From: uazo <uazo@users.noreply.github.com>
Date: Thu, 23 Jan 2025 17:01:50 +0000
Subject: PublicKeyCredential fingerprinting mitigations

Removes the possibility of obtaining the presence of Windows Hello and
Bluetooth by querying the PublicKeyCredential of the webauth api in
the Windows platform
---
 .../webauth/authenticator_common_impl.cc      | 28 +++++++++++++++++++
 .../webauth/authenticator_common_impl.h       |  2 +-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/content/browser/webauth/authenticator_common_impl.cc b/content/browser/webauth/authenticator_common_impl.cc
--- a/content/browser/webauth/authenticator_common_impl.cc
+++ b/content/browser/webauth/authenticator_common_impl.cc
@@ -57,6 +57,7 @@
 #include "content/public/browser/authenticator_common.h"
 #include "content/public/browser/authenticator_request_client_delegate.h"
 #include "content/public/browser/back_forward_cache.h"
+#include "content/public/browser/bluetooth_delegate.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_frame_host.h"
@@ -2010,6 +2011,7 @@ void AuthenticatorCommonImpl::GetClientCapabilities(
       MakeCapability(client_capabilities::kConditionalCreate, true));
 
   IsHybridTransportSupported(
+    caller_origin,
       base::BindOnce(&MakeCapability, client_capabilities::kHybridTransport)
           .Then(barrier_callback));
 
@@ -2037,11 +2039,30 @@ void AuthenticatorCommonImpl::GetClientCapabilities(
 }
 
 void AuthenticatorCommonImpl::IsHybridTransportSupported(
+    const url::Origin& caller_origin,
     base::OnceCallback<void(bool)> callback) {
   if (!device::BluetoothAdapterFactory::Get()->IsLowEnergySupported()) {
     std::move(callback).Run(false);
     return;
   }
+  BluetoothDelegate* delegate =
+        GetContentClient()->browser()->GetBluetoothDelegate();
+  if (!delegate) {
+    std::move(callback).Run(false);
+    return;
+  }
+  const url::Origin& embedding_origin =
+      GetRenderFrameHost()->GetMainFrame()->GetLastCommittedOrigin();
+  switch (delegate->AllowWebBluetooth(
+      GetBrowserContext(), caller_origin,
+      embedding_origin)) {
+    case BluetoothDelegate::AllowWebBluetoothResult::kBlockPolicy:
+    case BluetoothDelegate::AllowWebBluetoothResult::kBlockGloballyDisabled:
+      std::move(callback).Run(false);
+      return;
+    case BluetoothDelegate::AllowWebBluetoothResult::kAllow:
+      break;
+  }
 
   device::BluetoothAdapterFactory::Get()->GetAdapter(
       base::BindOnce([](scoped_refptr<device::BluetoothAdapter> adapter) {
@@ -2087,6 +2108,13 @@ void AuthenticatorCommonImpl::ContinueIsUvpaaAfterOverrideCheck(
         IsUserVerifyingPlatformAuthenticatorAvailableCallback callback,
     bool is_get_client_capabilities_call,
     std::optional<bool> is_uvpaa_override) {
+#if BUILDFLAG(IS_WIN)
+  if ((true)) {
+    // always expose Windows Hello active, even if it is not
+    std::move(callback).Run(true);
+    return;
+  }
+#endif
   if (is_uvpaa_override) {
     std::move(callback).Run(*is_uvpaa_override);
     return;
diff --git a/content/browser/webauth/authenticator_common_impl.h b/content/browser/webauth/authenticator_common_impl.h
--- a/content/browser/webauth/authenticator_common_impl.h
+++ b/content/browser/webauth/authenticator_common_impl.h
@@ -231,7 +231,7 @@ class CONTENT_EXPORT AuthenticatorCommonImpl : public AuthenticatorCommon {
   // Bluetooth adapter that supports BLE. If so, runs |callback| with `true`.
   // Otherwise, or if Bluetooth is disabled by Permissions Policy, runs
   // |callback| with `false`.
-  void IsHybridTransportSupported(base::OnceCallback<void(bool)> callback);
+  void IsHybridTransportSupported(const url::Origin& caller_origin, base::OnceCallback<void(bool)> callback);
 
   // `is_get_client_capabilities_call` is true if this call originated from the
   // `GetClientCapabilities` method. The UMA metric is only recorded if this is
--