CODEWITHSUNDEEP
google-chrome-extensionwebassembly
M4hd1
M4hd1

Reputation: 133

How to Handle a Dependency Using a WASM Executable Considered as Obfuscated Code in a Chrome Extension Review?

I am developing a Chrome extension that uses WebAssembly (WASM) files as part of the Shiki syntax highlighting library. These files are essential for providing accurate and performant syntax highlighting capabilities within the extension. This library is actually used by a dependency. However, during the review process, Google has flagged the WASM files as obfuscated code, which is causing my extension to be rejected. At this point I don't know what to do as rewriting the would be quite challenging (dependency of dependency).

Overview

This Chrome extension uses WebAssembly (WASM) files as part of the Shiki syntax highlighting library. These files are essential for providing accurate and performant syntax highlighting capabilities within the extension.

What is Shiki?

Shiki is a syntax highlighting library that provides TextMate grammar-powered syntax highlighting. It's used to create VS Code-like syntax highlighting and is known for its accuracy and performance.

Why WASM?

The wasm2.js file present in our extension is a compiled WebAssembly module that:

  1. Handles complex text parsing operations
  2. Processes TextMate grammars for syntax highlighting
  3. Enables high-performance code highlighting without compromising accuracy

What we have tried

We have implemented the following measures to ensure security and transparency:

  1. Source Maps Enabled: We maintain source maps in our build for complete transparency and debuggability of the WASM code.
  2. Direct Integration: The WASM file is bundled directly with our extension rather than being loaded from external sources.
  3. Open Source Components: Shiki is an open-source library maintained by the VS Code team.
  4. Add Documentation: along with the extension code to explain the presence of this wasm file

The WASM module can be verified by:

  1. Checking Shiki's source code at: https://github.com/shikijs/shiki
  2. Inspecting the source maps included with our build
  3. Monitoring the extension's network activity (no external WASM loading occurs)

Technical Details

References

Question

Given the above context, how can I address Google's concerns about the WASM files being considered obfuscated code? Are there any best practices or additional steps I can take to ensure my extension passes the review process? I am not so familiar with WASM, and I don't have any lead to really solve this issue

Any help or guidance would be greatly appreciated!

Upvotes: 0

Views: 10

Answers (0)

Related Questions