diff --git a/build/cromite_patches_list.txt b/build/cromite_patches_list.txt index e673a8e4..87a64299 100644 --- a/build/cromite_patches_list.txt +++ b/build/cromite_patches_list.txt @@ -117,7 +117,6 @@ User-agent-customization.patch Add-AllowUserCertificates-flag.patch Add-IsCleartextPermitted-flag.patch Add-flag-for-omnibox-autocomplete-filtering.patch -Revert-Delete-block-external-form-redirects.patch Add-flag-to-disable-external-intent-requests.patch Enable-share-intent.patch Logcat-crash-reports-UI.patch diff --git a/build/patches/Add-flag-to-disable-external-intent-requests.patch b/build/patches/Add-flag-to-disable-external-intent-requests.patch index 8c896f96..8af98e72 100644 --- a/build/patches/Add-flag-to-disable-external-intent-requests.patch +++ b/build/patches/Add-flag-to-disable-external-intent-requests.patch @@ -3,20 +3,29 @@ Date: Tue, 25 May 2021 19:46:14 +0200 Subject: Add flag to disable external intent requests Adds a new flag that allows to control the switch with same name; -when flag is disabled no external intent will ever be allowed, for any URL. +when flag is disabled no external intent will ever be allowed, +for any URL except for the tel: schema. +This also reverts commit b710cefb53b558a8bcd884f6baf0229ba4225721 and +enables IntentBlockExternalFormRedirectsNoGesture. License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html --- .../java/res/xml/privacy_preferences.xml | 7 +++- - .../ExternalNavigationDelegateImpl.java | 3 +- + .../ExternalNavigationDelegateImpl.java | 4 ++- .../cromite/sAllowExternalIntentRequests.java | 33 +++++++++++++++++++ ...g-to-disable-external-intent-requests.grdp | 9 +++++ + .../android/external_intents_features.cc | 7 +++- + .../android/external_intents_features.h | 1 + + .../ExternalIntentsFeatures.java | 6 ++++ + .../ExternalNavigationHandler.java | 21 ++++++++++++ ...ag-to-disable-external-intent-requests.inc | 13 ++++++++ + ...t-Delete-block-external-form-redirects.inc | 15 +++++++++ ...ag-to-disable-external-intent-requests.inc | 3 ++ - 6 files changed, 66 insertions(+), 2 deletions(-) + 11 files changed, 116 insertions(+), 3 deletions(-) create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sAllowExternalIntentRequests.java create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-flag-to-disable-external-intent-requests.grdp create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-flag-to-disable-external-intent-requests.inc + create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-flag-to-disable-external-intent-requests.inc diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml @@ -47,11 +56,12 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/Ext import org.chromium.chrome.browser.IntentHandler; import org.chromium.chrome.browser.tab.EmptyTabObserver; import org.chromium.chrome.browser.tab.Tab; -@@ -103,7 +104,7 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat +@@ -103,7 +104,8 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat @Override public boolean shouldDisableExternalIntentRequestsForUrl(GURL url) { - return false; ++ if ("tel".equals(url.getScheme())) return false; + return !sAllowExternalIntentRequests.getInstance().isEnabled(); } @@ -105,9 +115,99 @@ new file mode 100644 + Allow forward URL requests to external intents + + -+ If disabled, URL requests will never allow redirection to an external intent, such as open application or dialer. Caution: since no verification is possible on the information, allows linkage between browser browsing and activity on the application. ++ If disabled, URL requests will never allow redirection to an external intent, such as open application. Caution: since no verification is possible on the information, allows linkage between browser browsing and activity on the application. + + +diff --git a/components/external_intents/android/external_intents_features.cc b/components/external_intents/android/external_intents_features.cc +--- a/components/external_intents/android/external_intents_features.cc ++++ b/components/external_intents/android/external_intents_features.cc +@@ -27,7 +27,6 @@ namespace { + const base::Feature* kFeaturesExposedToJava[] = { + &kExternalNavigationDebugLogs, &kBlockFrameRenavigations, + &kBlockIntentsToSelf, &kTrustedClientGestureBypass}; +- + } // namespace + + // Alphabetical: +@@ -48,7 +47,13 @@ BASE_FEATURE(kTrustedClientGestureBypass, + "TrustedClientGestureBypass", + base::FEATURE_ENABLED_BY_DEFAULT); + ++CROMITE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture, ++ "IntentBlockExternalFormRedirectsNoGesture", ++ base::FEATURE_ENABLED_BY_DEFAULT); ++ + static jlong JNI_ExternalIntentsFeatures_GetFeature(JNIEnv* env, jint ordinal) { ++ if (ordinal == -1) ++ return reinterpret_cast(&kIntentBlockExternalFormRedirectsNoGesture); + return reinterpret_cast(kFeaturesExposedToJava[ordinal]); + } + +diff --git a/components/external_intents/android/external_intents_features.h b/components/external_intents/android/external_intents_features.h +--- a/components/external_intents/android/external_intents_features.h ++++ b/components/external_intents/android/external_intents_features.h +@@ -9,6 +9,7 @@ + + namespace external_intents { + ++BASE_DECLARE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture); + BASE_DECLARE_FEATURE(kExternalNavigationDebugLogs); + BASE_DECLARE_FEATURE(kBlockFrameRenavigations); + BASE_DECLARE_FEATURE(kBlockIntentsToSelf); +diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java +--- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java ++++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java +@@ -18,6 +18,12 @@ import org.chromium.base.Features; + */ + @JNINamespace("external_intents") + public class ExternalIntentsFeatures extends Features { ++ public static final String INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME = ++ "IntentBlockExternalFormRedirectsNoGesture"; ++ ++ public static final ExternalIntentsFeatures INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE = ++ new ExternalIntentsFeatures(-1, INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME); ++ + public static final String EXTERNAL_NAVIGATION_DEBUG_LOGS_NAME = "ExternalNavigationDebugLogs"; + public static final String BLOCK_FRAME_RENAVIGATIONS_NAME = "BlockFrameRenavigations3"; + public static final String BLOCK_INTENTS_TO_SELF_NAME = "BlockIntentsToSelf"; +diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java +--- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java ++++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java +@@ -1560,6 +1560,12 @@ public class ExternalNavigationHandler { + || ignoreBackForwardNav(params); + } + ++ /** Wrapper of check against the feature to support overriding for testing. */ ++ @VisibleForTesting ++ boolean blockExternalFormRedirectsWithoutGesture() { ++ return ExternalIntentsFeatures.INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE.isEnabled(); ++ } ++ + private OverrideUrlLoadingResult shouldOverrideUrlLoadingInternal( + ExternalNavigationParams params, + Intent targetIntent, +@@ -1623,6 +1629,21 @@ public class ExternalNavigationHandler { + return OverrideUrlLoadingResult.forNoOverride(); + } + ++ // http://crbug.com/839751: Require user gestures for form submits to external ++ // protocols. ++ // TODO(tedchoc): Turn this on by default once we verify this change does ++ // not break the world. ++ int pageTransitionCore = params.getPageTransition() & PageTransition.CORE_MASK; ++ boolean isFormSubmit = pageTransitionCore == PageTransition.FORM_SUBMIT; ++ boolean isRedirectFromFormSubmit = isFormSubmit && params.isRedirect(); ++ if (isRedirectFromFormSubmit && !incomingIntentRedirect && !params.hasUserGesture() ++ && blockExternalFormRedirectsWithoutGesture()) { ++ if (debug()) { ++ Log.i(TAG, "Incoming form intent attempting to redirect without user gesture"); ++ } ++ return OverrideUrlLoadingResult.forNoOverride(); ++ } ++ + if (hasInternalScheme(params.getUrl(), targetIntent) + || hasContentScheme(params.getUrl(), targetIntent) + || hasFileSchemeInIntentURI(params.getUrl(), targetIntent)) { diff --git a/cromite_flags/chrome/browser/about_flags_cc/Add-flag-to-disable-external-intent-requests.inc b/cromite_flags/chrome/browser/about_flags_cc/Add-flag-to-disable-external-intent-requests.inc new file mode 100644 --- /dev/null @@ -126,6 +226,26 @@ new file mode 100644 +#endif + +#endif +diff --git a/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc b/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc +new file mode 100644 +--- /dev/null ++++ b/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc +@@ -0,0 +1,15 @@ ++#if BUILDFLAG(IS_ANDROID) ++ ++#ifdef FLAG_SECTION ++ ++ {"block-external-form-redirects-no-gesture", ++ "Block intents from form submissions without user gesture", ++ "Require a user gesture that triggered a form submission in order to " ++ "allow for redirecting to an external intent.", ++ kOsAndroid, ++ FEATURE_VALUE_TYPE( ++ external_intents::kIntentBlockExternalFormRedirectsNoGesture)}, ++ ++#endif ++ ++#endif diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-flag-to-disable-external-intent-requests.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Add-flag-to-disable-external-intent-requests.inc new file mode 100644 --- /dev/null diff --git a/build/patches/Revert-Delete-block-external-form-redirects.patch b/build/patches/Revert-Delete-block-external-form-redirects.patch deleted file mode 100644 index 945c22ed..00000000 --- a/build/patches/Revert-Delete-block-external-form-redirects.patch +++ /dev/null @@ -1,128 +0,0 @@ -From: csagan5 <32685696+csagan5@users.noreply.github.com> -Date: Thu, 16 Jun 2022 23:23:43 +0200 -Subject: Revert "Delete block-external-form-redirects" - -This reverts commit b710cefb53b558a8bcd884f6baf0229ba4225721 and -enables IntentBlockExternalFormRedirectsNoGesture. - -License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html ---- - .../android/external_intents_features.cc | 7 ++++++- - .../android/external_intents_features.h | 1 + - .../ExternalIntentsFeatures.java | 6 ++++++ - .../ExternalNavigationHandler.java | 21 +++++++++++++++++++ - ...t-Delete-block-external-form-redirects.inc | 15 +++++++++++++ - 5 files