PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity
Files
create-pull-request/patch-b8df90d
cromite/build/patches/Partitioning-all-cookies-by-top-frame-domain.patch
T

435 lines
20 KiB
Diff
Raw Permalink Blame History

From: uazo <uazo@users.noreply.github.com>
Date: Mon, 9 Jan 2023 12:02:05 +0000
Subject: Partitioning all cookies by top frame domain
Enables cookie partitioning by top frame etld, respecting the
user's possible wish to disable all third-party cookies.
Disabling the flag via the ui restores the normal mode, where
samesite=none first-party cookies are sent in third-party contexts.
License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
---
.../browser/chrome_content_browser_client.cc | 2 +-
.../net/profile_network_context_service.cc | 12 ++---
.../privacy_sandbox_settings_delegate.cc | 1 +
.../experiment/experiment_manager_impl.cc | 1 +
.../core/browser/cookie_settings.cc | 2 +
.../core/common/cookie_settings_base.cc | 47 -------------------
...ioning-all-cookies-by-top-frame-domain.inc | 3 ++
...ioning-all-cookies-by-top-frame-domain.inc | 2 +
...ioning-all-cookies-by-top-frame-domain.inc | 1 +
...ioning-all-cookies-by-top-frame-domain.inc | 10 ++++
net/cookies/canonical_cookie.cc | 12 +----
net/cookies/cookie_deletion_info.cc | 3 +-
net/cookies/parsed_cookie.h | 7 ++-
.../sqlite/sqlite_persistent_cookie_store.cc | 10 ++++
net/url_request/url_request_http_job.cc | 10 ++--
services/network/cookie_settings.cc | 5 +-
services/network/restricted_cookie_manager.cc | 6 +++
.../modules/cookie_store/cookie_init.idl | 2 +-
.../modules/cookie_store/cookie_store.cc | 12 +++++
.../cookie_store_delete_options.idl | 2 +-
ui/webui/webui_allowlist.cc | 1 +
21 files changed, 72 insertions(+), 79 deletions(-)
create mode 100644 cromite_flags/components/content_settings/core/common/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
create mode 100644 cromite_flags/components/permissions/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
create mode 100644 cromite_flags/content/public/common/content_features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
create mode 100644 cromite_flags/net/base/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -3399,7 +3399,7 @@ bool ChromeContentBrowserClient::IsFullCookieAccessAllowed(
scoped_refptr<content_settings::CookieSettings> cookie_settings =
CookieSettingsFactory::GetForProfile(profile);
if (!cookie_settings) {
- return true;
+ return false;
}
return cookie_settings->IsFullCookieAccessAllowed(
url, storage_key.ToNetSiteForCookies(),
diff --git a/chrome/browser/net/profile_network_context_service.cc b/chrome/browser/net/profile_network_context_service.cc
--- a/chrome/browser/net/profile_network_context_service.cc
+++ b/chrome/browser/net/profile_network_context_service.cc
@@ -659,16 +659,16 @@ ProfileNetworkContextService::CreateCookieManagerParams(
// UI to interact with SameSite cookies on accounts.google.com, which is used
// for displaying a list of available accounts on the NTP
// (chrome://new-tab-page), etc.
- out->secure_origin_cookies_allowed_schemes.push_back(
- content::kChromeUIScheme);
+ // out->secure_origin_cookies_allowed_schemes.push_back(
+ // content::kChromeUIScheme);
#if BUILDFLAG(ENABLE_EXTENSIONS)
// TODO(chlily): To be consistent with the content_settings version of
// CookieSettings, we should probably also add kExtensionScheme to the list of
// matching_scheme_cookies_allowed_schemes.
