PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Add flag to disable external intent requests: enable "tel:" schema (#1489)

Browse Source 
merge "Revert Delete block-external-form-redirects" patch
This commit is contained in:
Carmelo Messina
2024-10-03 12:27:40 +02:00
parent 3aa032d863
commit efa7983219
3 changed files with 125 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build/cromite_patches_list.txt
-1
View File
@@ -117,7 +117,6 @@ User-agent-customization.patch
Add-AllowUserCertificates-flag.patch
Add-IsCleartextPermitted-flag.patch
Add-flag-for-omnibox-autocomplete-filtering.patch
Revert-Delete-block-external-form-redirects.patch
Add-flag-to-disable-external-intent-requests.patch
Enable-share-intent.patch
Logcat-crash-reports-UI.patch
build/patches/Add-flag-to-disable-external-intent-requests.patch
+125 -5
View File
@@ -3,20 +3,29 @@ Date: Tue, 25 May 2021 19:46:14 +0200
Subject: Add flag to disable external intent requests
Adds a new flag that allows to control the switch with same name;
when flag is disabled no external intent will ever be allowed, for any URL.
when flag is disabled no external intent will ever be allowed,
for any URL except for the tel: schema.
This also reverts commit b710cefb53b558a8bcd884f6baf0229ba4225721 and
enables IntentBlockExternalFormRedirectsNoGesture.
License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
---
.../java/res/xml/privacy_preferences.xml | 7 +++-
.../ExternalNavigationDelegateImpl.java | 3 +-
.../ExternalNavigationDelegateImpl.java | 4 ++-
.../cromite/sAllowExternalIntentRequests.java | 33 +++++++++++++++++++
...g-to-disable-external-intent-requests.grdp | 9 +++++
.../android/external_intents_features.cc | 7 +++-
.../android/external_intents_features.h | 1 +
.../ExternalIntentsFeatures.java | 6 ++++
.../ExternalNavigationHandler.java | 21 ++++++++++++
...ag-to-disable-external-intent-requests.inc | 13 ++++++++
...t-Delete-block-external-form-redirects.inc | 15 +++++++++
...ag-to-disable-external-intent-requests.inc | 3 ++
6 files changed, 66 insertions(+), 2 deletions(-)
11 files changed, 116 insertions(+), 3 deletions(-)
create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sAllowExternalIntentRequests.java
create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-flag-to-disable-external-intent-requests.grdp
create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-flag-to-disable-external-intent-requests.inc
create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc
create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-flag-to-disable-external-intent-requests.inc
diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
@@ -47,11 +56,12 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/Ext
import org.chromium.chrome.browser.IntentHandler;
import org.chromium.chrome.browser.tab.EmptyTabObserver;
import org.chromium.chrome.browser.tab.Tab;
@@ -103,7 +104,7 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
@@ -103,7 +104,8 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
@Override
public boolean shouldDisableExternalIntentRequestsForUrl(GURL url) {
- return false;
+ if ("tel".equals(url.getScheme())) return false;
+ return !sAllowExternalIntentRequests.getInstance().isEnabled();
}
@@ -105,9 +115,99 @@ new file mode 100644
+ Allow forward URL requests to external intents
+ </message>
+ <message name="IDS_ALLOW_EXTERNAL_INTENT_REQUESTS_SUMMARY" desc="">
+ If disabled, URL requests will never allow redirection to an external intent, such as open application or dialer. Caution: since no verification is possible on the information, allows linkage between browser browsing and activity on the application.
+ If disabled, URL requests will never allow redirection to an external intent, such as open application. Caution: since no verification is possible on the information, allows linkage between browser browsing and activity on the application.
