Guest and Embedder Process Segmentation for Untrusted Content
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Applications loading untrusted content from external sources, such as web servers, may become non-responsive or crash due to security failures or bugs, leading to potential data loss and user inconvenience.
Innovation Solution
Implementing a system with a guest process and an embedder process that communicate asynchronously to handle untrusted content, where the guest process adjusts images to fit within size constraints specified by the embedder process, and the embedder process recovers the guest process state in case of execution failures, preventing application crashes and non-responsiveness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the application loads untrusted content from external sources, then the functionality and content variety are improved, but the reliability and stability deteriorate due to security failures or bugs
Solution Approach 1:
The application is divided into multiple independent processes: an embedder process that loads untrusted content and guest processes that execute the content. This segmentation isolates failures to individual guest processes, preventing them from crashing the entire application. The embedder process can continue to load and manage other content even when a guest process fails.
Solution Approach 2:
A content process is introduced as an intermediary layer between the embedder process and the untrusted content. This intermediary validates and manages the execution of untrusted content, providing a safety buffer that prevents direct propagation of errors or security issues to the main application process.
2Adaptability or versatility
If the guest process executes untrusted content without constraints, then the content presentation flexibility is improved, but the security and control deteriorate
Solution Approach 1:
Different processes are assigned different security contexts and permissions. The embedder process operates with full permissions to load content, while guest processes execute with restricted permissions suitable for their specific content type. This local differentiation of security properties allows flexible content presentation while maintaining appropriate security controls for each content context.
Solution Approach 2:
The system dynamically adjusts execution parameters such as memory allocation limits, CPU time quotas, and resource access permissions for each guest process based on the trust level and type of content being executed. This parameter-based control enables flexible content presentation while preventing any single untrusted content from consuming excessive resources or accessing protected system functions.
3Reliability
If the application recovers from guest process failures, then the reliability is improved, but the complexity of error handling increases
Solution Approach 1:
The embedder process automatically detects when a guest process has failed and autonomously initiates recovery actions, such as loading a replacement guest process or adjusting content presentation. This self-service error handling eliminates the need for complex manual intervention or centralized error management systems, as each process manages its own failures independently.
Solution Approach 2:
The system pre-configures fallback mechanisms and alternative content sources before failures occur. When a guest process fails, the embedder process can immediately activate pre-prepared recovery procedures, such as loading backup content or switching to alternative rendering modes, without requiring complex real-time decision-making or error analysis.
Data Source
AI summary
Systems and methods for presenting information associated with an application are disclosed. An application is executed at a computing device, wherein the application presents a visual output at a display unit of the computing device. A guest process is run within the application. The guest process stores and processes untrusted content. An embedder process is run within the application and in parallel with the guest process. The embedder process stores and processes trusted content. The application receives, via the guest process, a request to present an image associated with the untrusted content. The embedder process specifies size constraints for the image. The guest process adjusts the image to fit within the size constraints specified via the embedder process.