- out->third_party_cookies_allowed_schemes.push_back(
- extensions::kExtensionScheme);
- out->third_party_cookies_allowed_schemes.push_back(
- content::kChromeDevToolsScheme);
+ // out->third_party_cookies_allowed_schemes.push_back(
+ // extensions::kExtensionScheme);
+ // out->third_party_cookies_allowed_schemes.push_back(
+ // content::kChromeDevToolsScheme);
#endif
HostContentSettingsMap* host_content_settings_map =
diff --git a/chrome/browser/privacy_sandbox/privacy_sandbox_settings_delegate.cc b/chrome/browser/privacy_sandbox/privacy_sandbox_settings_delegate.cc
--- a/chrome/browser/privacy_sandbox/privacy_sandbox_settings_delegate.cc
+++ b/chrome/browser/privacy_sandbox/privacy_sandbox_settings_delegate.cc
@@ -358,6 +358,7 @@ bool PrivacySandboxSettingsDelegate::IsCookieDeprecationLabelAllowed() const {
bool PrivacySandboxSettingsDelegate::
AreThirdPartyCookiesBlockedByCookieDeprecationExperiment() const {
+ if ((true)) return false;
if (net::cookie_util::IsForceThirdPartyCookieBlockingEnabled()) {
return false;
}
diff --git a/chrome/browser/tpcd/experiment/experiment_manager_impl.cc b/chrome/browser/tpcd/experiment/experiment_manager_impl.cc
--- a/chrome/browser/tpcd/experiment/experiment_manager_impl.cc
+++ b/chrome/browser/tpcd/experiment/experiment_manager_impl.cc
@@ -177,6 +177,7 @@ void ExperimentManagerImpl::MaybeUpdateSyntheticTrialRegistration() {
}
std::optional<bool> ExperimentManagerImpl::IsClientEligible() const {
+ if ((true)) return std::nullopt;
if (kForceEligibleForTesting.Get()) {
return true;
}
diff --git a/components/content_settings/core/browser/cookie_settings.cc b/components/content_settings/core/browser/cookie_settings.cc
--- a/components/content_settings/core/browser/cookie_settings.cc
+++ b/components/content_settings/core/browser/cookie_settings.cc
@@ -155,6 +155,7 @@ void CookieSettings::SetTemporaryCookieGrantForHeuristic(
const GURL& first_party_url,
base::TimeDelta ttl,
bool use_schemeless_patterns) {
+ if ((true)) return;
if (url.is_empty() || first_party_url.is_empty()) {
return;
}
@@ -425,6 +426,7 @@ bool CookieSettings::MitigationsEnabledFor3pcdInternal() {
return !tracking_protection_settings_->AreAllThirdPartyCookiesBlocked();
}
+ if ((true)) return false;
if (net::cookie_util::IsForceThirdPartyCookieBlockingEnabled()) {
return true;
}
diff --git a/components/content_settings/core/common/cookie_settings_base.cc b/components/content_settings/core/common/cookie_settings_base.cc
--- a/components/content_settings/core/common/cookie_settings_base.cc
+++ b/components/content_settings/core/common/cookie_settings_base.cc
@@ -38,16 +38,6 @@ using net::cookie_util::StorageAccessResult;
using ThirdPartyCookieAllowMechanism =
CookieSettingsBase::ThirdPartyCookieAllowMechanism;
-bool IsAllowedByCORS(const net::CookieSettingOverrides& overrides,
- const GURL& request_url,
- const GURL& first_party_url) {
- return overrides.Has(
- net::CookieSettingOverride::kCrossSiteCredentialedWithCORS) &&
- base::FeatureList::IsEnabled(
- net::features::kThirdPartyCookieTopLevelSiteCorsException) &&
- net::SchemefulSite(request_url) == net::SchemefulSite(first_party_url);
-}
-
constexpr StorageAccessResult GetStorageAccessResult(
ThirdPartyCookieAllowMechanism mechanism) {
switch (mechanism) {
@@ -473,48 +463,11 @@ CookieSettingsBase::DecideAccess(const GURL& url,
if (!is_third_party_request) {
return AllowAllCookies{ThirdPartyCookieAllowMechanism::kNone};
}
- if (!ShouldBlockThirdPartyCookies()) {
- return AllowAllCookies{
- ThirdPartyCookieAllowMechanism::kAllowByGlobalSetting};
- }
- if (IsThirdPartyCookiesAllowedScheme(first_party_url.scheme())) {
- return AllowAllCookies{ThirdPartyCookieAllowMechanism::kNone};
- }
- if (IsAllowedBy3pcdTrialSettings(url, first_party_url, overrides)) {
- return AllowAllCookies{ThirdPartyCookieAllowMechanism::kAllowBy3PCD};
- }
- if (IsAllowedByTopLevel3pcdTrialSettings(first_party_url, overrides)) {
- return AllowAllCookies{
- ThirdPartyCookieAllowMechanism::kAllowByTopLevel3PCD};
- }
- if (IsAllowedBy3pcdHeuristicsGrantsSettings(url, first_party_url,
- overrides)) {
- return AllowAllCookies{
- ThirdPartyCookieAllowMechanism::kAllowBy3PCDHeuristics};
- }
- if (IsAllowedByCORS(overrides, url, first_party_url)) {
- return AllowAllCookies{
- ThirdPartyCookieAllowMechanism::kAllowByCORSException};
- }
-
- if (IsAllowedByTopLevelStorageAccessGrant(url, first_party_url, overrides)) {
- return AllowAllCookies{
- ThirdPartyCookieAllowMechanism::kAllowByTopLevelStorageAccess};
- }
if (IsAllowedByStorageAccessGrant(url, first_party_url, overrides)) {
return AllowAllCookies{
ThirdPartyCookieAllowMechanism::kAllowByStorageAccess};
}
- SettingInfo info;
- // Sets the 3PCD Metadata Grants last, to prioritize grants from other
- // mitigations and access protocols.
