Make sure that extensions are bundled with the package they claim to be. by johnpryan · Pull Request #9981 · flutter/devtools

johnpryan · 2026-08-26T21:40:32Z

With this change, extensions are enabled if and only if the package name on disk matches the package name in extension/devtools/config.yaml.

This supersedes #9965

With this change, extensions are enabled if and only if the package name on disk matches the package name in extension/devtools/config.yaml.

gemini-code-assist

Code Review

This pull request improves DevTools extension isolation by tracking the providing package name for enablement, deduplication, and asset loading, and adds validation checks for extension names. The review feedback highlights a compilation error in _extensions_api.dart due to invalid map literal syntax, a potential runtime TypeError in _validate.dart when casting the configuration name, and a suggestion to normalize packageRoot in extension_manager.dart for more robust path comparisons.

kenzieschmoll · 2026-08-31T22:36:34Z

      return DevToolsExtensionConfig._(
        // These values are required fields in the extension's config.yaml file.
        name: name,
+        packageName: packageName,


the comment above name is intended for all keys until the next comment on line 82, so package should not go here unless we are expecting users to manually enter this in the extension config.yaml file.

kenzieschmoll · 2026-08-31T22:46:08Z

+
+      // Spoofed package does not inherit provider's enablement
+      expect(
+        options.lookupExtensionEnabledState(


is this going to be backwards compatible for existing devtools_options.yaml entries from before this change?

Yes, for most packages (like patrol or provider), the packageName field (from .dart_tool/package_config.json') matches the name` field (the package name the extension is declared to before in config.yaml).

If they don't match, then users will need to re-enable the extension after this change lands, because DevToolsExtensionConfig.identifier will be put in devtools_options.yaml file instead.

kenzieschmoll · 2026-08-31T22:52:23Z

    throw FileSystemException('${packageDirectory.path} directory not found');
  }

+  final pubspecFile = File(path.join(packageDirectory.path, 'pubspec.yaml'));


the additional validations added to this file seem useful, but they also seem out of scope of this PR. Are these somehow related to resolving the security bug?

I think AGY added this because extensions need to be included in a Dart package, right?

kenzieschmoll · 2026-08-31T22:53:47Z

        codePoint = codePointFromJson as int;
      }

+      final packageName = json[packageNameKey] as String? ?? name;


where is the packageName getting set in the json? Maybe I'm missing it in this PR.

In extension_manager.dart L191, the ExtensionsManager class puts this key into DevToolsExtensionConfig manually when detecting the available extensions.

Similar comment to above, but when would we expect this to be null. Is this for backwards compatibility?

kenzieschmoll · 2026-08-31T22:54:12Z

+  /// This value is parsed from the package name in
+  /// `.dart_tool/package_config.json`.
+  final String packageName;


related to my last comment. Where is this parsing code?

My understanding is that this is parsed from the package_config.json file in the extension_discovery package, and then ExtensionsManager puts this value into DevToolsExtensionConfig.

…tric-extensions

johnpryan · 2026-09-10T22:34:53Z

@kenzieschmoll this is ready for another look

kenzieschmoll · 2026-09-11T22:37:11Z

        ExtensionsApi.extensionNamePropertyName: extensionName,
-        if (enable != null)
-          ExtensionsApi.enabledStatePropertyName: enable.toString(),
+        ExtensionsApi.extensionPackagePropertyName: ?extensionPackage,


when would we ever expect this to be null?

kenzieschmoll · 2026-09-11T22:37:23Z

  [#8507](https://github.com/flutter/devtools/issues/8507)
+* Improved DevTools extension isolation by tracking the providing package name for
+  enablement, deduplication, and asset loading.
+  [#9965](https://github.com/flutter/devtools/pull/9965)


incorrect pr link

kenzieschmoll · 2026-09-11T22:41:08Z

 ## 0.5.2-wip
 * The minimum Dart SDK version is bumped to 3.11.0.
 * The minimum Flutter SDK version is bumped to 3.41.0.
+* Updates `devtools_shared` constraint to `^14.0.1`.


