnValues, [undefined, true]);
   });
 
   it('does not include blocked hosts in the HAR entries', async () => {
@@ -445,7 +443,7 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
         r => context.chrome.devtools?.inspectedWindow.eval(
             '4', {frameURL: childFrameUrl}, (result, error) => r({result, error})));
 
-    assert.deepStrictEqual(result.error?.details, ['Permission denied']);
+    assert.deepEqual(result.error?.details, ['Permission denied']);
   });
 
   it('doesn\'t block evaluation on blocked sub-executioncontexts with useContentScriptContext', async () => {
@@ -478,7 +476,7 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
         r => context.chrome.devtools?.inspectedWindow.eval(
             '4', {frameURL: childFrameUrl, useContentScriptContext: true}, (result, error) => r({result, error})));
 
-    assert.deepStrictEqual(result.result, 4);
+    assert.deepEqual(result.result, 4);
   });
 
   it('blocks evaluation on blocked sub-executioncontexts with explicit scriptExecutionContextOrigin', async () => {
@@ -508,7 +506,7 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
             '4', {frameURL: childFrameUrl, scriptExecutionContext: childExeContextOrigin} as any,
             (result, error) => r({result, error})));
 
-    assert.deepStrictEqual(result.error?.details, ['Permission denied']);
+    assert.deepEqual(result.error?.details, ['Permission denied']);
   });
 
   it('blocks evaluation on blocked sub-executioncontexts', async () => {
@@ -524,7 +522,7 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
         r => context.chrome.devtools?.inspectedWindow.eval(
             '4', {frameURL: childFrameUrl}, (result, error) => r({result, error})));
 
-    assert.deepStrictEqual(result.error?.details, ['Permission denied']);
+    assert.deepEqual(result.error?.details, ['Permission denied']);
   });
 
   async function createUISourceCode(
@@ -553,13 +551,13 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
     assert.exists(context.chrome.devtools);
     const resources =
         await new Promise<Chrome.DevTools.Resource[]>(r => context.chrome.devtools?.inspectedWindow.getResources(r));
-    assert.deepStrictEqual(resources.map(r => r.url), [blockedUrl, allowedUrl]);
+    assert.deepEqual(resources.map(r => r.url), [blockedUrl, allowedUrl]);
 
     const resourceContents = await Promise.all(resources.map(
         resource => new Promise<{url: string, content?: string, encoding?: string}>(
             r => resource.getContent((content, encoding) => r({url: resource.url, content, encoding})))));
 
-    assert.deepStrictEqual(resourceContents, [
+    assert.deepEqual(resourceContents, [
       {url: blockedUrl, content: undefined, encoding: undefined},
       {url: allowedUrl, content: 'content', encoding: ''},
     ]);
@@ -600,7 +598,7 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
 
     await waitForFunction(() => requests.length >= 1);
 
-    assert.strictEqual(requests.length, 1);
+    assert.lengthOf(requests, 1);
     assert.exists(requests.find(e => e.request.url === allowedUrl));
     assert.notExists(requests.find(e => e.request.url === blockedUrl));
   });
@@ -618,19 +616,19 @@ describeWithDevtoolsExtension('Runtime hosts policy', {hostsPolicy}, context =>
     assert.exists(context.chrome.devtools);
     const resources =
         await new Promise<Chrome.DevTools.Resource[]>(r => context.chrome.devtools?.inspectedWindow.getResources(r));
-    assert.deepStrictEqual(resources.map(r => r.url), [blockedUrl, allowedUrl]);
+    assert.deepEqual(resources.map(r => r.url), [blockedUrl, allowedUrl]);
 
-    assert.deepStrictEqual(project.uiSourceCodeForURL(allowedUrl)?.content(), 'content');
-    assert.deepStrictEqual(project.uiSourceCodeForURL(blockedUrl)?.content(), 'content');
+    assert.deepEqual(project.uiSourceCodeForURL(allowedUrl)?.content(), 'content');
+    assert.deepEqual(project.uiSourceCodeForURL(blockedUrl)?.content(), 'content');
     const responses = await Promise.all(resources.map(
                           resource => new Promise<Object|undefined>(r => resource.setContent('modified', true, r)))) as
         Array<undefined|{code: string, details: string[]}>;
 
