From: csagan5 <32685696+csagan5@users.noreply.github.com> Date: Thu, 4 Nov 2021 09:19:24 +0100 Subject: Disable third-party origin trials License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html --- android_webview/common/aw_content_client.cc | 1 - .../origin_trials/origin_trial_policy_impl.cc | 7 ++++--- .../origin_trials/origin_trial_policy_impl.h | 2 +- .../renderer_host/navigation_request.cc | 1 - .../origin_trial_state_host_impl.cc | 19 ------------------- content/renderer/render_frame_impl.cc | 10 +++------- .../shell/common/shell_origin_trial_policy.cc | 10 ++++------ .../origin_trials/trial_token_validator.cc | 1 + .../renderer/core/loader/document_loader.cc | 18 ++---------------- .../blink/renderer/core/loader/http_equiv.cc | 2 +- .../origin_trials/origin_trial_context.cc | 6 ++++-- 11 files changed, 20 insertions(+), 57 deletions(-) diff --git a/android_webview/common/aw_content_client.cc b/android_webview/common/aw_content_client.cc --- a/android_webview/common/aw_content_client.cc +++ b/android_webview/common/aw_content_client.cc @@ -131,7 +131,6 @@ blink::OriginTrialPolicy* AwContentClient::GetOriginTrialPolicy() { // flag to true after construction. This will work because trial token // validator will always get the current instance of policy when needed. if (IsDisableOriginTrialsSafeModeActionOn()) { - origin_trial_policy_->SetAllowOnlyDeprecationTrials(true); } return origin_trial_policy_.get(); } diff --git a/components/embedder_support/origin_trials/origin_trial_policy_impl.cc b/components/embedder_support/origin_trials/origin_trial_policy_impl.cc --- a/components/embedder_support/origin_trials/origin_trial_policy_impl.cc +++ b/components/embedder_support/origin_trials/origin_trial_policy_impl.cc @@ -24,10 +24,10 @@ namespace embedder_support { -// This is the default public key used for validating signatures. +// This is an invalid public key that will match no origin trial signature static const blink::OriginTrialPublicKey kDefaultPublicKey = { 0x7c, 0xc4, 0xb8, 0x9a, 0x93, 0xba, 0x6e, 0xe2, 0xd0, 0xfd, 0x03, - 0x1d, 0xfb, 0x32, 0x66, 0xc7, 0x3b, 0x72, 0xfd, 0x54, 0x3a, 0x07, + 0x1d, 0xfb, 0x32, 0x66, 0x00, 0x01, 0x02, 0xfd, 0x54, 0x3a, 0x07, 0x51, 0x14, 0x66, 0xaa, 0x02, 0x53, 0x4e, 0x33, 0xa1, 0x15, }; @@ -61,7 +61,8 @@ OriginTrialPolicyImpl::OriginTrialPolicyImpl() { OriginTrialPolicyImpl::~OriginTrialPolicyImpl() = default; bool OriginTrialPolicyImpl::IsOriginTrialsSupported() const { - return true; + // third-party origin trials are always disabled + return false; } const std::vector& diff --git a/components/embedder_support/origin_trials/origin_trial_policy_impl.h b/components/embedder_support/origin_trials/origin_trial_policy_impl.h --- a/components/embedder_support/origin_trials/origin_trial_policy_impl.h +++ b/components/embedder_support/origin_trials/origin_trial_policy_impl.h @@ -34,6 +34,7 @@ class OriginTrialPolicyImpl : public blink::OriginTrialPolicy { bool IsTokenDisabled(std::string_view token_signature) const override; bool IsOriginSecure(const GURL& url) const override; + private: bool SetPublicKeysFromASCIIString(const std::string& ascii_public_key); bool SetDisabledFeatures(const std::string& disabled_feature_list); bool SetDisabledTokens(const std::vector& tokens); @@ -44,7 +45,6 @@ class OriginTrialPolicyImpl : public blink::OriginTrialPolicy { bool GetAllowOnlyDeprecationTrials() const; const std::set* GetDisabledTokensForTesting() const override; - private: std::vector public_keys_; std::set disabled_features_; std::set disabled_tokens_; diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc --- a/content/browser/renderer_host/navigation_request.cc +++ b/content/browser/renderer_host/navigation_request.cc @@ -10207,7 +10207,6 @@ void NavigationRequest::SetSourceSiteInstanceToInitiatorIfNeeded() { void NavigationRequest::ForceEnableOriginTrials( const std::vector& trials) { CHECK(!HasCommitted()); - commit_params_->force_enabled_origin_trials = trials; } network::CrossOriginEmbedderPolicy diff --git a/content/browser/renderer_host/origin_trial_state_host_impl.cc b/content/browser/renderer_host/origin_trial_state_host_impl.cc --- a/content/browser/renderer_host/origin_trial_state_host_impl.cc +++ b/content/browser/renderer_host/origin_trial_state_host_impl.cc @@ -109,25 +109,6 @@ void OriginTrialStateHostImpl::ApplyFeatureDiffForOriginTrial( // This issue should be revisited to avoid silently dropping any feature // overrides that are stored in the RFSDocumentData, in these corner cases // when the data has become a nullptr. - RuntimeFeatureStateDocumentData* document_data = - RuntimeFeatureStateDocumentData::GetForCurrentDocument( - &render_frame_host()); - if (!document_data) { - // We can't use - // RuntimeFeatureStateDocumentData::GetOrCreateForCurrentDocument() because - // that creates an empty RuntimeFeatureStateReadContext which will hit some - // internal CHECKs if used because all its member fields are empty. Passing - // in a RuntimeFeatureStateContext() will initialize those member fields. - RuntimeFeatureStateDocumentData::CreateForCurrentDocument( - &render_frame_host(), blink::RuntimeFeatureStateContext()); - document_data = RuntimeFeatureStateDocumentData::GetForCurrentDocument( - &render_frame_host()); - } - CHECK(document_data); - document_data - ->GetMutableRuntimeFeatureStateReadContext( - base::PassKey()) - .ApplyFeatureChange(validated_features, possible_third_party_features); } void OriginTrialStateHostImpl::EnablePersistentTrial( diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc --- a/content/renderer/render_frame_impl.cc +++ b/content/renderer/render_frame_impl.cc @@ -530,10 +530,6 @@ void FillNavigationParamsRequest( common_params.initiator_origin.value(); } - navigation_params->initiator_origin_trial_features = { - common_params.initiator_origin_trial_features.begin(), - common_params.initiator_origin_trial_features.end()}; - navigation_params->was_discarded = commit_params.was_discarded; navigation_params->document_ukm_source_id = commit_params.document_ukm_source_id; @@ -556,8 +552,8 @@ void FillNavigationParamsRequest( navigation_params->had_transient_user_activation = common_params.has_possibly_filtered_user_gesture; - navigation_params->force_enabled_origin_trials = base::ToVector( - commit_params.force_enabled_origin_trials, &WebString::FromAscii); + std::vector force_enabled_origin_trials; + navigation_params->force_enabled_origin_trials = force_enabled_origin_trials; navigation_params->early_hints_preloaded_resources = base::ToVector( commit_params.early_hints_preloaded_resources, blink::ToWebURL); @@ -645,7 +641,7 @@ blink::mojom::CommonNavigationParamsPtr MakeCommonNavigationParams( info->url_request.HasUserGesture(), info->url_request.HasTextFragmentToken(), info->should_check_main_world_content_security_policy, - info->initiator_origin_trial_features, info->href_translate.Latin1(), + /*initiator_origin_trial_features*/std::vector(), info->href_translate.Latin1(), is_history_navigation_in_new_child_frame, info->input_start, request_destination); } diff --git a/content/shell/common/shell_origin_trial_policy.cc b/content/shell/common/shell_origin_trial_policy.cc --- a/content/shell/common/shell_origin_trial_policy.cc +++ b/content/shell/common/shell_origin_trial_policy.cc @@ -14,13 +14,10 @@ namespace content { namespace { -// This is the public key which the content shell will use to enable origin -// trial features. Trial tokens for use in web tests can be created with the -// tool in /tools/origin_trials/generate_token.py, using the private key -// contained in /tools/origin_trials/eftest.key. +// This is an invalid public key that does not allow any origin trial verification static const blink::OriginTrialPublicKey kOriginTrialPublicKey = { 0x75, 0x10, 0xac, 0xf9, 0x3a, 0x1c, 0xb8, 0xa9, 0x28, 0x70, 0xd2, - 0x9a, 0xd0, 0x0b, 0x59, 0xe1, 0xac, 0x2b, 0xb7, 0xd5, 0xca, 0x1f, + 0x9a, 0xd0, 0x00, 0x01, 0x02, 0xac, 0x2b, 0xb7, 0xd5, 0xca, 0x1f, 0x64, 0x90, 0x08, 0x8e, 0xa8, 0xe0, 0x56, 0x3a, 0x04, 0xd0, }; @@ -33,7 +30,8 @@ ShellOriginTrialPolicy::ShellOriginTrialPolicy() { ShellOriginTrialPolicy::~ShellOriginTrialPolicy() {} bool ShellOriginTrialPolicy::IsOriginTrialsSupported() const { - return true; + // third-party origin trials are