- if (IsAllowedBy3pcdMetadataGrantsSettings(url, first_party_url, overrides,
- &info)) {
- return AllowAllCookies{TpcdMetadataSourceToAllowMechanism(
- info.metadata.tpcd_metadata_rule_source())};
- }
-
return AllowPartitionedCookies{};
}
diff --git a/cromite_flags/components/content_settings/core/common/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc b/cromite_flags/components/content_settings/core/common/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/components/content_settings/core/common/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
@@ -0,0 +1,3 @@
+SET_CROMITE_FEATURE_DISABLED(kTrackingProtection3pcd);
+SET_CROMITE_FEATURE_DISABLED(kUserBypassUI);
+SET_CROMITE_FEATURE_DISABLED(kTpcdHeuristicsGrants);
diff --git a/cromite_flags/components/permissions/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc b/cromite_flags/components/permissions/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/components/permissions/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
@@ -0,0 +1,2 @@
+SET_CROMITE_FEATURE_DISABLED(kPermissionStorageAccessAPI);
+SET_CROMITE_FEATURE_ENABLED(kShowRelatedWebsiteSetsPermissionGrants);
diff --git a/cromite_flags/content/public/common/content_features_cc/Partitioning-all-cookies-by-top-frame-domain.inc b/cromite_flags/content/public/common/content_features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/content/public/common/content_features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
@@ -0,0 +1 @@
+SET_CROMITE_FEATURE_DISABLED(kCookieDeprecationFacilitatedTesting);
diff --git a/cromite_flags/net/base/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc b/cromite_flags/net/base/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/net/base/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
@@ -0,0 +1,10 @@
+SET_CROMITE_FEATURE_ENABLED(kPartitionedCookies);
+SET_CROMITE_FEATURE_ENABLED(kCookieDomainRejectNonASCII);
+
+SET_CROMITE_FEATURE_DISABLED(kForceThirdPartyCookieBlocking);
+SET_CROMITE_FEATURE_DISABLED(kThirdPartyPartitionedStorageAllowedByDefault);
+
+SET_CROMITE_FEATURE_ENABLED(kCookieSameSiteConsidersRedirectChain);
+SET_CROMITE_FEATURE_ENABLED(kSchemefulSameSite);
+SET_CROMITE_FEATURE_ENABLED(kSameSiteDefaultChecksMethodRigorously);
+SET_CROMITE_FEATURE_ENABLED(kTimeLimitedInsecureCookies);
diff --git a/net/cookies/canonical_cookie.cc b/net/cookies/canonical_cookie.cc
--- a/net/cookies/canonical_cookie.cc
+++ b/net/cookies/canonical_cookie.cc
@@ -1542,8 +1542,6 @@ bool CanonicalCookie::IsCanonicalForFromStorage() const {
if (IsPartitioned()) {
if (CookiePartitionKey::HasNonce(partition_key_))
return true;
- if (!secure_)
- return false;
}
return true;
@@ -1801,15 +1799,7 @@ bool CanonicalCookie::IsCookiePartitionedValid(const GURL& url,
bool secure,
bool is_partitioned,
bool partition_has_nonce) {
- if (!is_partitioned)
- return true;
- if (partition_has_nonce)
- return true;
- CookieAccessScheme scheme = cookie_util::ProvisionalAccessScheme(url);
- bool result = (scheme != CookieAccessScheme::kNonCryptographic) && secure;
- DLOG_IF(WARNING, !result)
- << "CanonicalCookie has invalid Partitioned attribute";
- return result;
+ return true;
}
CookieAndLineWithAccessResult::CookieAndLineWithAccessResult() = default;
diff --git a/net/cookies/cookie_deletion_info.cc b/net/cookies/cookie_deletion_info.cc
--- a/net/cookies/cookie_deletion_info.cc
+++ b/net/cookies/cookie_deletion_info.cc
@@ -131,7 +131,8 @@ bool CookieDeletionInfo::Matches(const CanonicalCookie& cookie,
return false;
}
- if (cookie.IsPartitioned() &&
+ // opened bug https://bugs.chromium.org/p/chromium/issues/detail?id=1405772
