fix(launcher): disable component extensions

[aslushnikov]

Chrome has a set of component extensions - e.g. CryptoTokenExtension
that helps with 2FA.

These extensions are loaded regardless of the --disable-extensions
flag we already pass. To disable these extensions, we need to pass additional
--disable-component-extensions-with-background-pages flag.

Fix #4300

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here (e.g. I signed it!) and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[aslushnikov]

I signed it!

[googlebot]

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

[JoelEinbinder]

Why?

[aslushnikov]

@JoelEinbinder context: #3694 (comment)

Long story short: these extensions add background pages, so it becomes impossible to wait for the background page of my extension.

[JoelEinbinder]

Presumably these extensions do something. Disabling them because it makes our API easier to use sounds to me like you are "fixing" this problem at the wrong layer.

[aslushnikov]

Presumably these extensions do something.

@JoelEinbinder They don't do anything important from the WebPlatform point of view. They do provide some enhanced UserAgent experience, but we already compromise it in many ways in favor of a pleasant automation, e.g. disabling keychains, phishing protection, translation e.t.c.

[JoelEinbinder]

Let's add a test

[aslushnikov]

Let's add a test

@JoelEinbinder I don't know any reliable way to check that this extension doesn't load; any suggestion?

[JoelEinbinder]

Have a test with our own extension. Verify that there are no other extensions once that one loads?

…

On Sun, Jul 14, 2019 at 5:26 PM Andrey Lushnikov ***@***.***> wrote: Let's add a test @JoelEinbinder <https://github.com/JoelEinbinder> I don't know any reliable way to check that this extension doesn't load; any suggestion? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4704>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABDI62KI2ZGDHYWOHWNKKNLP7O73VANCNFSM4IDSF2LQ> .

[aslushnikov]

Have a test with our own extension. Verify that there are no other
extensions once that one loads?

This won't work reliably - the order of background page loading is not guaranteed. There's no event I'm aware of that we can subscribe to that happens when all extension background pages are loaded.

[JoelEinbinder]

Have a test with our own extension. Verify that there are no other
extensions once that one loads?

This won't work reliably - the order of background page loading is not guaranteed. There's no event I'm aware of that we can subscribe to that happens when all extension background pages are loaded.

I'm fine with a test that succeeds reliably but might give false positives if it starts failing.

We are implicitly telling users to rely on the fact that no extensions will be in the browser besides the ones they added. Having a test codifies this as the intended behavior.