-    assert.deepStrictEqual(responses.map(response => response?.code), ['E_FAILED', 'OK']);
-    assert.deepStrictEqual(responses.map(response => response?.details), [['Permission denied'], []]);
+    assert.deepEqual(responses.map(response => response?.code), ['E_FAILED', 'OK']);
+    assert.deepEqual(responses.map(response => response?.details), [['Permission denied'], []]);
 
-    assert.deepStrictEqual(project.uiSourceCodeForURL(allowedUrl)?.content(), 'modified');
-    assert.deepStrictEqual(project.uiSourceCodeForURL(blockedUrl)?.content(), 'content');
+    assert.deepEqual(project.uiSourceCodeForURL(allowedUrl)?.content(), 'modified');
+    assert.deepEqual(project.uiSourceCodeForURL(blockedUrl)?.content(), 'content');
   });
 });
 
@@ -640,8 +638,7 @@ describe('ExtensionServer', () => {
     const extensionOrigin = 'chrome://abcdef' as Platform.DevToolsPath.UrlString;
     const almostOrigin = `${extensionOrigin}/` as Platform.DevToolsPath.UrlString;
     const expectation = `${extensionOrigin}/foo` as Platform.DevToolsPath.UrlString;
-    assert.strictEqual(
-        undefined,
+    assert.isUndefined(
         Extensions.ExtensionServer.ExtensionServer.expandResourcePath(extensionOrigin, 'http://example.com/foo'));
     assert.strictEqual(
         expectation, Extensions.ExtensionServer.ExtensionServer.expandResourcePath(extensionOrigin, expectation));
@@ -650,8 +647,7 @@ describe('ExtensionServer', () => {
     assert.strictEqual(
         expectation, Extensions.ExtensionServer.ExtensionServer.expandResourcePath(extensionOrigin, 'foo'));
 
-    assert.strictEqual(
-        undefined,
+    assert.isUndefined(
         Extensions.ExtensionServer.ExtensionServer.expandResourcePath(almostOrigin, 'http://example.com/foo'));
     assert.strictEqual(
         expectation, Extensions.ExtensionServer.ExtensionServer.expandResourcePath(almostOrigin, expectation));
@@ -704,6 +700,20 @@ describe('ExtensionServer', () => {
       assert.isTrue(Extensions.ExtensionServer.ExtensionServer.canInspectURL(url), url);
     }
   });
+
+  it('cannot inspect non-HTTP URL schemes', () => {
+    const blockedUrls = [
+      'devtools://devtools/bundled/front_end/devtools_app.html',
+      'devtools://devtools/anything',
+      'chrome://extensions',
+      'chrome-untrusted://extensions',
+      'chrome-error://crash',
+      'chrome-search://foo/bar',
+    ];
+    for (const url of blockedUrls as Platform.DevToolsPath.UrlString[]) {
+      assert.isFalse(Extensions.ExtensionServer.ExtensionServer.canInspectURL(url), url);
+    }
+  });
 });
 
 function assertIsStatus<T>(value: T|
@@ -773,6 +783,47 @@ describeWithDevtoolsExtension('Wasm extension API', {}, context => {
   });
 });
 
