Merge branch 'master' into enable-update-notification

This commit is contained in:
uazo 2021-10-12 08:39:16 +02:00 committed by GitHub
commit 5dbc455710
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
19 changed files with 1012 additions and 83 deletions

View file

@ -1,3 +1,14 @@
# 93.0.4577.110
* set enable_reporting to false (thanks to @nikolowry)
* backported patches for security issues https://crbug.com/1245578 and https://crbug.com/1251787
* disable AGSA by default
* disable UA client hint for model
* disable lock icon in address bar by default
* enable share intent (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1062)
* allow forcing external links to open in incognito (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/728)
* avoid double restart for default tab groups flags status
# 93.0.4577.83
* dropped patch for FLoC (already disabled by upstream)
* dropped patch for build with system sysroots

View file

@ -85,6 +85,7 @@ ETH donations address: `0xf47ff39223d828f99fec5ab53bd068c5c0522042`
* disable video autoplay by default, reintroduce site settings
* mobile/desktop user agent customization
* accessibility preference to force tablet UI
* use Alt+D to focus address bar
You can inspect all functionality/privacy changes by reading the [patches](https://github.com/bromite/bromite/tree/master/build/patches) and/or the [CHANGELOG](./CHANGELOG.md).

View file

@ -1 +1 @@
93.0.4577.83
93.0.4577.110

View file

@ -29,7 +29,6 @@ ungoogled-chromium-Disable-Google-host-detection.patch
ungoogled-chromium-Disable-Gaia.patch
ungoogled-chromium-Disable-domain-reliability.patch
ungoogled-chromium-Disable-Network-Time-Tracker.patch
ungoogled-chromium-Fix-building-without-enabling-reporting.patch
Disable-safe-browsing.patch
Skip-the-first-run-and-metrics.patch
Disable-all-promo-dialogs.patch
@ -154,8 +153,15 @@ Logcat-crash-reports-UI.patch
Add-support-for-ISupportHelpAndFeedback.patch
JIT-less-toggle.patch
API-level-21-prevent-crash-on-download.patch
Add-vibration-flag.patch
Add-flag-to-disable-vibration.patch
mime_util-force-text-x-suse-ymp-to-be-downloaded.patch
Disable-UA-client-hint.patch
Enable-update-notification.patch
Disable-UA-client-hint-for-model.patch
Disable-AGSA-by-default.patch
Allow-building-without-enable_reporting.patch
Disable-lock-icon-in-address-bar-by-default.patch
Force-open-external-links-in-incognito.patch
Enable-share-intent.patch
Automated-domain-substitution.patch
Observe-WebContents-in-PPAPIDownloadRequest.patch
Prevents-non-browser-processes-from-requesting-memory-dumps.patch
Enable-update-notification.patch

View file

@ -1,6 +1,6 @@
From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Sun, 27 Jun 2021 17:35:39 +0200
Subject: Add vibration flag
Subject: Add flag to disable vibration
---
chrome/browser/about_flags.cc | 4 ++++