+ </message>
+</grit-part>
diff --git a/components/external_intents/android/external_intents_features.cc b/components/external_intents/android/external_intents_features.cc
--- a/components/external_intents/android/external_intents_features.cc
+++ b/components/external_intents/android/external_intents_features.cc
@@ -27,7 +27,6 @@ namespace {
const base::Feature* kFeaturesExposedToJava[] = {
&kExternalNavigationDebugLogs, &kBlockFrameRenavigations,
&kBlockIntentsToSelf, &kTrustedClientGestureBypass};
-
} // namespace
// Alphabetical:
@@ -48,7 +47,13 @@ BASE_FEATURE(kTrustedClientGestureBypass,
"TrustedClientGestureBypass",
base::FEATURE_ENABLED_BY_DEFAULT);
+CROMITE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture,
+ "IntentBlockExternalFormRedirectsNoGesture",
+ base::FEATURE_ENABLED_BY_DEFAULT);
+
static jlong JNI_ExternalIntentsFeatures_GetFeature(JNIEnv* env, jint ordinal) {
+ if (ordinal == -1)
+ return reinterpret_cast<jlong>(&kIntentBlockExternalFormRedirectsNoGesture);
return reinterpret_cast<jlong>(kFeaturesExposedToJava[ordinal]);
}
diff --git a/components/external_intents/android/external_intents_features.h b/components/external_intents/android/external_intents_features.h
--- a/components/external_intents/android/external_intents_features.h
+++ b/components/external_intents/android/external_intents_features.h
@@ -9,6 +9,7 @@
namespace external_intents {
+BASE_DECLARE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture);
BASE_DECLARE_FEATURE(kExternalNavigationDebugLogs);
BASE_DECLARE_FEATURE(kBlockFrameRenavigations);
BASE_DECLARE_FEATURE(kBlockIntentsToSelf);
diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
--- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
@@ -18,6 +18,12 @@ import org.chromium.base.Features;
*/
@JNINamespace("external_intents")
public class ExternalIntentsFeatures extends Features {
+ public static final String INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME =
+ "IntentBlockExternalFormRedirectsNoGesture";
+
+ public static final ExternalIntentsFeatures INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE =
+ new ExternalIntentsFeatures(-1, INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME);
+
public static final String EXTERNAL_NAVIGATION_DEBUG_LOGS_NAME = "ExternalNavigationDebugLogs";
public static final String BLOCK_FRAME_RENAVIGATIONS_NAME = "BlockFrameRenavigations3";
public static final String BLOCK_INTENTS_TO_SELF_NAME = "BlockIntentsToSelf";
diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
--- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
@@ -1560,6 +1560,12 @@ public class ExternalNavigationHandler {
|| ignoreBackForwardNav(params);
}
+ /** Wrapper of check against the feature to support overriding for testing. */
+ @VisibleForTesting
+ boolean blockExternalFormRedirectsWithoutGesture() {
+ return ExternalIntentsFeatures.INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE.isEnabled();
+ }
+
private OverrideUrlLoadingResult shouldOverrideUrlLoadingInternal(
ExternalNavigationParams params,
Intent targetIntent,
@@ -1623,6 +1629,21 @@ public class ExternalNavigationHandler {
return OverrideUrlLoadingResult.forNoOverride();
}
+ // http://crbug.com/839751: Require user gestures for form submits to external
+ // protocols.
+ // TODO(tedchoc): Turn this on by default once we verify this change does
+ // not break the world.
+ int pageTransitionCore = params.getPageTransition() & PageTransition.CORE_MASK;
+ boolean isFormSubmit = pageTransitionCore == PageTransition.FORM_SUBMIT;
+ boolean isRedirectFromFormSubmit = isFormSubmit && params.isRedirect();
+ if (isRedirectFromFormSubmit && !incomingIntentRedirect && !params.hasUserGesture()
+ && blockExternalFormRedirectsWithoutGesture()) {
+ if (debug()) {
+ Log.i(TAG, "Incoming form intent attempting to redirect without user gesture");
+ }
+ return OverrideUrlLoadingResult.forNoOverride();
+ }
+
if (hasInternalScheme(params.getUrl(), targetIntent)
|| hasContentScheme(params.getUrl(), targetIntent)
|| hasFileSchemeInIntentURI(params.getUrl(), targetIntent)) {
diff --git a/cromite_flags/chrome/browser/about_flags_cc/Add-flag-to-disable-external-intent-requests.inc b/cromite_flags/chrome/browser/about_flags_cc/Add-flag-to-disable-external-intent-requests.inc
new file mode 100644
--- /dev/null
@@ -126,6 +226,26 @@ new file mode 100644
+#endif
+
+#endif
diff --git a/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc b/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc
@@ -0,0 +1,15 @@
+#if BUILDFLAG(IS_ANDROID)
+
+#ifdef FLAG_SECTION
+
+ {"block-external-form-redirects-no-gesture",
+ "Block intents from form submissions without user gesture",
+ "Require a user gesture that triggered a form submission in order to "
+ "allow for redirecting to an external intent.",
+ kOsAndroid,
+ FEATURE_VALUE_TYPE(
+ external_intents::kIntentBlockExternalFormRedirectsNoGesture)},
+
+#endif
+
+#endif
diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-flag-to-disable-external-intent-requests.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-flag-to-disable-external-intent-requests.inc
new file mode 100644
--- /dev/null
build/patches/Revert-Delete-block-external-form-redirects.patch
-128
View File
@@ -1,128 +0,0 @@
From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Thu, 16 Jun 2022 23:23:43 +0200
Subject: Revert "Delete block-external-form-redirects"
This reverts commit b710cefb53b558a8bcd884f6baf0229ba4225721 and
enables IntentBlockExternalFormRedirectsNoGesture.
