From: uazo Date: Wed, 17 Apr 2024 18:45:54 +0000 Subject: Private network access content settings Block access to the local network by default in android while allowing user choice in desktop platforms. License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html --- .../browser/chrome_content_browser_client.cc | 36 ++++++- ...eInsecurePrivateNetworkContentSetting.java | 93 +++++++++++++++++++ .../insecure_private_network.grdp | 18 ++++ .../insecure_private_network.inc | 25 +++++ .../INSECURE_PRIVATE_NETWORK.inc | 3 + .../local_network_access_util.cc | 6 +- ...rivate-network-access-content-settings.inc | 2 + services/network/public/cpp/features.cc | 2 +- 8 files changed, 178 insertions(+), 7 deletions(-) create mode 100644 components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteInsecurePrivateNetworkContentSetting.java create mode 100644 components/browser_ui/strings/bromite_content_settings/insecure_private_network.grdp create mode 100644 components/content_settings/core/browser/bromite_content_settings/insecure_private_network.inc create mode 100644 components/content_settings/core/common/bromite_content_settings/INSECURE_PRIVATE_NETWORK.inc create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Private-network-access-content-settings.inc diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc --- a/chrome/browser/chrome_content_browser_client.cc +++ b/chrome/browser/chrome_content_browser_client.cc @@ -4208,6 +4208,31 @@ bool ShouldPromptOnMultipleMatchingCertificates(const Profile* profile) { return false; } +bool ShouldAllowInsecurePrivateNetworkRequests( + const HostContentSettingsMap* map, + const url::Origin& origin) { + // Derive the base URL from the origin, since HostContentSettingsMap is keyed + // by URL and not by origin. However, this setting is conceptually keyed by + // origin, hence its public API uses url::Origin. + // + // This returns the default-constructed GURL for opaque origins, which should + // not match any content settings. + const GURL url = origin.GetURL(); + + const ContentSetting setting = map->GetContentSetting( + url, url, ContentSettingsType::INSECURE_PRIVATE_NETWORK); + + switch (setting) { + case CONTENT_SETTING_ALLOW: + return true; + case CONTENT_SETTING_BLOCK: + return false; + default: + NOTREACHED() + << "Invalid content setting for insecure private network requests: " + << setting; + } +} } // namespace base::OnceClosure ChromeContentBrowserClient::SelectClientCertificate( @@ -7870,12 +7895,17 @@ content::ContentBrowserClient::LocalNetworkAccessRequestPolicyOverride ChromeContentBrowserClient::ShouldOverrideLocalNetworkAccessRequestPolicy( content::BrowserContext* browser_context, const url::Origin& origin) { -#if BUILDFLAG(IS_ANDROID) - if (base::android::device_info::is_automotive()) { + if (HostContentSettingsMap* service = + HostContentSettingsMapFactory::GetForProfile(browser_context)) { + if (ShouldAllowInsecurePrivateNetworkRequests(service, origin)) { + return content::ContentBrowserClient:: + LocalNetworkAccessRequestPolicyOverride::kForceAllow; + } + } + if ((true)) { return content::ContentBrowserClient:: LocalNetworkAccessRequestPolicyOverride::kBlockInsteadOfWarn; } -#endif Profile* profile = Profile::FromBrowserContext(browser_context); diff --git a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteInsecurePrivateNetworkContentSetting.java b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteInsecurePrivateNetworkContentSetting.java new file mode 100644 --- /dev/null +++ b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteInsecurePrivateNetworkContentSetting.java @@ -0,0 +1,93 @@ +/* + This file is part of Bromite. + + Bromite is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + Bromite is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with Bromite. If not, see . +*/ + +package org.chromium.components.browser_ui.site_settings.impl; + +import