also include the change that was made to the validate tool

kenzieschmoll · 2026-09-11T22:42:17Z

+  /// Sets the enabled state for [extensionName] (and optionally [packageName])
+  /// in the 'devtools_options.yaml' file at [devtoolsOptionsUri].


this should actually be "Sets the enabled state of [packageName] (falls back to [extensionName]) in the ..."

kenzieschmoll · 2026-09-11T22:42:26Z

+  /// Returns the current enabled state for [extensionName] (and optionally
+  /// [packageName]) in the 'devtools_options.yaml' file at [devtoolsOptionsUri].


same comment here

kenzieschmoll · 2026-09-11T22:50:12Z

    final missingKeys = <String>[];
    for (final key in _serverGeneratedKeys) {
+      if (key == packageNameKey) {
+        continue; // Optional for backwards compatibility.


When do we need this? Since this is a generated key, a user who is using this version of the DevTools server with the changes in this PR should always have this key. I believe we only would need backwards compatibility for the keys we expect an extension author to provide in the extension's config.yaml file

kenzieschmoll · 2026-09-11T22:51:35Z

+
+      final configWithDistinctPackage = DevToolsExtensionConfig.parse({
+        'name': 'provider',
+        'packageName': 'provider_devtools_extension',


nit: I don't think this is reflective of the package provider extension. it is shipped with the provider package, not provider_devtools_extension where it is developed

kenzieschmoll · 2026-09-11T22:52:28Z

 class TestPackageWithExtension {
  TestPackageWithExtension({
    required this.name,
+    String? packageName,


let's make this non-nullable since we expect all extensions to have a package name

Make sure that extensions are bundled with the package they claim to be.

1c9d477

With this change, extensions are enabled if and only if the package name on disk matches the package name in extension/devtools/config.yaml.

johnpryan requested review from a team, bkonyi and kenzieschmoll as code owners August 26, 2026 21:40

johnpryan requested review from srawlins and removed request for a team August 26, 2026 21:40

johnpryan mentioned this pull request Aug 26, 2026

Add validation that the extension name matches the package name #9965

Closed

gemini-code-assist Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread packages/devtools_app/lib/src/shared/server/_extensions_api.dart

Comment thread packages/devtools_extensions/bin/_validate.dart Outdated

Comment thread packages/devtools_shared/lib/src/extensions/extension_manager.dart Outdated

kenzieschmoll reviewed Aug 31, 2026

View reviewed changes

Comment thread packages/devtools_app/lib/src/extensions/extension_service_helpers.dart Outdated

kenzieschmoll reviewed Aug 31, 2026

View reviewed changes

Comment thread packages/devtools_shared/CHANGELOG.md

kenzieschmoll reviewed Aug 31, 2026

View reviewed changes

Comment thread packages/devtools_shared/lib/src/extensions/extension_enablement.dart

kenzieschmoll reviewed Aug 31, 2026

View reviewed changes

johnpryan added 7 commits September 1, 2026 09:12

Merge branch 'master' of github.com:flutter/devtools into package-cen…

569f427

…tric-extensions

Check string type in if expression

29e8ec7

Normalize package root

b00b953

Fix typo

68e69d5

Revert missing line in CHANGELOG.md

ae1ee0a

Fix presubmits

e14a0c1

Use the package name to verify extension permissions and deduplication

3008fe4

kenzieschmoll reviewed Sep 11, 2026

View reviewed changes

		/// Sets the enabled state for [extensionName] (and optionally [packageName])
		/// in the 'devtools_options.yaml' file at [devtoolsOptionsUri].

		/// Returns the current enabled state for [extensionName] (and optionally
		/// [packageName]) in the 'devtools_options.yaml' file at [devtoolsOptionsUri].

Uh oh!

Conversation

johnpryan commented Aug 26, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnpryan Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

johnpryan commented Sep 10, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

johnpryan Sep 1, 2026 •

edited

Loading