PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
create-pull-request/patch-cdf415c
cromite/build/patches/Private-network-access-content-settings.patch
T

288 lines
14 KiB
Diff
Raw Permalink Blame History

From: uazo <uazo@users.noreply.github.com>
Date: Wed, 17 Apr 2024 18:45:54 +0000
Subject: Private network access content settings
Block access to the local network by default in android while allowing
user choice in desktop platforms.
License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
---
.../browser/chrome_content_browser_client.cc | 36 ++++++-
...eInsecurePrivateNetworkContentSetting.java | 93 +++++++++++++++++++
.../insecure_private_network.grdp | 18 ++++
.../insecure_private_network.inc | 25 +++++
.../INSECURE_PRIVATE_NETWORK.inc | 3 +
.../local_network_access_util.cc | 6 +-
...rivate-network-access-content-settings.inc | 2 +
services/network/public/cpp/features.cc | 2 +-
8 files changed, 178 insertions(+), 7 deletions(-)
create mode 100644 components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteInsecurePrivateNetworkContentSetting.java
create mode 100644 components/browser_ui/strings/bromite_content_settings/insecure_private_network.grdp
create mode 100644 components/content_settings/core/browser/bromite_content_settings/insecure_private_network.inc
create mode 100644 components/content_settings/core/common/bromite_content_settings/INSECURE_PRIVATE_NETWORK.inc
create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Private-network-access-content-settings.inc
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -4208,6 +4208,31 @@ bool ShouldPromptOnMultipleMatchingCertificates(const Profile* profile) {
return false;
}
+bool ShouldAllowInsecurePrivateNetworkRequests(
+ const HostContentSettingsMap* map,
+ const url::Origin& origin) {
+ // Derive the base URL from the origin, since HostContentSettingsMap is keyed
+ // by URL and not by origin. However, this setting is conceptually keyed by
+ // origin, hence its public API uses url::Origin.
+ //
+ // This returns the default-constructed GURL for opaque origins, which should
+ // not match any content settings.
+ const GURL url = origin.GetURL();
+
+ const ContentSetting setting = map->GetContentSetting(
+ url, url, ContentSettingsType::INSECURE_PRIVATE_NETWORK);
+
+ switch (setting) {
+ case CONTENT_SETTING_ALLOW:
+ return true;
+ case CONTENT_SETTING_BLOCK:
+ return false;
+ default:
+ NOTREACHED()
+ << "Invalid content setting for insecure private network requests: "
+ << setting;
+ }
+}
} // namespace
base::OnceClosure ChromeContentBrowserClient::SelectClientCertificate(
@@ -7870,12 +7895,17 @@ content::ContentBrowserClient::LocalNetworkAccessRequestPolicyOverride
ChromeContentBrowserClient::ShouldOverrideLocalNetworkAccessRequestPolicy(
content::BrowserContext* browser_context,
const url::Origin& origin) {
-#if BUILDFLAG(IS_ANDROID)
- if (base::android::device_info::is_automotive()) {
+ if (HostContentSettingsMap* service =
+ HostContentSettingsMapFactory::GetForProfile(browser_context)) {
+ if (ShouldAllowInsecurePrivateNetworkRequests(service, origin)) {
+ return content::ContentBrowserClient::
+ LocalNetworkAccessRequestPolicyOverride::kForceAllow;
+ }
+ }
+ if ((true)) {
return content::ContentBrowserClient::
LocalNetworkAccessRequestPolicyOverride::kBlockInsteadOfWarn;
}
-#endif
Profile* profile = Profile::FromBrowserContext(browser_context);
diff --git a/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteInsecurePrivateNetworkContentSetting.java b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteInsecurePrivateNetworkContentSetting.java
new file mode 100644
--- /dev/null
+++ b/components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteInsecurePrivateNetworkContentSetting.java
@@ -0,0 +1,93 @@
+/*
+ This file is part of Bromite.