org.chromium.components.browser_ui.site_settings.R; + +import org.chromium.components.browser_ui.site_settings.BromiteCustomContentSetting; +import org.chromium.components.browser_ui.site_settings.ContentSettingsResources; +import org.chromium.components.browser_ui.site_settings.SiteSettingsCategory; +import org.chromium.components.content_settings.ContentSetting; +import org.chromium.components.content_settings.ContentSettingsType; +import org.chromium.content_public.browser.BrowserContextHandle; + +import androidx.annotation.Nullable; +import androidx.preference.Preference; +import androidx.preference.PreferenceScreen; + +import java.util.ArrayList; + +public class BromiteInsecurePrivateNetworkContentSetting extends BromiteCustomContentSetting { + public BromiteInsecurePrivateNetworkContentSetting() { + super(/*contentSettingsType*/ ContentSettingsType.INSECURE_PRIVATE_NETWORK, + /*defaultEnabledValue*/ ContentSetting.ALLOW, + /*defaultDisabledValue*/ ContentSetting.BLOCK, + /*allowException*/ true, + /*preferenceKey*/ "insecure_private_network", + /*profilePrefKey*/ "insecure_private_network"); + } + + @Override + public ContentSettingsResources.ResourceItem getResourceItem() { + return new ContentSettingsResources.ResourceItem( + /*icon*/ R.drawable.web_asset, + /*title*/ R.string.insecure_private_network_permission_title, + /*defaultEnabledValue*/ getDefaultEnabledValue(), + /*defaultDisabledValue*/ getDefaultDisabledValue(), + /*enabledSummary*/ R.string.website_settings_category_insecure_private_network_allowed, + /*disabledSummary*/ R.string.website_settings_category_insecure_private_network_blocked, + /*summaryOverrideForScreenReader*/ 0); + } + + @Override + public int getCategorySummary(@Nullable @ContentSetting int value) { + switch (value) { + case ContentSetting.ALLOW: + return R.string.website_settings_category_insecure_private_network_allowed; + case ContentSetting.BLOCK: + return R.string.website_settings_category_insecure_private_network_blocked; + default: + return 0; + } + } + + @Override + public int getCategoryDescription() { + return R.string.settings_site_settings_insecure_private_network_description; + } + + @Override + public boolean requiresTriStateContentSetting() { + return false; + } + + @Override + public boolean showOnlyDescriptions() { + return true; + } + + @Override + public int getAddExceptionDialogMessage() { + return R.string.website_settings_category_insecure_private_network_allowed; + } + + @Override + public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSetting int value) { + return value != ContentSetting.BLOCK; + } +} diff --git a/components/browser_ui/strings/bromite_content_settings/insecure_private_network.grdp b/components/browser_ui/strings/bromite_content_settings/insecure_private_network.grdp new file mode 100644 --- /dev/null +++ b/components/browser_ui/strings/bromite_content_settings/insecure_private_network.grdp @@ -0,0 +1,18 @@ + + + + Access to Private Network + + + Enable access to private network + + + Allow access to private network + + + Block access to private network + + + Ask access to private network + + diff --git a/components/content_settings/core/browser/bromite_content_settings/insecure_private_network.inc b/components/content_settings/core/browser/bromite_content_settings/insecure_private_network.inc new file mode 100644 --- /dev/null +++ b/components/content_settings/core/browser/bromite_content_settings/insecure_private_network.inc @@ -0,0 +1,25 @@ + Register(ContentSettingsType::INSECURE_PRIVATE_NETWORK, + "insecure-private-network", CONTENT_SETTING_BLOCK, + WebsiteSettingsInfo::UNSYNCABLE, /*allowlisted_primary_schemes=*/{}, + /*valid_settings=*/{CONTENT_SETTING_ALLOW, CONTENT_SETTING_BLOCK}, + WebsiteSettingsInfo::REQUESTING_ORIGIN_ONLY_SCOPE, + WebsiteSettingsRegistry::ALL_PLATFORMS, + ContentSettingsInfo::INHERIT_IN_INCOGNITO, + PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS); + + content_settings::WebsiteSettingsRegistry::GetInstance() + ->GetMutable(ContentSettingsType::INSECURE_PRIVATE_NETWORK) + ->set_show_into_info_page() + .set_desktop_ui() + .set_title_ui(IDS_INSECURE_PRIVATE_NETWORK_PERMISSION_TITLE) + .set_description_ui(IDS_SETTINGS_SITE_SETTINGS_INSECURE_PRIVATE_NETWORK_DESCRIPTION) + .set_allowed_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ALLOWED) + .set_allowed_exceptions_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ALLOWED) +#if BUILDFLAG(IS_ANDROID) + .set_blocked_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_BLOCKED) + .set_blocked_exceptions_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_BLOCKED) +#else + .set_blocked_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ASK) + .set_blocked_exceptions_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ASK) +#endif + .set_mid_sentence_ui(IDS_INSECURE_PRIVATE_NETWORK_PERMISSION_TITLE); diff --git a/components/content_settings/core/common/bromite_content_settings/INSECURE_PRIVATE_NETWORK.inc b/components/content_settings/core/common/bromite_content_settings/INSECURE_PRIVATE_NETWORK.inc new file mode 100644 --- /dev/null +++ b/components/content_settings/core/common/bromite_content_settings/INSECURE_PRIVATE_NETWORK.inc @@ -0,0 +1,3 @@ + // Stores whether to allow insecure websites to make private network requests. + // See also: https://wicg.github.io/cors-rfc1918 + INSECURE_PRIVATE_NETWORK, diff --git a/content/browser/renderer_host/local_network_access_util.cc b/content/browser/renderer_host/local_network_access_util.cc --- a/content/browser/renderer_host/local_network_access_util.cc +++ b/content/browser/renderer_host/local_network_access_util.cc @@ -121,13 +121,13 @@ Policy DerivePolicyForNonSecureContext( // Requests from the `unknown` address space are controlled separately // because it is unclear why they happen in the first place. The goal is // to reduce instances of this happening before enabling this feature. - return Policy::kAllow; + return Policy::kWarn; case AddressSpace::kLocal: // Requests from the non secure contexts in the `local` address space // to localhost are blocked only if the right feature is enabled. // This is controlled separately because private network websites face // additional hurdles compared to public websites. See crbug.com/1234044. - return Policy::kWarn; + return Policy::kBlock; case AddressSpace::kPublic: case AddressSpace::kLoopback: // Private network requests from non secure contexts are blocked if the @@ -137,7 +137,7 @@ Policy DerivePolicyForNonSecureContext( // has no effect. Indeed, requests initiated from the local address space // are never considered private network requests - they cannot target // more-private address spaces. - return Policy::kWarn; + return Policy::kBlock; } } diff --git a/cromite_flags/services/network/public/cpp/features_cc/Private-network-access-content-settings.inc b/cromite_flags/services/network/public/cpp/features_cc/Private-network-access-content-settings.inc new file mode 100644 --- /dev/null +++ b/cromite_flags/services/network/public/cpp/features_cc/Private-network-access-content-settings.inc @@ -0,0 +1,2 @@ +SET_CROMITE_FEATURE_ENABLED(kLocalNetworkAccessChecks); +SET_CROMITE_FEATURE_ENABLED(kLocalNetworkAccessChecksWebRTC); diff --git a/services/network/public/cpp/features.cc b/services/network/public/cpp/features.cc --- a/services/network/public/cpp/features.cc +++ b/services/network/public/cpp/features.cc @@ -241,7 +241,7 @@ BASE_FEATURE_PARAM(bool, kLocalNetworkAccessChecksWarn, &kLocalNetworkAccessChecks, /*name=*/"LocalNetworkAccessChecksWarn", - /*default_value=*/false); + /*default_value=*/false); // keep false // Enables Local Network Access checks for WebRTC. // Blocks local network requests without user permission to prevent exploitation --