+class StubLanguageExtension implements Chrome.DevTools.LanguageExtensionPlugin {
+  async addRawModule(): Promise<string[]|{missingSymbolFiles: string[]}> {
+    return [];
+  }
+  async sourceLocationToRawLocation(): Promise<Chrome.DevTools.RawLocationRange[]> {
+    return [];
+  }
+  async rawLocationToSourceLocation(): Promise<Chrome.DevTools.SourceLocation[]> {
+    return [];
+  }
+  async getScopeInfo(): Promise<Chrome.DevTools.ScopeInfo> {
+    throw new Error('Method not implemented.');
+  }
+  async listVariablesInScope(): Promise<Chrome.DevTools.Variable[]> {
+    return [];
+  }
+  async removeRawModule(): Promise<void> {
+  }
+  async getFunctionInfo(): Promise<{frames: Array<Chrome.DevTools.FunctionInfo>, missingSymbolFiles: Array<string>}|
+                                   {missingSymbolFiles: Array<string>}|{frames: Array<Chrome.DevTools.FunctionInfo>}> {
+    return {frames: []};
+  }
+  async getInlinedFunctionRanges(): Promise<Chrome.DevTools.RawLocationRange[]> {
+    return [];
+  }
+  async getInlinedCalleesRanges(): Promise<Chrome.DevTools.RawLocationRange[]> {
+    return [];
+  }
+  async getMappedLines(): Promise<number[]|undefined> {
+    return undefined;
+  }
+  async evaluate(): Promise<Chrome.DevTools.RemoteObject|Chrome.DevTools.ForeignObject|null> {
+    return null;
+  }
+  async getProperties(): Promise<Chrome.DevTools.PropertyDescriptor[]> {
+    return [];
+  }
+  async releaseObject(): Promise<void> {
+  }
+}
+
 describeWithDevtoolsExtension('Language Extension API', {}, context => {
   it('reports loaded resources', async () => {
     const target = createTarget();
@@ -800,3 +851,47 @@ describeWithDevtoolsExtension('Language Extension API', {}, context => {
     assert.deepEqual(resource, expectedResource);
   });
 });
+
+for (const allowFileAccess of [true, false]) {
+  describeWithDevtoolsExtension(
+      `Language Extension API with {allowFileAccess: ${allowFileAccess}}`, {allowFileAccess}, context => {
+        let target: SDK.Target.Target;
+        beforeEach(() => {
+          target = createTarget();
+          const targetManager = target.targetManager();
+          const workspace = Workspace.Workspace.WorkspaceImpl.instance();
+          const resourceMapping = new Bindings.ResourceMapping.ResourceMapping(targetManager, workspace);
+          target.setInspectedURL('http://example.com' as Platform.DevToolsPath.UrlString);
+          const debuggerWorkspaceBinding = Bindings.DebuggerWorkspaceBinding.DebuggerWorkspaceBinding.instance(
+              {forceNew: true, targetManager, resourceMapping});
+          Bindings.IgnoreListManager.IgnoreListManager.instance({forceNew: true, debuggerWorkspaceBinding});
+        });
+
+        it('passes allowFileAccess to the LanguageExtensionEndpoint', async () => {
+          const endpointSpy =
+              sinon.spy(Extensions.LanguageExtensionEndpoint.LanguageExtensionEndpoint.prototype, 'handleScript');
+          const plugin = new StubLanguageExtension();
+          await context.chrome.devtools?.languageServices.registerLanguageExtensionPlugin(plugin, 'plugin', {
+            language: Protocol.Debugger.ScriptLanguage.JavaScript,
+            symbol_types: [Protocol.Debugger.DebugSymbolsType.SourceMap],
+          });
+
+          const debuggerModel = target.model(SDK.DebuggerModel.DebuggerModel);
+          assert.isOk(debuggerModel);
+          debuggerModel.parsedScriptSource(
+              '0' as Protocol.Runtime.ScriptId, 'file:///source/url' as Platform.DevToolsPath.UrlString, 0, 0, 100, 100,
+              0, '', {}, false, 'file:///source/url.map', false, false, 200, true, null, null,
+              Protocol.Debugger.ScriptLanguage.JavaScript, [{
+                type: Protocol.Debugger.DebugSymbolsType.SourceMap,
+                externalURL: 'file:///source/url.map',
+              }],
+              null);
+
+          assert.isTrue(endpointSpy.calledOnce);
+          assert.strictEqual(
+              (endpointSpy.thisValues[0] as Extensions.LanguageExtensionEndpoint.LanguageExtensionEndpoint)
+                  .allowFileAccess,
+              allowFileAccess);
+        });
+      });
+}

package/front_end/models/extensions/ExtensionServer.ts

@@ -56,6 +56,7 @@ import {RecorderExtensionEndpoint} from './RecorderExtensionEndpoint.js';
 import {RecorderPluginManager} from './RecorderPluginManager.js';
 
 const extensionOrigins: WeakMap<MessagePort, Platform.DevToolsPath.UrlString> = new WeakMap();
+const kPermittedSchemes = ['http:', 'https:', 'file:', 'data:', 'chrome-extension:', 'about:'];
 
 declare global {
   interface Window {
@@ -63,8 +64,6 @@ declare global {
   }
 }
 
