From: Joachim Bauch <jojo@struktur.de>
Date: Wed, 22 Jul 2015 12:24:15 +0200
Subject: safe_browsing: disable cookie transmission

Disables sending/setting cookies for Safebrowsing requests. This
prevents the long-living tracking cookie from being set.

References: https://github.com/iridium-browser/iridium-browser/issues/37
---
 chrome/browser/safe_browsing/client_side_detection_service.cc         | 4 ++--
 .../download_protection/check_client_download_request.cc              | 2 +-
 .../safe_browsing/download_protection/ppapi_download_request.cc       | 2 +-
 components/safe_browsing/browser/threat_details_cache.cc              | 1 +
 components/safe_browsing/db/v4_update_protocol_manager.cc             | 4 ++--
 5 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/chrome/browser/safe_browsing/client_side_detection_service.cc b/chrome/browser/safe_browsing/client_side_detection_service.cc
--- a/chrome/browser/safe_browsing/client_side_detection_service.cc
+++ b/chrome/browser/safe_browsing/client_side_detection_service.cc
@@ -359,7 +359,7 @@ void ClientSideDetectionService::StartClientReportPhishingRequest(
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = GetClientReportUrl(kClientReportPhishingUrl);
   resource_request->method = "POST";
-  resource_request->load_flags = net::LOAD_DISABLE_CACHE;
+  resource_request->load_flags = net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES;
   auto loader = network::SimpleURLLoader::Create(std::move(resource_request),
                                                  traffic_annotation);
   loader->AttachStringForUpload(request_data, "application/octet-stream");
@@ -441,7 +441,7 @@ void ClientSideDetectionService::StartClientReportMalwareRequest(
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = GetClientReportUrl(kClientReportMalwareUrl);
   resource_request->method = "POST";
-  resource_request->load_flags = net::LOAD_DISABLE_CACHE;
+  resource_request->load_flags = net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES;
   auto loader = network::SimpleURLLoader::Create(std::move(resource_request),
                                                  traffic_annotation);
   loader->AttachStringForUpload(request_data, "application/octet-stream");
diff --git a/chrome/browser/safe_browsing/download_protection/check_client_download_request.cc b/chrome/browser/safe_browsing/download_protection/check_client_download_request.cc
--- a/chrome/browser/safe_browsing/download_protection/check_client_download_request.cc
+++ b/chrome/browser/safe_browsing/download_protection/check_client_download_request.cc
@@ -772,7 +772,7 @@ void CheckClientDownloadRequest::SendRequest() {
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = PPAPIDownloadRequest::GetDownloadRequestUrl();
   resource_request->method = "POST";
-  resource_request->load_flags = net::LOAD_DISABLE_CACHE;
+  resource_request->load_flags = net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES;
   loader_ = network::SimpleURLLoader::Create(std::move(resource_request),
                                              traffic_annotation);
   loader_->AttachStringForUpload(client_download_request_data_,
diff --git a/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc b/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc
--- a/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc
+++ b/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc
@@ -251,7 +251,7 @@ void PPAPIDownloadRequest::SendRequest() {
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = GetDownloadRequestUrl();
   resource_request->method = "POST";
-  resource_request->load_flags = net::LOAD_DISABLE_CACHE;
+  resource_request->load_flags = net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES;
   loader_ = network::SimpleURLLoader::Create(std::move(resource_request),
                                              traffic_annotation);
   loader_->AttachStringForUpload(client_download_request_data_,
diff --git a/components/safe_browsing/browser/threat_details_cache.cc b/components/safe_browsing/browser/threat_details_cache.cc
--- a/components/safe_browsing/browser/threat_details_cache.cc
+++ b/components/safe_browsing/browser/threat_details_cache.cc
@@ -115,6 +115,7 @@ void ThreatDetailsCacheCollector::OpenEntry() {
   // Only from cache, and don't save cookies.
   resource_request->load_flags = net::LOAD_ONLY_FROM_CACHE |
                                  net::LOAD_SKIP_CACHE_VALIDATION |
+                                 net::LOAD_DO_NOT_SEND_COOKIES |
                                  net::LOAD_DO_NOT_SAVE_COOKIES;
   current_load_ = network::SimpleURLLoader::Create(std::move(resource_request),
                                                    traffic_annotation);
diff --git a/components/safe_browsing/db/v4_update_protocol_manager.cc b/components/safe_browsing/db/v4_update_protocol_manager.cc
--- a/components/safe_browsing/db/v4_update_protocol_manager.cc
+++ b/components/safe_browsing/db/v4_update_protocol_manager.cc
@@ -344,8 +344,8 @@ void V4UpdateProtocolManager::IssueUpdateRequest() {
   std::string req_base64 = GetBase64SerializedUpdateRequestProto();
   GetUpdateUrlAndHeaders(req_base64, &resource_request->url,
                          &resource_request->headers);
-  resource_request->load_flags = net::LOAD_DISABLE_CACHE;
-  std::unique_ptr<network::SimpleURLLoader> loader =
+  resource_request->load_flags = net::LOAD_DISABLE_CACHE | net::LOAD_DO_NOT_SAVE_COOKIES | net::LOAD_DO_NOT_SEND_COOKIES;
+ std::unique_ptr<network::SimpleURLLoader> loader =
       network::SimpleURLLoader::Create(std::move(resource_request),
                                        traffic_annotation);
   loader->DownloadToStringOfUnboundedSizeUntilCrashAndDie(
-- 
2.11.0

