news
GNOME: Javad Rahmatzadeh on Mindless Slop and Michael Catanzaro on Security Problem
-
GNOME ☛ Javad Rahmatzadeh: Hey Hi (AI) and GNOME Shell Extensions
Since I joined the extensions team, I’ve only had one goal in mind. Making the extension developers’ job easier by providing them documentation and help.
I started with the port guide and then I became involved in the reviews by providing developers code samples, mentioning best practices, even fixing the issue myself and sending them merge requests. Andy Holmes and I spent a lot of time writing all the necessary documentation for the extension developers. We even made the review guidelines very strict and easy to understand with code samples.
-
GNOME ☛ Michael Catanzaro: Significant Drag and Drop Vulnerability in WebKitGTK
WebKitGTK and WPE WebKit 2.50.3 contain a workaround for CVE-2025-13947, an issue that allows websites to exfiltrate files from your filesystem. If you’re using Epiphany or any other web browser based on WebKitGTK or WPE WebKit, then you should immediately update to 2.50.3.
Websites may attach file URLs to drag sources. When the drag source is dropped onto a drop target, the website can read the file data for its chosen files, without any restrictions. Oops. Suffice to say, this is not how drag and drop is supposed to work. Websites should not be able to choose for themselves which files to read from your filesystem; only the user is supposed to be able to make that choice, by dragging the file from an external application. That is, drag sources created by websites should not receive file access.