PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Release 84.0.4147.95

Browse Source
This commit is contained in:
csagan5
2020-07-17 15:46:36 +02:00
parent 265ab75e24
commit 84a9001629
9 changed files with 182 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+4
View File
@@ -1,3 +1,7 @@
# 84.0.4147.95
* show warnings for TLSv1.0/TLSv1.1 connections (fixes https://github.com/bromite/bromite/issues/645)
* fix bug with unconfigured DoH (fixes https://github.com/bromite/bromite/issues/646)
# 84.0.4147.90
* added menu item to view source of current page
* fixed dialog for SSL/TLS errors (fixes https://github.com/bromite/bromite/issues/638)
README.md
+2
View File
@@ -42,6 +42,7 @@ ETH donations address: `0xf47ff39223d828f99fec5ab53bd068c5c0522042`
* use [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) on all architectures except x86
* disable media router and remoting by default
* disable dynamic module loading
* show warnings for TLSv1.0/TLSv1.1 pages
* enable site-per-process isolation for all devices with memory > 1GB
* completely remove safe browsing and other privacy-unfriendly features
* [proxy configuration page](https://github.com/bromite/bromite/wiki/ProxyConfiguration) with PAC and custom proxy lists support
@@ -82,6 +83,7 @@ New flags:
* `#ipv6-probing`
* `#disable-webgl`
* `#enable-device-motion` and `#enable-device-orientation`
* `#show-legacy-tls-warnings`
# Privacy limitations
build/RELEASE
+1 -1
View File
@@ -1 +1 @@
84.0.4147.90
84.0.4147.95
build/bromite_patches_list.txt
+2 -1
View File
@@ -125,7 +125,7 @@ Reduce-HTTP-headers-in-DoH-requests-to-bare-minimum.patch
Revert-flags-remove-disable-pull-to-refresh-effect.patch
Use-dummy-DFM-installer.patch
Disable-password-reuse-detection-on-android.patch
Allow-building-without-feed-support.patch
Disable-feeds-support-by-default.patch
Disable-autofill-assistant-by-default.patch
Show-site-settings-for-cookies-javascript-and-ads.patch
Restore-enable-horizontal-tab-switcher-flag.patch
@@ -141,4 +141,5 @@ Restore-GPU-bug-blacklist-for-AImageReader-on-ARM-CPUs.patch
Update-i18n-zh_CN-support.patch
Add-a-flag-to-allow-screenshots-in-Incognito-mode.patch
Add-menu-item-to-view-source.patch
Enable-legacy-TLS-interstitital-warning.patch
Automated-domain-substitution.patch
build/chromium_patches_list.txt
+1 -1
View File
@@ -3,4 +3,4 @@ AV1-codec-support.patch
Switch-to-fstack-protector-strong.patch
Enable-fwrapv-in-Clang-for-non-UBSan-builds.patch
Disable-password-reuse-detection-on-android.patch
Allow-building-without-feed-support.patch
Disable-feeds-support-by-default.patch
build/patches/Add-user-setting-for-DNS-over-HTTPS-DoH-custom-URL.patch
+13 -8
View File
@@ -12,12 +12,12 @@ Subject: Add user setting for DNS-over-HTTPS (DoH) custom URL
.../chrome/browser/settings/DoHEditor.java | 92 +++++++++++++++++++
.../browser/settings/DoHPreferences.java | 54 +++++++++++
chrome/app/generated_resources.grd | 6 ++
.../flags/android/cached_feature_flags.cc | 24 +++++
.../flags/android/cached_feature_flags.cc | 25 +++++
.../browser/flags/CachedFeatureFlags.java | 24 +++++
.../net/stub_resolver_config_reader.cc | 30 +-----
.../net/stub_resolver_config_reader.cc | 36 ++------
.../strings/android_chrome_strings.grd | 11 +++
chrome/common/chrome_features.cc | 4 +-
14 files changed, 317 insertions(+), 29 deletions(-)
14 files changed, 322 insertions(+), 31 deletions(-)
create mode 100644 chrome/android/java/res/layout/doh_editor.xml
create mode 100644 chrome/android/java/res/xml/doh_preferences.xml