License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
---
.../android/external_intents_features.cc | 7 ++++++-
.../android/external_intents_features.h | 1 +
.../ExternalIntentsFeatures.java | 6 ++++++
.../ExternalNavigationHandler.java | 21 +++++++++++++++++++
...t-Delete-block-external-form-redirects.inc | 15 +++++++++++++
5 files changed, 49 insertions(+), 1 deletion(-)
create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc
diff --git a/components/external_intents/android/external_intents_features.cc b/components/external_intents/android/external_intents_features.cc
--- a/components/external_intents/android/external_intents_features.cc
+++ b/components/external_intents/android/external_intents_features.cc
@@ -27,7 +27,6 @@ namespace {
const base::Feature* kFeaturesExposedToJava[] = {
&kExternalNavigationDebugLogs, &kBlockFrameRenavigations,
&kBlockIntentsToSelf, &kTrustedClientGestureBypass};
-
} // namespace
// Alphabetical:
@@ -48,7 +47,13 @@ BASE_FEATURE(kTrustedClientGestureBypass,
"TrustedClientGestureBypass",
base::FEATURE_ENABLED_BY_DEFAULT);
+CROMITE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture,
+ "IntentBlockExternalFormRedirectsNoGesture",
+ base::FEATURE_ENABLED_BY_DEFAULT);
+
static jlong JNI_ExternalIntentsFeatures_GetFeature(JNIEnv* env, jint ordinal) {
+ if (ordinal == -1)
+ return reinterpret_cast<jlong>(&kIntentBlockExternalFormRedirectsNoGesture);
return reinterpret_cast<jlong>(kFeaturesExposedToJava[ordinal]);
}
diff --git a/components/external_intents/android/external_intents_features.h b/components/external_intents/android/external_intents_features.h
--- a/components/external_intents/android/external_intents_features.h
+++ b/components/external_intents/android/external_intents_features.h
@@ -9,6 +9,7 @@
namespace external_intents {
+BASE_DECLARE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture);
BASE_DECLARE_FEATURE(kExternalNavigationDebugLogs);
BASE_DECLARE_FEATURE(kBlockFrameRenavigations);
BASE_DECLARE_FEATURE(kBlockIntentsToSelf);
diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
--- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
@@ -18,6 +18,12 @@ import org.chromium.base.Features;
*/
@JNINamespace("external_intents")
public class ExternalIntentsFeatures extends Features {
+ public static final String INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME =
+ "IntentBlockExternalFormRedirectsNoGesture";
+
+ public static final ExternalIntentsFeatures INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE =
+ new ExternalIntentsFeatures(-1, INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME);
+
public static final String EXTERNAL_NAVIGATION_DEBUG_LOGS_NAME = "ExternalNavigationDebugLogs";
public static final String BLOCK_FRAME_RENAVIGATIONS_NAME = "BlockFrameRenavigations3";
public static final String BLOCK_INTENTS_TO_SELF_NAME = "BlockIntentsToSelf";
diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
--- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
@@ -1560,6 +1560,12 @@ public class ExternalNavigationHandler {
|| ignoreBackForwardNav(params);
}
+ /** Wrapper of check against the feature to support overriding for testing. */
+ @VisibleForTesting
+ boolean blockExternalFormRedirectsWithoutGesture() {
+ return ExternalIntentsFeatures.INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE.isEnabled();
+ }
+
private OverrideUrlLoadingResult shouldOverrideUrlLoadingInternal(
ExternalNavigationParams params,
Intent targetIntent,
@@ -1623,6 +1629,21 @@ public class ExternalNavigationHandler {
return OverrideUrlLoadingResult.forNoOverride();
}
+ // http://crbug.com/839751: Require user gestures for form submits to external
+ // protocols.
+ // TODO(tedchoc): Turn this on by default once we verify this change does
+ // not break the world.
+ int pageTransitionCore = params.getPageTransition() & PageTransition.CORE_MASK;
+ boolean isFormSubmit = pageTransitionCore == PageTransition.FORM_SUBMIT;
+ boolean isRedirectFromFormSubmit = isFormSubmit && params.isRedirect();
+ if (isRedirectFromFormSubmit && !incomingIntentRedirect && !params.hasUserGesture()
+ && blockExternalFormRedirectsWithoutGesture()) {
+ if (debug()) {
+ Log.i(TAG, "Incoming form intent attempting to redirect without user gesture");
+ }
+ return OverrideUrlLoadingResult.forNoOverride();
+ }
+
if (hasInternalScheme(params.getUrl(), targetIntent)
|| hasContentScheme(params.getUrl(), targetIntent)
|| hasFileSchemeInIntentURI(params.getUrl(), targetIntent)) {
diff --git a/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc b/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc
@@ -0,0 +1,15 @@
+#if BUILDFLAG(IS_ANDROID)
+
+#ifdef FLAG_SECTION
+
+ {"block-external-form-redirects-no-gesture",
+ "Block intents from form submissions without user gesture",
+ "Require a user gesture that triggered a form submission in order to "
+ "allow for redirecting to an external intent.",
+ kOsAndroid,
+ FEATURE_VALUE_TYPE(
+ external_intents::kIntentBlockExternalFormRedirectsNoGesture)},
+
+#endif
+
+#endif
--