-const kAllowedOrigins = [].map(url => (new URL(url)).origin);
-
 let extensionServerInstance: ExtensionServer|null;
 
 export class HostsPolicy {
@@ -314,8 +313,12 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
     const symbol_types_array =
         (Array.isArray(symbol_types) && symbol_types.every(e => typeof e === 'string') ? symbol_types : []);
     const extensionOrigin = this.getExtensionOrigin(_shared_port);
-    const endpoint =
-        new LanguageExtensionEndpoint(extensionOrigin, pluginName, {language, symbol_types: symbol_types_array}, port);
+    const registration = this.registeredExtensions.get(extensionOrigin);
+    if (!registration) {
+      throw new Error('Received a message from an unregistered extension');
+    }
+    const endpoint = new LanguageExtensionEndpoint(
+        registration.allowFileAccess, extensionOrigin, pluginName, {language, symbol_types: symbol_types_array}, port);
     pluginManager.addPlugin(endpoint);
     return this.status.OK();
   }
@@ -1406,19 +1409,8 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
     } catch (exception) {
       return false;
     }
-    if (kAllowedOrigins.includes(parsedURL.origin)) {
-      return true;
-    }
-    if (parsedURL.protocol === 'chrome:' || parsedURL.protocol === 'devtools:' ||
-        parsedURL.protocol === 'chrome-untrusted:' || parsedURL.protocol === 'chrome-error:' ||
-        parsedURL.protocol === 'chrome-search:') {
-      return false;
-    }
-    if (parsedURL.protocol.startsWith('http') && parsedURL.hostname.match(/^chrome\.google\.com\.?$/) &&
-        parsedURL.pathname.startsWith('/webstore')) {
-      return false;
-    }
-    if (parsedURL.protocol.startsWith('http') && parsedURL.hostname.match(/^chromewebstore\.google\.com\.?$/)) {
+
+    if (!kPermittedSchemes.includes(parsedURL.protocol)) {
       return false;
     }
 
@@ -1428,9 +1420,34 @@ export class ExtensionServer extends Common.ObjectWrapper.ObjectWrapper<EventTyp
       return false;
     }
 
+    if (this.#isUrlFromChromeWebStore(parsedURL)) {
+      return false;
+    }
+
     return true;
   }
 
+  /**
+   * Tests whether a given URL is from the Chrome web store to prevent the extension server from
+   * being injected. This is treated as separate from the `getOriginsForbiddenForExtensions` API because
+   * DevTools might not be being run from a native origin and we still want to lock down this specific
+   * origin from DevTools extensions.
+   *
+   * @param parsedURL The URL to check
+   * @returns `true` if the URL corresponds to the Chrome web store; otherwise `false`
+   */
+  static #isUrlFromChromeWebStore(parsedURL: URL): boolean {
+    if (parsedURL.protocol.startsWith('http') && parsedURL.hostname.match(/^chrome\.google\.com\.?$/) &&
+        parsedURL.pathname.startsWith('/webstore')) {
+      return true;
+    }
+    if (parsedURL.protocol.startsWith('http') && parsedURL.hostname.match(/^chromewebstore\.google\.com\.?$/)) {
+      return true;
+    }
+
+    return false;
+  }
+
   private disableExtensions(): void {
     this.extensionsEnabled = false;
   }

package/front_end/models/extensions/LanguageExtensionEndpoint.test.ts

@@ -0,0 +1,59 @@
+// Copyright 2024 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import type * as Platform from '../../core/platform/platform.js';
+import * as SDK from '../../core/sdk/sdk.js';
+import * as Protocol from '../../generated/protocol.js';
+
+import * as Extensions from './extensions.js';
+
+for (const allowFileAccess of [true, false]) {
+  describe(`LanguageExtensionEndpoint ${allowFileAccess ? 'with' : 'without'} file access`, () => {
+    let endpoint: Extensions.LanguageExtensionEndpoint.LanguageExtensionEndpoint;
+    beforeEach(() => {
+      const channel = new MessageChannel();
+      endpoint = new Extensions.LanguageExtensionEndpoint.LanguageExtensionEndpoint(
+          allowFileAccess, '', '', {language: 'lang', symbol_types: [Protocol.Debugger.DebugSymbolsType.SourceMap]},
+          channel.port1);
+    });
+
+    it('canAccessURL respects allowFileAccess correctly', () => {
+      assert.isTrue(endpoint.canAccessURL('http://example.com'));
+      assert.strictEqual(endpoint.canAccessURL('file:///file'), allowFileAccess);
+    });
+
+    it('handleScript respects allowFileAccess correctly', () => {
+      const script = sinon.createStubInstance(SDK.Script.Script);
+      script.debugSymbols = {type: Protocol.Debugger.DebugSymbolsType.SourceMap};
+      script.scriptLanguage.returns('lang');
+
+      script.contentURL.returns('file:///file' as Platform.DevToolsPath.UrlString);
+      assert.strictEqual(endpoint.handleScript(script), allowFileAccess);
+      script.contentURL.returns('http://example.com' as Platform.DevToolsPath.UrlString);
+      assert.isTrue(endpoint.handleScript(script));
+
+      script.hasSourceURL = true;
+      script.sourceURL = 'file:///file' as Platform.DevToolsPath.UrlString;
+      assert.strictEqual(endpoint.handleScript(script), allowFileAccess);
+      script.sourceURL = 'http://example.com' as Platform.DevToolsPath.UrlString;
+      assert.isTrue(endpoint.handleScript(script));
+
+      script.debugSymbols.externalURL = 'file:///file';
+      assert.strictEqual(endpoint.handleScript(script), allowFileAccess);
+      script.debugSymbols.externalURL = 'http://example.com';
+      assert.isTrue(endpoint.handleScript(script));
+    });
+
+    it('addRawModule respects allowFileAccess correctly', async () => {
+      const endpointProxyStub = sinon.stub(Extensions.ExtensionEndpoint.ExtensionEndpoint.prototype, 'sendRequest');
+      endpointProxyStub.resolves([]);
+      await endpoint.addRawModule('', 'file:///file', {url: 'http://example.com'});
+      assert.strictEqual(endpointProxyStub.calledOnce, allowFileAccess);
+      await endpoint.addRawModule('', 'http://example.com', {url: 'file:///file'});
+      assert.strictEqual(endpointProxyStub.calledTwice, allowFileAccess);
+      await endpoint.addRawModule('', 'http://example.com', {url: 'http://example.com'});
+      assert.lengthOf(endpointProxyStub.getCalls(), allowFileAccess ? 3 : 1);
+    });
+  });
+}