always disabled + return false; } const std::vector& diff --git a/third_party/blink/common/origin_trials/trial_token_validator.cc b/third_party/blink/common/origin_trials/trial_token_validator.cc --- a/third_party/blink/common/origin_trials/trial_token_validator.cc +++ b/third_party/blink/common/origin_trials/trial_token_validator.cc @@ -427,6 +427,7 @@ TrialTokenValidator::GetValidTokens(const url::Origin& origin, // static bool TrialTokenValidator::IsTrialPossibleOnOrigin(const GURL& url) { + if ((true)) return false; OriginTrialPolicy* policy = PolicyGetter().Run(); return policy && policy->IsOriginTrialsSupported() && policy->IsOriginSecure(url); diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc --- a/third_party/blink/renderer/core/loader/document_loader.cc +++ b/third_party/blink/renderer/core/loader/document_loader.cc @@ -201,13 +201,6 @@ namespace { Vector CopyInitiatorOriginTrials( const std::vector& initiator_origin_trial_features) { Vector result; - for (auto feature : initiator_origin_trial_features) { - // Convert from int to OriginTrialFeature. These values are passed between - // blink navigations. OriginTrialFeature isn't visible outside of blink (and - // doesn't need to be) so the values are transferred outside of blink as - // ints and casted to OriginTrialFeature once being processed in blink. - result.push_back(static_cast(feature)); - } return result; } @@ -221,16 +214,13 @@ std::vector CopyInitiatorOriginTrials( Vector CopyForceEnabledOriginTrials( const std::vector& force_enabled_origin_trials) { Vector result; - result.ReserveInitialCapacity( - base::checked_cast(force_enabled_origin_trials.size())); - for (const auto& trial : force_enabled_origin_trials) - result.push_back(trial); return result; } std::vector CopyForceEnabledOriginTrials( const Vector& force_enabled_origin_trials) { - return base::ToVector(force_enabled_origin_trials, ToWebString); + std::vector result; + return result; } bool IsPagePopupRunningInWebTest(LocalFrame* frame) { @@ -3320,10 +3310,6 @@ void DocumentLoader::CreateParserPostCommit() { mojom::blink::OriginTrialFeature::kTouchEventFeatureDetection); } - // Enable any origin trials that have been force enabled for this commit. - window->GetOriginTrialContext()->AddForceEnabledTrials( - force_enabled_origin_trials_); - OriginTrialContext::ActivateNavigationFeaturesFromInitiator( window, &initiator_origin_trial_features_); } diff --git a/third_party/blink/renderer/core/loader/http_equiv.cc b/third_party/blink/renderer/core/loader/http_equiv.cc --- a/third_party/blink/renderer/core/loader/http_equiv.cc +++ b/third_party/blink/renderer/core/loader/http_equiv.cc @@ -107,7 +107,7 @@ void HttpEquiv::ProcessHttpEquivDefaultStyle(Document& document, void HttpEquiv::ProcessHttpEquivOriginTrial(LocalDOMWindow* window, const AtomicString& content) { - if (!window) + if ((true)) return; // For meta tags injected by script, process the token with the origin of the // external script, if available. Get the top 3 script urls from the stack, as diff --git a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc --- a/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc +++ b/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc @@ -313,6 +313,9 @@ void OriginTrialContext::AddToken(const String& token) { void OriginTrialContext::AddTokenFromExternalScript( const String& token, const Vector>& external_origins) { + if ((true)) { + return; + } Vector script_origins; for (const scoped_refptr& origin : external_origins) { OriginInfo origin_info = {.origin = origin, @@ -468,8 +471,6 @@ bool OriginTrialContext::InstallSettingFeature( } void OriginTrialContext::AddFeature(mojom::blink::OriginTrialFeature feature) { - enabled_features_.insert(feature); - InitializePendingFeatures(); } bool OriginTrialContext::IsFeatureEnabled( @@ -513,6 +514,7 @@ void OriginTrialContext::AddForceEnabledTrials( } bool OriginTrialContext::CanEnableTrialFromName(const StringView& trial_name) { + if ((true)) return false; if (trial_name == "FledgeBiddingAndAuctionServer") { return base::FeatureList::IsEnabled( network::features::kInterestGroupStorage) && --