+
+ Bromite is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ Bromite is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with Bromite. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+package org.chromium.components.browser_ui.site_settings.impl;
+
+import org.chromium.components.browser_ui.site_settings.R;
+
+import org.chromium.components.browser_ui.site_settings.BromiteCustomContentSetting;
+import org.chromium.components.browser_ui.site_settings.ContentSettingsResources;
+import org.chromium.components.browser_ui.site_settings.SiteSettingsCategory;
+import org.chromium.components.content_settings.ContentSetting;
+import org.chromium.components.content_settings.ContentSettingsType;
+import org.chromium.content_public.browser.BrowserContextHandle;
+
+import androidx.annotation.Nullable;
+import androidx.preference.Preference;
+import androidx.preference.PreferenceScreen;
+
+import java.util.ArrayList;
+
+public class BromiteInsecurePrivateNetworkContentSetting extends BromiteCustomContentSetting {
+ public BromiteInsecurePrivateNetworkContentSetting() {
+ super(/*contentSettingsType*/ ContentSettingsType.INSECURE_PRIVATE_NETWORK,
+ /*defaultEnabledValue*/ ContentSetting.ALLOW,
+ /*defaultDisabledValue*/ ContentSetting.BLOCK,
+ /*allowException*/ true,
+ /*preferenceKey*/ "insecure_private_network",
+ /*profilePrefKey*/ "insecure_private_network");
+ }
+
+ @Override
+ public ContentSettingsResources.ResourceItem getResourceItem() {
+ return new ContentSettingsResources.ResourceItem(
+ /*icon*/ R.drawable.web_asset,
+ /*title*/ R.string.insecure_private_network_permission_title,
+ /*defaultEnabledValue*/ getDefaultEnabledValue(),
+ /*defaultDisabledValue*/ getDefaultDisabledValue(),
+ /*enabledSummary*/ R.string.website_settings_category_insecure_private_network_allowed,
+ /*disabledSummary*/ R.string.website_settings_category_insecure_private_network_blocked,
+ /*summaryOverrideForScreenReader*/ 0);
+ }
+
+ @Override
+ public int getCategorySummary(@Nullable @ContentSetting int value) {
+ switch (value) {
+ case ContentSetting.ALLOW:
+ return R.string.website_settings_category_insecure_private_network_allowed;
+ case ContentSetting.BLOCK:
+ return R.string.website_settings_category_insecure_private_network_blocked;
+ default:
+ return 0;
+ }
+ }
+
+ @Override
+ public int getCategoryDescription() {
+ return R.string.settings_site_settings_insecure_private_network_description;
+ }
+
+ @Override
+ public boolean requiresTriStateContentSetting() {
+ return false;
+ }
+
+ @Override
+ public boolean showOnlyDescriptions() {
+ return true;
+ }
+
+ @Override
+ public int getAddExceptionDialogMessage() {
+ return R.string.website_settings_category_insecure_private_network_allowed;
+ }
+
+ @Override
+ public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSetting int value) {
+ return value != ContentSetting.BLOCK;
+ }
+}
diff --git a/components/browser_ui/strings/bromite_content_settings/insecure_private_network.grdp b/components/browser_ui/strings/bromite_content_settings/insecure_private_network.grdp
new file mode 100644
--- /dev/null
+++ b/components/browser_ui/strings/bromite_content_settings/insecure_private_network.grdp
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<grit-part>
+ <message name="IDS_INSECURE_PRIVATE_NETWORK_PERMISSION_TITLE" desc="" formatter_data="android_java">
+ Access to Private Network
+ </message>
+ <message name="IDS_SETTINGS_SITE_SETTINGS_INSECURE_PRIVATE_NETWORK_DESCRIPTION" desc="" formatter_data="android_java">
+ Enable access to private network
+ </message>
+ <message name="IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ALLOWED" desc="" formatter_data="android_java">
+ Allow access to private network
+ </message>
+ <message name="IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_BLOCKED" desc="" formatter_data="android_java">
+ Block access to private network
+ </message>
+ <message name="IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ASK" desc="" formatter_data="android_java">
+ Ask access to private network
+ </message>
+</grit-part>
diff --git a/components/content_settings/core/browser/bromite_content_settings/insecure_private_network.inc b/components/content_settings/core/browser/bromite_content_settings/insecure_private_network.inc
new file mode 100644
--- /dev/null
+++ b/components/content_settings/core/browser/bromite_content_settings/insecure_private_network.inc