create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/settings/DoHEditor.java
@@ -367,14 +367,15 @@ diff --git a/chrome/browser/flags/android/cached_feature_flags.cc b/chrome/brows
using base::android::ConvertJavaStringToUTF8;
using base::android::ConvertUTF8ToJavaString;
using base::android::JavaParamRef;
@@ -49,3 +53,23 @@ static jboolean JNI_CachedFeatureFlags_IsNetworkServiceWarmUpEnabled(
@@ -49,3 +53,24 @@ static jboolean JNI_CachedFeatureFlags_IsNetworkServiceWarmUpEnabled(
return content::IsOutOfProcessNetworkService() &&
base::FeatureList::IsEnabled(features::kWarmUpNetworkProcess);
}
+
+static jboolean JNI_CachedFeatureFlags_GetDoHEnabled(JNIEnv* env) {
+ std::string doh_mode = g_browser_process->local_state()->GetString(prefs::kDnsOverHttpsMode);
+ return ((doh_mode == "secure") || (doh_mode == "auto"));
+ return ((doh_mode == "secure") || (doh_mode == "auto"))
+ && !g_browser_process->local_state()->GetString(prefs::kDnsOverHttpsTemplates).empty();
+}
+
+static void JNI_CachedFeatureFlags_SetDoHEnabled(JNIEnv* env, jboolean enabled) {
@@ -464,7 +465,7 @@ diff --git a/chrome/browser/net/stub_resolver_config_reader.cc b/chrome/browser/
}
pref_change_registrar_.Add(prefs::kBuiltInDnsClientEnabled, pref_callback);
@@ -323,21 +301,19 @@ SecureDnsConfig StubResolverConfigReader::GetAndUpdateConfiguration(
@@ -323,21 +301,21 @@ SecureDnsConfig StubResolverConfigReader::GetAndUpdateConfiguration(
parental_controls_checked_ = true;
}
@@ -475,12 +476,16 @@ diff --git a/chrome/browser/net/stub_resolver_config_reader.cc b/chrome/browser/
std::string doh_templates =
local_state_->GetString(prefs::kDnsOverHttpsTemplates);
- std::string server_method;
+ if (doh_templates.empty()) {
+ secure_dns_mode = net::DnsConfig::SecureDnsMode::OFF;
+ }
+ LOG(INFO) << "DoH templates: '" << doh_templates << "' with mode " << SecureDnsConfig::ModeToString(secure_dns_mode);
std::vector<net::DnsOverHttpsServerConfig> dns_over_https_servers;
base::Optional<std::vector<network::mojom::DnsOverHttpsServerPtr>>
servers_mojo;
if (!doh_templates.empty() &&
secure_dns_mode != net::DnsConfig::SecureDnsMode::OFF) {
- if (!doh_templates.empty() &&
- secure_dns_mode != net::DnsConfig::SecureDnsMode::OFF) {
+ if (secure_dns_mode != net::DnsConfig::SecureDnsMode::OFF) {
+ std::string server_method;
for (base::StringPiece server_template :
chrome_browser_net::secure_dns::SplitGroup(doh_templates)) {
build/patches/Allow-building-without-feed-support.patch
-59
View File
@@ -1,59 +0,0 @@
From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Thu, 19 Dec 2019 22:52:53 +0100
Subject: Allow building without feed support
---
.../start_surface/StartSurfaceMediator.java | 18 ------------------
components/feed/feed_feature_list.cc | 2 +-
2 files changed, 1 insertion(+), 19 deletions(-)
diff --git a/chrome/android/features/start_surface/internal/java/src/org/chromium/chrome/features/start_surface/StartSurfaceMediator.java b/chrome/android/features/start_surface/internal/java/src/org/chromium/chrome/features/start_surface/StartSurfaceMediator.java
--- a/chrome/android/features/start_surface/internal/java/src/org/chromium/chrome/features/start_surface/StartSurfaceMediator.java
+++ b/chrome/android/features/start_surface/internal/java/src/org/chromium/chrome/features/start_surface/StartSurfaceMediator.java
@@ -486,16 +486,6 @@ class StartSurfaceMediator
assert (isShownState(shownState));
setOverviewState(shownState);
- // Make sure FeedSurfaceCoordinator is built before the explore surface is showing by
- // default.