package/front_end/models/extensions/LanguageExtensionEndpoint.ts

@@ -31,18 +31,17 @@ class LanguageExtensionEndpointImpl extends ExtensionEndpoint {
 export class LanguageExtensionEndpoint implements Bindings.DebuggerLanguagePlugins.DebuggerLanguagePlugin {
   private readonly supportedScriptTypes: {
     language: string,
-    // TODO(crbug.com/1172300) Ignored during the jsdoc to ts migration
     // eslint-disable-next-line @typescript-eslint/naming-convention
     symbol_types: Array<string>,
   };
-  private endpoint: LanguageExtensionEndpointImpl;
-  private extensionOrigin: string;
-  name: string;
+  private readonly endpoint: LanguageExtensionEndpointImpl;
+  private readonly extensionOrigin: string;
+  readonly allowFileAccess: boolean;
+  readonly name: string;
 
   constructor(
-      extensionOrigin: string, name: string, supportedScriptTypes: {
+      allowFileAccess: boolean, extensionOrigin: string, name: string, supportedScriptTypes: {
         language: string,
-        // TODO(crbug.com/1172300) Ignored during the jsdoc to ts migration
         // eslint-disable-next-line @typescript-eslint/naming-convention
         symbol_types: Array<string>,
       },
@@ -51,9 +50,26 @@ export class LanguageExtensionEndpoint implements Bindings.DebuggerLanguagePlugi
     this.extensionOrigin = extensionOrigin;
     this.supportedScriptTypes = supportedScriptTypes;
     this.endpoint = new LanguageExtensionEndpointImpl(this, port);
+    this.allowFileAccess = allowFileAccess;
+  }
+
+  canAccessURL(url: string): boolean {
+    try {
+      return this.allowFileAccess || new URL(url).protocol !== 'file:';
+    } catch (e) {
+      return false;
+    }
   }
 
   handleScript(script: SDK.Script.Script): boolean {
+    try {
+      if (!this.canAccessURL(script.contentURL()) || (script.hasSourceURL && !this.canAccessURL(script.sourceURL)) ||
+          (script.debugSymbols?.externalURL && !this.canAccessURL(script.debugSymbols.externalURL))) {
+        return false;
+      }
+    } catch (e) {
+      return false;
+    }
     const language = script.scriptLanguage();
     return language !== null && script.debugSymbols !== null && language === this.supportedScriptTypes.language &&
         this.supportedScriptTypes.symbol_types.includes(script.debugSymbols.type);
@@ -71,6 +87,9 @@ export class LanguageExtensionEndpoint implements Bindings.DebuggerLanguagePlugi
   /** Notify the plugin about a new script
    */
   addRawModule(rawModuleId: string, symbolsURL: string, rawModule: Chrome.DevTools.RawModule): Promise<string[]> {
+    if (!this.canAccessURL(symbolsURL) || !this.canAccessURL(rawModule.url)) {
+      return Promise.resolve([]);
+    }
     return this.endpoint.sendRequest(
                PrivateAPI.LanguageExtensionPluginCommands.AddRawModule, {rawModuleId, symbolsURL, rawModule}) as
         Promise<string[]>;

package/front_end/models/extensions/RecorderPluginManager.test.ts

@@ -20,7 +20,7 @@ describe('RecorderPluginManager', () => {
     manager.addPlugin(plugin);
     manager.removePlugin(plugin);
 