+ if (cookie.IsPartitioned() && !cookie_partition_key_collection.IsEmpty() &&
!cookie_partition_key_collection.Contains(*cookie.PartitionKey())) {
return false;
}
diff --git a/net/cookies/parsed_cookie.h b/net/cookies/parsed_cookie.h
--- a/net/cookies/parsed_cookie.h
+++ b/net/cookies/parsed_cookie.h
@@ -11,6 +11,7 @@
#include <utility>
#include <vector>
+#include "net/base/features.h"
#include "net/base/net_export.h"
#include "net/cookies/cookie_constants.h"
@@ -85,7 +86,11 @@ class NET_EXPORT ParsedCookie {
CookieSameSite SameSite(
CookieSameSiteString* samesite_string = nullptr) const;
CookiePriority Priority() const;
- bool IsPartitioned() const { return partitioned_index_ != 0; }
+ bool IsPartitioned() const {
+ if (base::FeatureList::IsEnabled(net::features::kPartitionedCookies))
+ return true;
+ return partitioned_index_ != 0;
+ }
bool HasInternalHtab() const { return internal_htab_; }
TruncatingCharacterInCookieStringType
GetTruncatingCharacterInCookieStringType() const {
diff --git a/net/extras/sqlite/sqlite_persistent_cookie_store.cc b/net/extras/sqlite/sqlite_persistent_cookie_store.cc
--- a/net/extras/sqlite/sqlite_persistent_cookie_store.cc
+++ b/net/extras/sqlite/sqlite_persistent_cookie_store.cc
@@ -750,6 +750,16 @@ bool SQLitePersistentCookieStore::Backend::DoInitializeDatabase() {
if (!restore_old_session_cookies_)
DeleteSessionCookiesOnStartup();
+ // Since there is no automatic transition to partitioned cookies
+ // (the information would be missing), we clean the current ones
+ // present because they would otherwise be sent in third-party contexts
+ // even if the flag is active.
+ if (base::FeatureList::IsEnabled(features::kPartitionedCookies)) {
+ if (!db()->Execute("DELETE FROM cookies WHERE top_frame_site_key = ''")) {
+ LOG(WARNING) << "Unable to delete unpartitioned cookies.";
+ }
+ }
+
return true;
}
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -776,13 +776,9 @@ void URLRequestHttpJob::SetCookieHeaderAndStart(
AnnotateAndMoveUserBlockedCookies(maybe_included_cookies, excluded_cookies);
}
- const bool cookie_deprecation_testing_enabled =
- request_->context()->cookie_deprecation_label().has_value();
- const bool cookie_deprecation_testing_has_label =
- cookie_deprecation_testing_enabled &&
- !request_->context()->cookie_deprecation_label().value().empty();
- bool may_set_sec_cookie_deprecation_header =
- cookie_deprecation_testing_has_label;
+ const bool cookie_deprecation_testing_enabled = false;
+ const bool cookie_deprecation_testing_has_label = false;
+ bool may_set_sec_cookie_deprecation_header = false;
if (!maybe_included_cookies.empty()) {
std::string cookie_line =
diff --git a/services/network/cookie_settings.cc b/services/network/cookie_settings.cc
--- a/services/network/cookie_settings.cc
+++ b/services/network/cookie_settings.cc
@@ -43,7 +43,7 @@ bool AffectedByThirdPartyCookiePhaseout(
const bool is_third_party_request,
const bool is_cookie_partitioned) {
return cookie_same_site == net::CookieSameSite::NO_RESTRICTION &&
- is_third_party_request && !is_cookie_partitioned;
+ is_third_party_request;
}
bool IsValidType(ContentSettingsType type) {
@@ -117,8 +117,7 @@ bool IsOriginOpaqueHttpOrHttps(const url::Origin* top_frame_origin) {
// static
bool CookieSettings::IsCookieAllowed(const net::CanonicalCookie& cookie,
const CookieSettingWithMetadata& setting) {
- return IsAllowed(setting.cookie_setting()) ||
- (cookie.IsPartitioned() && setting.allow_partitioned_cookies());
+ return IsAllowed(setting.cookie_setting());
}
// static
diff --git a/services/network/restricted_cookie_manager.cc b/services/network/restricted_cookie_manager.cc