@@ -0,0 +1,25 @@
+ Register(ContentSettingsType::INSECURE_PRIVATE_NETWORK,
+ "insecure-private-network", CONTENT_SETTING_BLOCK,
+ WebsiteSettingsInfo::UNSYNCABLE, /*allowlisted_primary_schemes=*/{},
+ /*valid_settings=*/{CONTENT_SETTING_ALLOW, CONTENT_SETTING_BLOCK},
+ WebsiteSettingsInfo::REQUESTING_ORIGIN_ONLY_SCOPE,
+ WebsiteSettingsRegistry::ALL_PLATFORMS,
+ ContentSettingsInfo::INHERIT_IN_INCOGNITO,
+ PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
+
+ content_settings::WebsiteSettingsRegistry::GetInstance()
+ ->GetMutable(ContentSettingsType::INSECURE_PRIVATE_NETWORK)
+ ->set_show_into_info_page()
+ .set_desktop_ui()
+ .set_title_ui(IDS_INSECURE_PRIVATE_NETWORK_PERMISSION_TITLE)
+ .set_description_ui(IDS_SETTINGS_SITE_SETTINGS_INSECURE_PRIVATE_NETWORK_DESCRIPTION)
+ .set_allowed_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ALLOWED)
+ .set_allowed_exceptions_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ALLOWED)
+#if BUILDFLAG(IS_ANDROID)
+ .set_blocked_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_BLOCKED)
+ .set_blocked_exceptions_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_BLOCKED)
+#else
+ .set_blocked_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ASK)
+ .set_blocked_exceptions_ui(IDS_WEBSITE_SETTINGS_CATEGORY_INSECURE_PRIVATE_NETWORK_ASK)
+#endif
+ .set_mid_sentence_ui(IDS_INSECURE_PRIVATE_NETWORK_PERMISSION_TITLE);
diff --git a/components/content_settings/core/common/bromite_content_settings/INSECURE_PRIVATE_NETWORK.inc b/components/content_settings/core/common/bromite_content_settings/INSECURE_PRIVATE_NETWORK.inc
new file mode 100644
--- /dev/null
+++ b/components/content_settings/core/common/bromite_content_settings/INSECURE_PRIVATE_NETWORK.inc
@@ -0,0 +1,3 @@
+ // Stores whether to allow insecure websites to make private network requests.
+ // See also: https://wicg.github.io/cors-rfc1918
+ INSECURE_PRIVATE_NETWORK,
diff --git a/content/browser/renderer_host/local_network_access_util.cc b/content/browser/renderer_host/local_network_access_util.cc
--- a/content/browser/renderer_host/local_network_access_util.cc
+++ b/content/browser/renderer_host/local_network_access_util.cc
@@ -121,13 +121,13 @@ Policy DerivePolicyForNonSecureContext(
// Requests from the `unknown` address space are controlled separately
// because it is unclear why they happen in the first place. The goal is
// to reduce instances of this happening before enabling this feature.
- return Policy::kAllow;
+ return Policy::kWarn;
case AddressSpace::kLocal:
// Requests from the non secure contexts in the `local` address space
// to localhost are blocked only if the right feature is enabled.
// This is controlled separately because private network websites face
// additional hurdles compared to public websites. See crbug.com/1234044.
- return Policy::kWarn;
+ return Policy::kBlock;
case AddressSpace::kPublic:
case AddressSpace::kLoopback:
// Private network requests from non secure contexts are blocked if the
@@ -137,7 +137,7 @@ Policy DerivePolicyForNonSecureContext(
// has no effect. Indeed, requests initiated from the local address space
// are never considered private network requests - they cannot target
// more-private address spaces.
- return Policy::kWarn;
+ return Policy::kBlock;
}
}
diff --git a/cromite_flags/services/network/public/cpp/features_cc/Private-network-access-content-settings.inc b/cromite_flags/services/network/public/cpp/features_cc/Private-network-access-content-settings.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/services/network/public/cpp/features_cc/Private-network-access-content-settings.inc
@@ -0,0 +1,2 @@
+SET_CROMITE_FEATURE_ENABLED(kLocalNetworkAccessChecks);
+SET_CROMITE_FEATURE_ENABLED(kLocalNetworkAccessChecksWebRTC);
diff --git a/services/network/public/cpp/features.cc b/services/network/public/cpp/features.cc
--- a/services/network/public/cpp/features.cc
+++ b/services/network/public/cpp/features.cc
@@ -241,7 +241,7 @@ BASE_FEATURE_PARAM(bool,
kLocalNetworkAccessChecksWarn,
&kLocalNetworkAccessChecks,
/*name=*/"LocalNetworkAccessChecksWarn",
- /*default_value=*/false);
+ /*default_value=*/false); // keep false
// Enables Local Network Access checks for WebRTC.
// Blocks local network requests without user permission to prevent exploitation
--
Reference in New Issue View Git Blame Copy Permalink