-    assert.deepStrictEqual(events, [
+    assert.deepEqual(events, [
       {
         event: 'pluginAdded',
         plugin,

package/front_end/models/extensions/extensions.ts

@@ -3,19 +3,23 @@
 // found in the LICENSE file.
 
 import * as ExtensionAPI from './ExtensionAPI.js';
+import * as ExtensionEndpoint from './ExtensionEndpoint.js';
 import * as ExtensionPanel from './ExtensionPanel.js';
 import * as ExtensionServer from './ExtensionServer.js';
 import * as ExtensionView from './ExtensionView.js';
 import * as HostUrlPattern from './HostUrlPattern.js';
+import * as LanguageExtensionEndpoint from './LanguageExtensionEndpoint.js';
 import * as RecorderExtensionEndpoint from './RecorderExtensionEndpoint.js';
 import * as RecorderPluginManager from './RecorderPluginManager.js';
 
 export {
   ExtensionAPI,
+  ExtensionEndpoint,
   ExtensionPanel,
   ExtensionServer,
   ExtensionView,
   HostUrlPattern,
+  LanguageExtensionEndpoint,
   RecorderExtensionEndpoint,
   RecorderPluginManager,
 };

package/front_end/models/formatter/FormatterWorkerPool.ts

@@ -3,7 +3,8 @@
 // found in the LICENSE file.
 
 import * as Common from '../../core/common/common.js';
-import * as FormatterActions from '../../entrypoints/formatter_worker/FormatterActions.js';  // eslint-disable-line rulesdir/es_modules_import
+import * as FormatterActions from '../../entrypoints/formatter_worker/FormatterActions.js';  // eslint-disable-line rulesdir/es-modules-import
+
 export {DefinitionKind, type ScopeTreeNode} from '../../entrypoints/formatter_worker/FormatterActions.js';
 
 const MAX_WORKERS = Math.max(2, navigator.hardwareConcurrency - 1);

package/front_end/models/har/Importer.test.ts

@@ -204,9 +204,9 @@ describe('HAR Importer', () => {
     assert.strictEqual(parsedRequest.requestId(), 'har-0');
     assert.strictEqual(parsedRequest.url(), 'https://example.com/api/testEndpoint?param1=test');
     assert.strictEqual(parsedRequest.documentURL, 'https://example.com/api/testEndpoint?param1=test');
-    assert.strictEqual(parsedRequest.frameId, null);
-    assert.strictEqual(parsedRequest.loaderId, null);
-    assert.deepStrictEqual(
+    assert.isNull(parsedRequest.frameId);
+    assert.isNull(parsedRequest.loaderId);
+    assert.deepEqual(
         parsedRequest.initiator() as HAR.HARFormat.HARInitiator,
         {
           type: Protocol.Network.InitiatorType.Script,
@@ -258,7 +258,7 @@ describe('HAR Importer', () => {
 
   it('Parses service worker info in entries', () => {
     const parsedRequest = requests[0];
-    assert.strictEqual(parsedRequest.fetchedViaServiceWorker, true);
+    assert.isTrue(parsedRequest.fetchedViaServiceWorker);
     assert.strictEqual(parsedRequest.getResponseCacheStorageCacheName(), 'v1');
     assert.strictEqual(parsedRequest.serviceWorkerResponseSource(), 'cache-storage');
   });

package/front_end/models/har/Log.test.ts

@@ -174,7 +174,7 @@ describe('HAR', () => {
 
           const entry = await build(request, {sanitize: false});
 
-          assert.strictEqual(entry.response._fetchedViaServiceWorker, true);
+          assert.isTrue(entry.response._fetchedViaServiceWorker);
           assert.strictEqual(entry.response._responseCacheStorageCacheName, cacheName);
           assert.strictEqual(
               entry.response._serviceWorkerResponseSource, Protocol.Network.ServiceWorkerResponseSource.CacheStorage);