--- a/services/network/restricted_cookie_manager.cc
+++ b/services/network/restricted_cookie_manager.cc
@@ -961,6 +961,12 @@ void RestrictedCookieManager::SetCookieFromString(
std::move(callback).Run();
+ // https://bugs.chromium.org/p/chromium/issues/detail?id=911299
+ bool site_for_cookies_ok =
+ BoundSiteForCookies().IsEquivalent(site_for_cookies);
+ bool top_frame_origin_ok = top_frame_origin == BoundTopFrameOrigin();
+ if (!site_for_cookies_ok || !top_frame_origin_ok) return;
+
net::CookieInclusionStatus status;
std::unique_ptr<net::CanonicalCookie> parsed_cookie =
net::CanonicalCookie::Create(
diff --git a/third_party/blink/renderer/modules/cookie_store/cookie_init.idl b/third_party/blink/renderer/modules/cookie_store/cookie_init.idl
--- a/third_party/blink/renderer/modules/cookie_store/cookie_init.idl
+++ b/third_party/blink/renderer/modules/cookie_store/cookie_init.idl
@@ -17,5 +17,5 @@ dictionary CookieInit {
USVString path = "/";
DOMHighResTimeStamp? expires = null;
CookieSameSite sameSite = "strict";
- [RuntimeEnabled=PartitionedCookies] boolean partitioned = false;
+ [RuntimeEnabled=PartitionedCookies] boolean partitioned = true;
};
diff --git a/third_party/blink/renderer/modules/cookie_store/cookie_store.cc b/third_party/blink/renderer/modules/cookie_store/cookie_store.cc
--- a/third_party/blink/renderer/modules/cookie_store/cookie_store.cc
+++ b/third_party/blink/renderer/modules/cookie_store/cookie_store.cc
@@ -340,6 +340,10 @@ ScriptPromise CookieStore::set(ScriptState* script_state,
CookieInit* set_options = CookieInit::Create();
set_options->setName(name);
set_options->setValue(value);
+ if (RuntimeEnabledFeatures::PartitionedCookiesEnabled(
+ CurrentExecutionContext(script_state->GetIsolate()))) {
+ set_options->setPartitioned(true);
+ }
return set(script_state, set_options, exception_state);
}
@@ -362,6 +366,10 @@ ScriptPromise CookieStore::Delete(ScriptState* script_state,
set_options->setName(name);
set_options->setValue("deleted");
set_options->setExpires(0);
+ if (RuntimeEnabledFeatures::PartitionedCookiesEnabled(
+ CurrentExecutionContext(script_state->GetIsolate()))) {
+ set_options->setPartitioned(true);
+ }
return DoWrite(script_state, set_options, exception_state);
}
@@ -376,6 +384,10 @@ ScriptPromise CookieStore::Delete(ScriptState* script_state,
set_options->setPath(options->path());
set_options->setSameSite("strict");
set_options->setPartitioned(options->partitioned());
+ if (RuntimeEnabledFeatures::PartitionedCookiesEnabled(
+ CurrentExecutionContext(script_state->GetIsolate()))) {
+ set_options->setPartitioned(true);
+ }
return DoWrite(script_state, set_options, exception_state);
}
diff --git a/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl b/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl
--- a/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl
+++ b/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl
@@ -8,5 +8,5 @@ dictionary CookieStoreDeleteOptions {
required USVString name;
USVString? domain = null;
USVString path = "/";
- [RuntimeEnabled=PartitionedCookies] boolean partitioned = false;
+ [RuntimeEnabled=PartitionedCookies] boolean partitioned = true;
};
diff --git a/ui/webui/webui_allowlist.cc b/ui/webui/webui_allowlist.cc
--- a/ui/webui/webui_allowlist.cc
+++ b/ui/webui/webui_allowlist.cc
@@ -75,6 +75,7 @@ void WebUIAllowlist::RegisterAutoGrantedPermissions(
void WebUIAllowlist::RegisterAutoGrantedThirdPartyCookies(
const url::Origin& top_level_origin,
const std::vector<ContentSettingsPattern>& origin_patterns) {
+ if ((true)) return;
DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
--
Reference in New Issue View Git Blame Copy Permalink