From: csagan5 <32685696+csagan5@users.noreply.github.com> Date: Thu, 22 Jul 2021 23:10:52 +0200 Subject: Client hints overrides Disable critical client hints and network early hints Use Google Chrome branding for client hints License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html --- .../SupportLibWebViewChromiumFactory.java | 2 +- components/client_hints/browser/client_hints.cc | 5 +++-- components/embedder_support/user_agent_utils.cc | 5 ++--- content/browser/client_hints/client_hints.cc | 17 +++++++++++++++-- .../about_flags_cc/Client-hints-overrides.inc | 9 +++++++++ .../features_cc/Client-hints-overrides.inc | 1 + .../cpp/features_cc/Client-hints-overrides.inc | 1 + net/http/http_network_transaction.cc | 1 + services/network/public/cpp/client_hints.cc | 2 +- .../blink/common/client_hints/client_hints.cc | 6 ++++-- .../common/client_hints/enabled_client_hints.cc | 8 ++++++++ .../blink/renderer/core/frame/navigator_ua.idl | 4 +++- .../renderer/core/frame/navigator_ua_data.cc | 1 + .../renderer/core/frame/navigator_ua_data.idl | 5 ++++- .../renderer/core/loader/frame_fetch_context.cc | 4 +++- .../platform/runtime_enabled_features.json5 | 5 +++++ 16 files changed, 62 insertions(+), 14 deletions(-) create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Client-hints-overrides.inc create mode 100644 cromite_flags/content/common/features_cc/Client-hints-overrides.inc create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Client-hints-overrides.inc diff --git a/android_webview/support_library/java/src/org/chromium/support_lib_glue/SupportLibWebViewChromiumFactory.java b/android_webview/support_library/java/src/org/chromium/support_lib_glue/SupportLibWebViewChromiumFactory.java --- a/android_webview/support_library/java/src/org/chromium/support_lib_glue/SupportLibWebViewChromiumFactory.java +++ b/android_webview/support_library/java/src/org/chromium/support_lib_glue/SupportLibWebViewChromiumFactory.java @@ -99,7 +99,7 @@ public class SupportLibWebViewChromiumFactory implements WebViewProviderFactoryB Features.GET_COOKIE_INFO, Features.WEB_MESSAGE_ARRAY_BUFFER, Features.IMAGE_DRAG_DROP, - Features.USER_AGENT_METADATA, + // Features.USER_AGENT_METADATA, Features.MULTI_PROFILE, Features.ATTRIBUTION_BEHAVIOR, Features.WEBVIEW_MEDIA_INTEGRITY_API_STATUS, diff --git a/components/client_hints/browser/client_hints.cc b/components/client_hints/browser/client_hints.cc --- a/components/client_hints/browser/client_hints.cc +++ b/components/client_hints/browser/client_hints.cc @@ -36,7 +36,7 @@ ParseInitializeClientHintsStorage() { auto results = base::flat_map>(); - + if ((true)) return results; std::string raw_client_hint_json = base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII( switches::kInitializeClientHintsStorage); @@ -201,7 +201,8 @@ void ClientHints::PersistClientHints( // TODO(tbansal): crbug.com/735518. Disable updates to client hints settings // when cookies are disabled for |primary_origin|. content_settings::ContentSettingConstraints constraints; - constraints.set_session_model(content_settings::mojom::SessionModel::DURABLE); + constraints.set_session_model(content_settings::mojom::SessionModel::USER_SESSION); + constraints.set_lifetime(base::Minutes(1)); settings_map_->SetWebsiteSettingDefaultScope( primary_url, GURL(), ContentSettingsType::CLIENT_HINTS, base::Value(std::move(client_hints_dictionary)), constraints); diff --git a/components/embedder_support/user_agent_utils.cc b/components/embedder_support/user_agent_utils.cc --- a/components/embedder_support/user_agent_utils.cc +++ b/components/embedder_support/user_agent_utils.cc @@ -163,9 +163,7 @@ const blink::UserAgentBrandList GetUserAgentBrandList( bool parse_result = base::StringToInt(major_version, &major_version_number); DCHECK(parse_result); std::optional brand; -#if !BUILDFLAG(CHROMIUM_BRANDING) - brand = version_info::GetProductName(); -#endif + brand = "Google Chrome"; std::string brand_version = output_version_type == blink::UserAgentBrandVersionType::kFullVersion @@ -662,6 +660,7 @@ blink::UserAgentMetadata GetUserAgentMetadata(bool only_low_entropy_ch) { } // High entropy client hints. + if ((true)) return metadata; metadata.brand_full_version_list = GetUserAgentBrandFullVersionListInternal(std::nullopt); metadata.full_version = std::string(version_info::GetVersionNumber()); diff --git a/content/browser/client_hints/client_hints.cc b/content/browser/client_hints/client_hints.cc --- a/content/browser/client_hints/client_hints.cc +++ b/content/browser/client_hints/client_hints.cc @@ -57,6 +57,7 @@ #include "third_party/blink/public/common/features.h" #include "third_party/blink/public/common/page/page_zoom.h" #include "third_party/blink/public/common/user_agent/user_agent_metadata.h" +#include "third_party/blink/renderer/platform/runtime_enabled_features.h" #include "ui/display/display.h" #include "ui/display/screen.h" #include "url/origin.h" @@ -601,10 +602,21 @@ bool IsClientHintEnabled(const ClientHintsExtendedData& data, bool IsClientHintAllowed(const ClientHintsExtendedData& data, WebClientHintsType type) { + if (!blink::RuntimeEnabledFeatures::UserAgentClientHintEnabled()) + return false; + + bool allowed = false; + if (type == WebClientHintsType::kUA || + type == WebClientHintsType::kUAMobile || + type == WebClientHintsType::kUAPlatform || + type == WebClientHintsType::kUAModel || + type == WebClientHintsType::kUAPlatformVersion) { + allowed = true; + } if (data.is_outermost_main_frame) { - return true; + return allowed; } - return (data.permissions_policy->IsFeatureEnabledForOrigin( + return ((false)) && (data.permissions_policy->IsFeatureEnabledForOrigin( network::GetClientHintToPolicyFeatureMap().at(type), data.resource_origin)); } @@ -629,6 +641,7 @@ bool IsJavascriptEnabled(FrameTreeNode* frame_tree_node) { void UpdateIFramePermissionsPolicyWithDelegationSupportForClientHints( ClientHintsExtendedData& data, const network::ParsedPermissionsPolicy& container_policy) { + if ((true)) return; if (container_policy.empty()) { return; } diff --git a/cromite_flags/chrome/browser/about_flags_cc/Client-hints-overrides.inc b/cromite_flags/chrome/browser/about_flags_cc/Client-hints-overrides.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/chrome/browser/about_flags_cc/Client-hints-overrides.inc @@ -0,0 +1,9 @@ +#ifdef FLAG_SECTION + + {"enable-ua-client-hint", + "Enable UA client hint", + "Allow sending base low entropy client hints as " + "UA, UAMobile and UAPlatform for compatibility", kOsAll, + FEATURE_VALUE_TYPE(blink::features::kUserAgentClientHint)}, + +#endif diff --git a/cromite_flags/content/common/features_cc/Client-hints-overrides.inc b/cromite_flags/content/common/features_cc/Client-hints-overrides.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/content/common/features_cc/Client-hints-overrides.inc @@ -0,0 +1 @@ +SET_CROMITE_FEATURE_ENABLED(kCriticalClientHint); diff --git a/cromite_flags/services/network/public/cpp/features_cc/Client-hints-overrides.inc b/cromite_flags/services/network/public/cpp/features_cc/Client-hints-overrides.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/services/network/public/cpp/features_cc/Client-hints-overrides.inc @@ -0,0 +1 @@ +SET_CROMITE_FEATURE_ENABLED(kAcceptCHFrame); diff --git a/net/http/http_network_transaction.cc b/net/http/http_network_transaction.cc --- a/net/http/http_network_transaction.cc +++ b/net/http/http_network_transaction.cc @@ -120,6 +120,7 @@ const size_t kMaxRestarts = 32; // Returns true when Early Hints are allowed on the given protocol. bool EarlyHintsAreAllowedOn(HttpConnectionInfo connection_info) { + if ((true)) return false; switch (connection_info) { case HttpConnectionInfo::kHTTP0_9: case HttpConnectionInfo::kHTTP1_0: diff --git a/services/network/public/cpp/client_hints.cc b/services/network/public/cpp/client_hints.cc --- a/services/network/public/cpp/client_hints.cc +++ b/services/network/public/cpp/client_hints.cc @@ -111,7 +111,7 @@ const DecodeMap& GetDecodeMap() { } // namespace std::optional> -ParseClientHintsHeader(const std::string& header) { +ParseClientHintsHeader(const std::string& header) { // Parse Client Hints Header // Accept-CH is an sh-list of tokens; see: // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-header-structure-19#section-3.1 std::optional maybe_list = diff --git a/third_party/blink/common/client_hints/client_hints.cc b/third_party/blink/common/client_hints/client_hints.cc --- a/third_party/blink/common/client_hints/client_hints.cc +++ b/third_party/blink/common/client_hints/client_hints.cc @@ -14,6 +14,7 @@ #include "base/strings/string_util.h" #include "services/network/public/cpp/client_hints.h" #include "services/network/public/cpp/permissions_policy/client_hints_permissions_policy_mapping.h" +#include "third_party/blink/public/common/features_generated.h" #include "services/network/public/cpp/permissions_policy/permissions_policy.h" #include "third_party/blink/public/common/features.h" #include "url/origin.h" @@ -22,11 +23,12 @@ namespace blink { bool IsClientHintSentByDefault(network::mojom::WebClientHintsType type) { switch (type) { - case network::mojom::WebClientHintsType::kSaveData: case network::mojom::WebClientHintsType::kUA: case network::mojom::WebClientHintsType::kUAMobile: case network::mojom::WebClientHintsType::kUAPlatform: - return true; + return base::FeatureList::IsEnabled(blink::features::kUserAgentClientHint); + case network::mojom::WebClientHintsType::kSaveData: + return false; default: return false; } diff --git a/third_party/blink/common/client_hints/enabled_client_hints.cc b/third_party/blink/common/client_hints/enabled_client_hints.cc --- a/third_party/blink/common/client_hints/enabled_client_hints.cc +++ b/third_party/blink/common/client_hints/enabled_client_hints.cc @@ -15,6 +15,14 @@ namespace { using ::network::mojom::WebClientHintsType; bool IsDisabledByFeature(const WebClientHintsType type) { + if (type == WebClientHintsType::kUA || + type == WebClientHintsType::kUAMobile || + type == WebClientHintsType::kUAPlatform || + type == WebClientHintsType::kUAModel || + type == WebClientHintsType::kUAPlatformVersion) { + return false; + } + if ((true)) return true; switch (type) { case WebClientHintsType::kUA: case WebClientHintsType::kUAArch: diff --git a/third_party/blink/renderer/core/frame/navigator_ua.idl b/third_party/blink/renderer/core/frame/navigator_ua.idl --- a/third_party/blink/renderer/core/frame/navigator_ua.idl +++ b/third_party/blink/renderer/core/frame/navigator_ua.idl @@ -4,6 +4,8 @@ // https://github.com/WICG/ua-client-hints -interface mixin NavigatorUA { +[ + RuntimeEnabled=UserAgentClientHint +] interface mixin NavigatorUA { [SecureContext] readonly attribute NavigatorUAData userAgentData; }; diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.cc b/third_party/blink/renderer/core/frame/navigator_ua_data.cc --- a/third_party/blink/renderer/core/frame/navigator_ua_data.cc +++ b/third_party/blink/renderer/core/frame/navigator_ua_data.cc @@ -113,6 +113,7 @@ const String& NavigatorUAData::platform() const { } bool AllowedToCollectHighEntropyValues(ExecutionContext* execution_context) { + if ((true)) return false; // To determine whether a document is allowed to get high-entropy // client hints returned by navigator.userAgentData.getHighEntropyValues(), // we need to check the "ch-ua-high-entropy-values" policy: diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.idl b/third_party/blink/renderer/core/frame/navigator_ua_data.idl --- a/third_party/blink/renderer/core/frame/navigator_ua_data.idl +++ b/third_party/blink/renderer/core/frame/navigator_ua_data.idl @@ -4,7 +4,10 @@ // https://github.com/WICG/ua-client-hints -[Exposed=(Window,Worker)] interface NavigatorUAData { +[ + RuntimeEnabled=UserAgentClientHint, + Exposed=(Window,Worker) +] interface NavigatorUAData { [MeasureAs=NavigatorUAData_Brands] readonly attribute FrozenArray brands; [MeasureAs=NavigatorUAData_Mobile] readonly attribute boolean mobile; [MeasureAs=NavigatorUAData_Platform] readonly attribute DOMString platform; diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/third_party/blink/renderer/core/loader/frame_fetch_context.cc --- a/third_party/blink/renderer/core/loader/frame_fetch_context.cc +++ b/third_party/blink/renderer/core/loader/frame_fetch_context.cc @@ -233,6 +233,8 @@ bool ShouldSendClientHint(const network::PermissionsPolicy& policy, bool is_1p_origin, network::mojom::blink::WebClientHintsType type, const ClientHintsPreferences& hints_preferences) { + if (!RuntimeEnabledFeatures::UserAgentClientHintEnabled()) + return false; // For subresource requests, sending the hint in the fetch request based on // the permissions policy. if (!policy.IsFeatureEnabledForOrigin( @@ -725,7 +727,7 @@ void FrameFetchContext::AddClientHintsIfNecessary( } // Only send User Agent hints if the info is available - if (ua) { + if (RuntimeEnabledFeatures::UserAgentClientHintEnabled() && ua) { // ShouldSendClientHint is called to make sure UA is controlled by // Permissions Policy. if (ShouldSendClientHint(*policy, resource_origin, is_1p_origin, diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5 @@ -678,6 +678,11 @@ name: "AriaNotifyV2", status: {"Android": "test", "Win": "test", "Mac": "test", "Linux": "test"}, }, + { + name: "UserAgentClientHint", + status: "stable", + base_feature: "UserAgentClientHint", + }, { name: "AriaRowColIndexText", status: "stable", --