77 lines
3.4 KiB
Diff
77 lines
3.4 KiB
Diff
From: uazo <uazo@users.noreply.github.com>
|
|
Date: Thu, 23 Jan 2025 17:01:50 +0000
|
|
Subject: PublicKeyCredential fingerprinting mitigations
|
|
|
|
Removes the possibility of obtaining the presence of Windows Hello and
|
|
Bluetooth by querying the PublicKeyCredential of the webauth api in
|
|
the Windows platform
|
|
---
|
|
.../webauth/authenticator_common_impl.cc | 22 +++++++++++++++++++
|
|
.../webauth/authenticator_common_impl.h | 2 +-
|
|
2 files changed, 23 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/content/browser/webauth/authenticator_common_impl.cc b/content/browser/webauth/authenticator_common_impl.cc
|
|
--- a/content/browser/webauth/authenticator_common_impl.cc
|
|
+++ b/content/browser/webauth/authenticator_common_impl.cc
|
|
@@ -1845,6 +1845,7 @@ void AuthenticatorCommonImpl::GetClientCapabilities(
|
|
base::FeatureList::IsEnabled(device::kWebAuthnPasskeyUpgrade)));
|
|
|
|
IsHybridTransportSupported(
|
|
+ caller_origin,
|
|
base::BindOnce(&MakeCapability, client_capabilities::kHybridTransport)
|
|
.Then(barrier_callback));
|
|
|
|
@@ -1865,11 +1866,25 @@ void AuthenticatorCommonImpl::GetClientCapabilities(
|
|
}
|
|
|
|
void AuthenticatorCommonImpl::IsHybridTransportSupported(
|
|
+ const url::Origin& caller_origin,
|
|
base::OnceCallback<void(bool)> callback) {
|
|
if (!device::BluetoothAdapterFactory::Get()->IsLowEnergySupported()) {
|
|
std::move(callback).Run(false);
|
|
return;
|
|
}
|
|
+ const url::Origin& embedding_origin =
|
|
+ GetRenderFrameHost()->GetMainFrame()->GetLastCommittedOrigin();
|
|
+
|
|
+ switch (GetContentClient()->browser()->AllowWebBluetooth(
|
|
+ GetBrowserContext(), caller_origin,
|
|
+ embedding_origin)) {
|
|
+ case ContentBrowserClient::AllowWebBluetoothResult::BLOCK_POLICY:
|
|
+ case ContentBrowserClient::AllowWebBluetoothResult::BLOCK_GLOBALLY_DISABLED:
|
|
+ std::move(callback).Run(false);
|
|
+ return;
|
|
+ case ContentBrowserClient::AllowWebBluetoothResult::ALLOW:
|
|
+ break;
|
|
+ }
|
|
|
|
device::BluetoothAdapterFactory::Get()->GetAdapter(
|
|
base::BindOnce([](scoped_refptr<device::BluetoothAdapter> adapter) {
|
|
@@ -1915,6 +1930,13 @@ void AuthenticatorCommonImpl::ContinueIsUvpaaAfterOverrideCheck(
|
|
IsUserVerifyingPlatformAuthenticatorAvailableCallback callback,
|
|
bool is_get_client_capabilities_call,
|
|
std::optional<bool> is_uvpaa_override) {
|
|
+#if BUILDFLAG(IS_WIN)
|
|
+ if ((true)) {
|
|
+ // always expose Windows Hello active, even if it is not
|
|
+ std::move(callback).Run(true);
|
|
+ return;
|
|
+ }
|
|
+#endif
|
|
if (is_uvpaa_override) {
|
|
std::move(callback).Run(*is_uvpaa_override);
|
|
return;
|
|
diff --git a/content/browser/webauth/authenticator_common_impl.h b/content/browser/webauth/authenticator_common_impl.h
|
|
--- a/content/browser/webauth/authenticator_common_impl.h
|
|
+++ b/content/browser/webauth/authenticator_common_impl.h
|
|
@@ -254,7 +254,7 @@ class CONTENT_EXPORT AuthenticatorCommonImpl : public AuthenticatorCommon {
|
|
// Bluetooth adapter that supports BLE. If so, runs |callback| with `true`.
|
|
// Otherwise, or if Bluetooth is disabled by Permissions Policy, runs
|
|
// |callback| with `false`.
|
|
- void IsHybridTransportSupported(base::OnceCallback<void(bool)> callback);
|
|
+ void IsHybridTransportSupported(const url::Origin& caller_origin, base::OnceCallback<void(bool)> callback);
|
|
|
|
// `is_get_client_capabilities_call` is true if this call originated from the
|
|
// `GetClientCapabilities` method. The UMA metric is only recorded if this is
|
|
--
|