From d3765627a19edbd621e109bfb2617085a746e170 Mon Sep 17 00:00:00 2001 From: Carmelo Messina Date: Wed, 27 Mar 2024 16:43:45 +0100 Subject: [PATCH] #207 Allow worklet in blink and disallow fetch later manager and speculation rules --- build/patches/Internal-firewall.patch | 187 ++++++++++++++++---------- 1 file changed, 118 insertions(+), 69 deletions(-) diff --git a/build/patches/Internal-firewall.patch b/build/patches/Internal-firewall.patch index 3b94ebac..24dd4df3 100644 --- a/build/patches/Internal-firewall.patch +++ b/build/patches/Internal-firewall.patch @@ -20,26 +20,26 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html net/url_request/url_request_http_job.cc | 15 + net/url_request/url_request_http_job.h | 3 + services/firewall/public/BUILD.gn | 70 +++ - services/firewall/public/firewall_features.cc | 28 ++ + services/firewall/public/firewall_features.cc | 28 + services/firewall/public/firewall_features.h | 31 ++ services/firewall/public/firewall_service.cc | 46 ++ - services/firewall/public/firewall_service.h | 57 +++ + services/firewall/public/firewall_service.h | 57 ++ services/firewall/tools/annotation_model.py | 49 ++ - services/firewall/tools/annotations.xml | 466 ++++++++++++++++++ + services/firewall/tools/annotations.xml | 489 ++++++++++++++++++ services/firewall/tools/builders_template.py | 72 +++ services/firewall/tools/codegen.py | 82 +++ - services/firewall/tools/decode_template.py | 85 ++++ + services/firewall/tools/decode_template.py | 85 +++ services/firewall/tools/gen_builders.py | 65 +++ - services/firewall/tools/rules.xml | 87 ++++ + services/firewall/tools/rules.xml | 92 ++++ services/firewall/tools/rules_model.py | 35 ++ services/network/network_context.cc | 73 +++ .../network/public/cpp/simple_url_loader.cc | 18 + .../network/public/cpp/simple_url_loader.h | 3 + - .../platform/loader/fetch/fetch_utils.cc | 195 +++++++- + .../platform/loader/fetch/fetch_utils.cc | 216 +++++++- .../loader/fetch/url_loader/url_loader.cc | 4 +- .../scripts/auditor/auditor.py | 1 + .../scripts/auditor/util.py | 1 + - 30 files changed, 1575 insertions(+), 22 deletions(-) + 30 files changed, 1624 insertions(+), 22 deletions(-) create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Internal-firewall.inc create mode 100644 services/firewall/public/BUILD.gn create mode 100644 services/firewall/public/firewall_features.cc @@ -628,7 +628,7 @@ diff --git a/services/firewall/tools/annotations.xml b/services/firewall/tools/a new file mode 100644 --- /dev/null +++ b/services/firewall/tools/annotations.xml -@@ -0,0 +1,466 @@ +@@ -0,0 +1,489 @@ + + + + + + -+ ++ + + + @@ -663,8 +664,8 @@ new file mode 100644 + + + -+ -+ ++ ++ + + + @@ -679,7 +680,6 @@ new file mode 100644 + + + -+ + + + @@ -688,7 +688,7 @@ new file mode 100644 + + + -+ ++ + + + @@ -696,9 +696,9 @@ new file mode 100644 + + + -+ ++ + -+ ++ + + + @@ -709,7 +709,6 @@ new file mode 100644 + + + -+ + + + @@ -719,7 +718,7 @@ new file mode 100644 + + + -+ ++ + + + @@ -763,13 +762,12 @@ new file mode 100644 + + + -+ + + + + -+ -+ ++ ++ + + + @@ -798,16 +796,14 @@ new file mode 100644 + + + -+ ++ + -+ -+ + + + + + -+ ++ + + + @@ -840,7 +836,7 @@ new file mode 100644 + + + -+ ++ + + + @@ -926,7 +922,7 @@ new file mode 100644 + + + -+ ++ + + diff --git a/services/firewall/tools/builders_template.py b/services/firewall/tools/builders_template.py new file mode 100644 @@ -1423,7 +1446,7 @@ diff --git a/services/firewall/tools/rules.xml b/services/firewall/tools/rules.x new file mode 100644 --- /dev/null +++ b/services/firewall/tools/rules.xml -@@ -0,0 +1,87 @@ +@@ -0,0 +1,92 @@ + + + + ++ ++ ++ + + + -+ + ++ ++ ++ + + + @@ -1734,7 +1762,7 @@ diff --git a/services/network/public/cpp/simple_url_loader.h b/services/network/ diff --git a/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc b/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc --- a/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc +++ b/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc -@@ -97,31 +97,200 @@ net::NetworkTrafficAnnotationTag FetchUtils::GetTrafficAnnotationTag( +@@ -97,31 +97,221 @@ net::NetworkTrafficAnnotationTag FetchUtils::GetTrafficAnnotationTag( case network::mojom::RequestDestination::kIframe: case network::mojom::RequestDestination::kFrame: case network::mojom::RequestDestination::kFencedframe: @@ -1877,12 +1905,33 @@ diff --git a/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc b/t + "Not implemented. Without these requests, Chrome will be unable " + "to load any webpage." + })"); ++ ++ case network::mojom::RequestDestination::kSpeculationRules: ++ return net::DefineNetworkTrafficAnnotation("blink_resource_speculation_rules", R"( ++ semantics { ++ sender: "Blink Resource Loader" ++ description: ++ "Blink-initiated request, which includes all resources for " ++ "normal page loads, chrome URLs, and downloads." ++ trigger: ++ "The user navigates to a URL or downloads a file. Also when a " ++ "webpage, ServiceWorker, or chrome:// uses any network communication." ++ data: "Anything the initiator wants to send." ++ destination: OTHER ++ } ++ policy { ++ cookies_allowed: YES ++ cookies_store: "user" ++ setting: "These requests cannot be disabled in settings." ++ policy_exception_justification: ++ "Not implemented. Without these requests, Chrome will be unable " ++ "to load any webpage." ++ })"); + case network::mojom::RequestDestination::kEmpty: case network::mojom::RequestDestination::kAudio: - case network::mojom::RequestDestination::kAudioWorklet: case network::mojom::RequestDestination::kFont: -+ case network::mojom::RequestDestination::kSpeculationRules: case network::mojom::RequestDestination::kImage: - case network::mojom::RequestDestination::kJson: - case network::mojom::RequestDestination::kManifest: @@ -1947,7 +1996,7 @@ diff --git a/third_party/blink/renderer/platform/loader/fetch/fetch_utils.cc b/t semantics { sender: "Blink Resource Loader" description: -@@ -145,7 +314,7 @@ net::NetworkTrafficAnnotationTag FetchUtils::GetTrafficAnnotationTag( +@@ -145,7 +335,7 @@ net::NetworkTrafficAnnotationTag FetchUtils::GetTrafficAnnotationTag( case network::mojom::RequestDestination::kEmbed: case network::mojom::RequestDestination::kObject: return net::DefineNetworkTrafficAnnotation(