- if (mPropertyModel.get(IS_EXPLORE_SURFACE_VISIBLE)
- && mPropertyModel.get(FEED_SURFACE_COORDINATOR) == null
- && !mActivityStateChecker.isFinishingOrDestroyed()
- && mFeedSurfaceCreator != null) {
- mPropertyModel.set(FEED_SURFACE_COORDINATOR,
- mFeedSurfaceCreator.createFeedSurfaceCoordinator(
- mNightModeStateProvider.isInNightMode()));
- }
mTabModelSelector.addObserver(mTabModelSelectorObserver);
if (mBrowserControlsObserver != null) {
@@ -615,14 +605,6 @@ class StartSurfaceMediator
private void setExploreSurfaceVisibility(boolean isVisible) {
if (isVisible == mPropertyModel.get(IS_EXPLORE_SURFACE_VISIBLE)) return;
- if (isVisible && mPropertyModel.get(IS_SHOWING_OVERVIEW)
- && mPropertyModel.get(FEED_SURFACE_COORDINATOR) == null
- && !mActivityStateChecker.isFinishingOrDestroyed()) {
- mPropertyModel.set(FEED_SURFACE_COORDINATOR,
- mFeedSurfaceCreator.createFeedSurfaceCoordinator(
- mNightModeStateProvider.isInNightMode()));
- }
-
mPropertyModel.set(IS_EXPLORE_SURFACE_VISIBLE, isVisible);
if (mOverviewModeState == OverviewModeState.SHOWN_TABSWITCHER_TWO_PANES) {
diff --git a/components/feed/feed_feature_list.cc b/components/feed/feed_feature_list.cc
--- a/components/feed/feed_feature_list.cc
+++ b/components/feed/feed_feature_list.cc
@@ -7,7 +7,7 @@
namespace feed {
const base::Feature kInterestFeedContentSuggestions{
- "InterestFeedContentSuggestions", base::FEATURE_ENABLED_BY_DEFAULT};
+ "InterestFeedContentSuggestions", base::FEATURE_DISABLED_BY_DEFAULT};
const base::FeatureParam<std::string> kDisableTriggerTypes{
&kInterestFeedContentSuggestions, "disable_trigger_types", ""};
--
2.17.1
build/patches/Disable-feeds-support-by-default.patch
+23
View File
@@ -0,0 +1,23 @@
From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Thu, 19 Dec 2019 22:52:53 +0100
Subject: Disable feeds support by default
---
components/feed/feed_feature_list.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/components/feed/feed_feature_list.cc b/components/feed/feed_feature_list.cc
--- a/components/feed/feed_feature_list.cc
+++ b/components/feed/feed_feature_list.cc
@@ -7,7 +7,7 @@
namespace feed {
const base::Feature kInterestFeedContentSuggestions{
- "InterestFeedContentSuggestions", base::FEATURE_ENABLED_BY_DEFAULT};
+ "InterestFeedContentSuggestions", base::FEATURE_DISABLED_BY_DEFAULT};
const base::FeatureParam<std::string> kDisableTriggerTypes{
&kInterestFeedContentSuggestions, "disable_trigger_types", ""};
--
2.17.1
build/patches/Enable-legacy-TLS-interstitital-warning.patch
+136
View File
@@ -0,0 +1,136 @@
From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Fri, 17 Jul 2020 09:28:36 +0200
Subject: Enable legacy TLS interstitital warning
Expose show-legacy-tls-warnings flag on Android as well
---
chrome/browser/about_flags.cc | 2 --
chrome/browser/ssl/tls_deprecation_config.cc | 22 +------------------
components/security_state/core/features.cc | 2 +-
net/base/features.cc | 2 +-
.../network/legacy_tls_config_distributor.cc | 21 +-----------------
services/network/ssl_config_service_mojo.cc | 7 ++----
6 files changed, 6 insertions(+), 50 deletions(-)
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -5269,11 +5269,9 @@ const FeatureEntry kFeatureEntries[] = {
FEATURE_VALUE_TYPE(features::kElasticOverscrollWin)},
#endif
-#if !defined(OS_ANDROID)
{"show-legacy-tls-warnings", flag_descriptions::kLegacyTLSWarningsName,
flag_descriptions::kLegacyTLSWarningsDescription, kOsDesktop,
FEATURE_VALUE_TYPE(security_state::features::kLegacyTLSWarnings)},
-#endif
#if defined(OS_CHROMEOS)
{"enable-assistant-aec", flag_descriptions::kEnableGoogleAssistantAecName,
diff --git a/chrome/browser/ssl/tls_deprecation_config.cc b/chrome/browser/ssl/tls_deprecation_config.cc
--- a/chrome/browser/ssl/tls_deprecation_config.cc
+++ b/chrome/browser/ssl/tls_deprecation_config.cc
@@ -58,27 +58,7 @@ void SetRemoteTLSDeprecationConfig(const std::string& binary_config) {
}
bool ShouldSuppressLegacyTLSWarning(const GURL& url) {
- if (!url.has_host() || !url.SchemeIsCryptographic())
- return false;
-
- auto* proto = TLSDeprecationConfigSingleton::GetInstance().GetProto();
- // If the config is not yet loaded, we err on the side of not showing warnings
- // for any sites.