changed, 49 insertions(+), 1 deletion(-) - create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc - -diff --git a/components/external_intents/android/external_intents_features.cc b/components/external_intents/android/external_intents_features.cc ---- a/components/external_intents/android/external_intents_features.cc -+++ b/components/external_intents/android/external_intents_features.cc -@@ -27,7 +27,6 @@ namespace { - const base::Feature* kFeaturesExposedToJava[] = { - &kExternalNavigationDebugLogs, &kBlockFrameRenavigations, - &kBlockIntentsToSelf, &kTrustedClientGestureBypass}; -- - } // namespace - - // Alphabetical: -@@ -48,7 +47,13 @@ BASE_FEATURE(kTrustedClientGestureBypass, - "TrustedClientGestureBypass", - base::FEATURE_ENABLED_BY_DEFAULT); - -+CROMITE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture, -+ "IntentBlockExternalFormRedirectsNoGesture", -+ base::FEATURE_ENABLED_BY_DEFAULT); -+ - static jlong JNI_ExternalIntentsFeatures_GetFeature(JNIEnv* env, jint ordinal) { -+ if (ordinal == -1) -+ return reinterpret_cast(&kIntentBlockExternalFormRedirectsNoGesture); - return reinterpret_cast(kFeaturesExposedToJava[ordinal]); - } - -diff --git a/components/external_intents/android/external_intents_features.h b/components/external_intents/android/external_intents_features.h ---- a/components/external_intents/android/external_intents_features.h -+++ b/components/external_intents/android/external_intents_features.h -@@ -9,6 +9,7 @@ - - namespace external_intents { - -+BASE_DECLARE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture); - BASE_DECLARE_FEATURE(kExternalNavigationDebugLogs); - BASE_DECLARE_FEATURE(kBlockFrameRenavigations); - BASE_DECLARE_FEATURE(kBlockIntentsToSelf); -diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java ---- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java -+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java -@@ -18,6 +18,12 @@ import org.chromium.base.Features; - */ - @JNINamespace("external_intents") - public class ExternalIntentsFeatures extends Features { -+ public static final String INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME = -+ "IntentBlockExternalFormRedirectsNoGesture"; -+ -+ public static final ExternalIntentsFeatures INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE = -+ new ExternalIntentsFeatures(-1, INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME); -+ - public static final String EXTERNAL_NAVIGATION_DEBUG_LOGS_NAME = "ExternalNavigationDebugLogs"; - public static final String BLOCK_FRAME_RENAVIGATIONS_NAME = "BlockFrameRenavigations3"; - public static final String BLOCK_INTENTS_TO_SELF_NAME = "BlockIntentsToSelf"; -diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java ---- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java -+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java -@@ -1560,6 +1560,12 @@ public class ExternalNavigationHandler { - || ignoreBackForwardNav(params); - } - -+ /** Wrapper of check against the feature to support overriding for testing. */ -+ @VisibleForTesting -+ boolean blockExternalFormRedirectsWithoutGesture() { -+ return ExternalIntentsFeatures.INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE.isEnabled(); -+ } -+ - private OverrideUrlLoadingResult shouldOverrideUrlLoadingInternal( - ExternalNavigationParams params, - Intent targetIntent, -@@ -1623,6 +1629,21 @@ public class ExternalNavigationHandler { - return OverrideUrlLoadingResult.forNoOverride(); - } - -+ // http://crbug.com/839751: Require user gestures for form submits to external -+ // protocols. -+ // TODO(tedchoc): Turn this on by default once we verify this change does -+ // not break the world. -+ int pageTransitionCore = params.getPageTransition() & PageTransition.CORE_MASK; -+ boolean isFormSubmit = pageTransitionCore == PageTransition.FORM_SUBMIT; -+ boolean isRedirectFromFormSubmit = isFormSubmit && params.isRedirect(); -+ if (isRedirectFromFormSubmit && !incomingIntentRedirect && !params.hasUserGesture() -+ && blockExternalFormRedirectsWithoutGesture()) { -+ if (debug()) { -+ Log.i(TAG, "Incoming form intent attempting to redirect without user gesture"); -+ } -+ return OverrideUrlLoadingResult.forNoOverride(); -+ } -+ - if (hasInternalScheme(params.getUrl(), targetIntent) - || hasContentScheme(params.getUrl(), targetIntent) - || hasFileSchemeInIntentURI(params.getUrl(), targetIntent)) { -diff --git a/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc b/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc -new file mode 100644 ---- /dev/null -+++ b/cromite_flags/chrome/browser/about_flags_cc/Revert-Delete-block-external-form-redirects.inc -@@ -0,0 +1,15 @@ -+#if BUILDFLAG(IS_ANDROID) -+ -+#ifdef FLAG_SECTION -+ -+ {"block-external-form-redirects-no-gesture", -+ "Block intents from form submissions without user gesture", -+ "Require a user gesture that triggered a form submission in order to " -+ "allow for redirecting to an external intent.", -+ kOsAndroid, -+ FEATURE_VALUE_TYPE( -+ external_intents::kIntentBlockExternalFormRedirectsNoGesture)}, -+ -+#endif -+ -+#endif ---