- if (!proto)
- return true;
-
- // Convert bytes from crypto::SHA256 so we can compare to the proto contents.
- std::string host_hash_bytes = crypto::SHA256HashString(url.host_piece());
- std::string host_hash = base::ToLowerASCII(
- base::HexEncode(host_hash_bytes.c_str(), host_hash_bytes.size()));
- const auto& control_site_hashes = proto->control_site_hashes();
-
- // Perform binary search on the sorted list of control site hashes to check
- // if the input URL's hostname is included.
- auto lower = std::lower_bound(control_site_hashes.begin(),
- control_site_hashes.end(), host_hash);
-
- return lower != control_site_hashes.end() && *lower == host_hash;
+ return false;
}
void ResetTLSDeprecationConfigForTesting() {
diff --git a/components/security_state/core/features.cc b/components/security_state/core/features.cc
--- a/components/security_state/core/features.cc
+++ b/components/security_state/core/features.cc
@@ -16,7 +16,7 @@ const char kMarkHttpAsParameterWarningAndDangerousOnFormEdits[] =
const char kMarkHttpAsParameterDangerWarning[] = "danger-warning";
const base::Feature kLegacyTLSWarnings{"LegacyTLSWarnings",
- base::FEATURE_DISABLED_BY_DEFAULT};
+ base::FEATURE_ENABLED_BY_DEFAULT};
const base::Feature kSafetyTipUI{"SafetyTip",
base::FEATURE_DISABLED_BY_DEFAULT};
diff --git a/net/base/features.cc b/net/base/features.cc
--- a/net/base/features.cc
+++ b/net/base/features.cc
@@ -120,7 +120,7 @@ const base::Feature kTurnOffStreamingMediaCaching{
"TurnOffStreamingMediaCaching", base::FEATURE_DISABLED_BY_DEFAULT};
const base::Feature kLegacyTLSEnforced{"LegacyTLSEnforced",
- base::FEATURE_DISABLED_BY_DEFAULT};
+ base::FEATURE_ENABLED_BY_DEFAULT};
const base::Feature kSchemefulSameSite{"SchemefulSameSite",
base::FEATURE_DISABLED_BY_DEFAULT};
diff --git a/services/network/legacy_tls_config_distributor.cc b/services/network/legacy_tls_config_distributor.cc
--- a/services/network/legacy_tls_config_distributor.cc
+++ b/services/network/legacy_tls_config_distributor.cc
@@ -51,26 +51,7 @@ scoped_refptr<LegacyTLSExperimentConfig> LegacyTLSExperimentConfig::Parse(
bool LegacyTLSExperimentConfig::ShouldSuppressLegacyTLSWarning(
const std::string& hostname) const {
- // Match on eTLD+1 rather than full hostname (to account for subdomains and
- // redirects). If no registrable domain is found, default to using the
- // hostname as-is.
- auto domain = net::registry_controlled_domains::GetDomainAndRegistry(
- hostname, net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
- if (domain.empty())
- domain = hostname;
-
- // Convert bytes from crypto::SHA256 so we can compare to the proto contents.
- std::string host_hash_bytes = crypto::SHA256HashString(domain);
- std::string host_hash = base::ToLowerASCII(
- base::HexEncode(host_hash_bytes.data(), host_hash_bytes.size()));
- const auto& control_site_hashes = proto_.control_site_hashes();
-
- // Perform binary search on the sorted list of control site hashes to check
- // if the input URL's hostname is included.
- auto lower = std::lower_bound(control_site_hashes.begin(),
- control_site_hashes.end(), host_hash);
-
- return lower != control_site_hashes.end() && *lower == host_hash;
+ return false;
}
LegacyTLSConfigDistributor::LegacyTLSConfigDistributor() = default;
diff --git a/services/network/ssl_config_service_mojo.cc b/services/network/ssl_config_service_mojo.cc
--- a/services/network/ssl_config_service_mojo.cc
+++ b/services/network/ssl_config_service_mojo.cc
@@ -120,11 +120,8 @@ bool SSLConfigServiceMojo::CanShareConnectionWithClientCerts(
bool SSLConfigServiceMojo::ShouldSuppressLegacyTLSWarning(
const std::string& hostname) const {
- // If the config is not yet loaded, we err on the side of not showing warnings
- // for any sites.
- if (!legacy_tls_config_)
- return true;
- return legacy_tls_config_->ShouldSuppressLegacyTLSWarning(hostname);
+ // never suppress any warning
+ return false;
}
void SSLConfigServiceMojo::OnNewCRLSet(scoped_refptr<net::CRLSet> crl_set) {
--
2.17.1