View file

@ -1,6 +1,19 @@
From: Zoraver Kang <Zoraver@users.noreply.github.com>
Date: Fri, 22 May 2020 22:43:27 -0400
Subject: Allow building without enable_reporting
---
content/browser/BUILD.gn | 8 ++++----
third_party/blink/renderer/core/frame/local_frame.cc | 5 +++++
third_party/blink/renderer/core/frame/local_frame.h | 7 +++++--
.../blink/renderer/core/frame/reporting_context.cc | 9 +++++++++
.../blink/renderer/core/frame/reporting_context.h | 7 +++++--
5 files changed, 28 insertions(+), 8 deletions(-)
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -1150,6 +1150,10 @@ source_set("browser") {
@@ -1227,6 +1227,10 @@ source_set("browser") {
"net/browser_online_state_observer.cc",
"net/browser_online_state_observer.h",
"net/cookie_store_factory.cc",
@ -11,7 +24,7 @@
"net/network_errors_listing_ui.cc",
"net/network_errors_listing_ui.h",
"net/network_quality_observer_impl.cc",
@@ -2796,10 +2800,6 @@ source_set("browser") {
@@ -2966,10 +2970,6 @@ source_set("browser") {
if (enable_reporting) {
sources += [
@ -22,17 +35,18 @@
"net/reporting_service_proxy.cc",
"net/reporting_service_proxy.h",
]
diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
--- a/third_party/blink/renderer/core/frame/local_frame.cc
+++ b/third_party/blink/renderer/core/frame/local_frame.cc
@@ -38,6 +38,7 @@
#include "base/unguessable_token.h"
@@ -39,6 +39,7 @@
#include "base/values.h"
#include "mojo/public/cpp/bindings/self_owned_receiver.h"
#include "mojo/public/cpp/system/message_pipe.h"
+#include "net/net_buildflags.h"
#include "services/data_decoder/public/mojom/resource_snapshot_for_web_bundle.mojom-blink.h"
#include "services/network/public/cpp/features.h"
#include "services/network/public/mojom/content_security_policy.mojom-blink.h"
@@ -551,7 +552,9 @@ void LocalFrame::Trace(Visitor* visitor)
@@ -423,7 +424,9 @@ void LocalFrame::Trace(Visitor* visitor) const {
visitor->Trace(raw_system_clipboard_);
visitor->Trace(virtual_keyboard_overlay_changed_observers_);
visitor->Trace(pause_handle_receivers_);
@ -42,7 +56,7 @@
#if defined(OS_MAC)
visitor->Trace(text_input_host_);
#endif
@@ -2273,6 +2276,7 @@ const base::UnguessableToken& LocalFrame
@@ -2308,6 +2311,7 @@ const base::UnguessableToken& LocalFrame::GetAgentClusterId() const {
return base::UnguessableToken::Null();
}
@ -50,7 +64,7 @@
mojom::blink::ReportingServiceProxy* LocalFrame::GetReportingService() {
if (!reporting_service_.is_bound()) {
GetBrowserInterfaceBroker().GetInterface(
@@ -2281,6 +2285,7 @@ mojom::blink::ReportingServiceProxy* Loc
@@ -2316,6 +2320,7 @@ mojom::blink::ReportingServiceProxy* LocalFrame::GetReportingService() {
}
return reporting_service_.get();
}
@ -58,17 +72,18 @@
// static
void LocalFrame::NotifyUserActivation(
diff --git a/third_party/blink/renderer/core/frame/local_frame.h b/third_party/blink/renderer/core/frame/local_frame.h
--- a/third_party/blink/renderer/core/frame/local_frame.h
+++ b/third_party/blink/renderer/core/frame/local_frame.h
@@ -38,6 +38,7 @@
@@ -36,6 +36,7 @@
#include "build/build_config.h"
#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
#include "mojo/public/cpp/bindings/pending_receiver.h"
#include "mojo/public/cpp/bindings/unique_receiver_set.h"
+#include "net/net_buildflags.h"
#include "third_party/blink/public/common/frame/transient_allow_fullscreen.h"
#include "third_party/blink/public/mojom/blob/blob_url_store.mojom-blink.h"
#include "third_party/blink/public/mojom/frame/back_forward_cache_controller.mojom-blink.h"
@@ -521,9 +522,9 @@ class CORE_EXPORT LocalFrame final
#include "services/network/public/mojom/fetch_api.mojom-blink-forward.h"
#include "third_party/blink/public/common/frame/frame_ad_evidence.h"
#include "third_party/blink/public/common/frame/payment_request_token.h"
@@ -545,9 +546,9 @@ class CORE_EXPORT LocalFrame final : public Frame,
}
SmoothScrollSequencer& GetSmoothScrollSequencer();
@ -80,18 +95,18 @@
// Returns the frame host ptr. The interface returned is backed by an
// associated interface with the legacy Chrome IPC channel.
mojom::blink::LocalFrameHost& GetLocalFrameHostRemote() const;
@@ -903,9 +904,11 @@ class CORE_EXPORT LocalFrame final
@@ -875,8 +876,10 @@ class CORE_EXPORT LocalFrame final : public Frame,
// const methods.
//
// LocalFrame can be reused by multiple ExecutionContext.
+#if BUILDFLAG(ENABLE_REPORTING)
mutable HeapMojoRemote<mojom::blink::ReportingServiceProxy,
HeapMojoWrapperMode::kWithoutContextObserver>
mutable HeapMojoRemote<mojom::blink::ReportingServiceProxy>
reporting_service_{nullptr};
+#endif
#if defined(OS_MAC)
// LocalFrame can be reused by multiple ExecutionContext.
diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_party/blink/renderer/core/frame/reporting_context.cc
--- a/third_party/blink/renderer/core/frame/reporting_context.cc
+++ b/third_party/blink/renderer/core/frame/reporting_context.cc
@@ -4,6 +4,7 @@
@ -102,7 +117,7 @@
#include "third_party/blink/public/common/browser_interface_broker_proxy.h"
#include "third_party/blink/public/platform/platform.h"
#include "third_party/blink/public/platform/task_type.h"
@@ -54,7 +55,9 @@ const char ReportingContext::kSupplement
@@ -54,7 +55,9 @@ const char ReportingContext::kSupplementName[] = "ReportingContext";
ReportingContext::ReportingContext(ExecutionContext& context)
: Supplement<ExecutionContext>(context),
execution_context_(context),
@ -112,7 +127,7 @@
receiver_(this, &context) {}
// static
@@ -118,7 +121,9 @@ void ReportingContext::Trace(Visitor* vi
@@ -118,7 +121,9 @@ void ReportingContext::Trace(Visitor* visitor) const {
visitor->Trace(observers_);
visitor->Trace(report_buffer_);
visitor->Trace(execution_context_);
@ -122,7 +137,7 @@
visitor->Trace(receiver_);
Supplement<ExecutionContext>::Trace(visitor);
}
@@ -140,6 +145,7 @@ void ReportingContext::CountReport(Repor
@@ -140,6 +145,7 @@ void ReportingContext::CountReport(Report* report) {
UseCounter::Count(execution_context_, feature);
}
@ -130,7 +145,7 @@
const HeapMojoRemote<mojom::blink::ReportingServiceProxy>&
ReportingContext::GetReportingService() const {
if (!reporting_service_.is_bound()) {
@@ -149,6 +155,7 @@ ReportingContext::GetReportingService()
@@ -149,6 +155,7 @@ ReportingContext::GetReportingService() const {
}
return reporting_service_;
}
@ -138,22 +153,23 @@
void ReportingContext::NotifyInternal(Report* report) {
// Buffer the report.
@@ -171,6 +178,7 @@ void ReportingContext::NotifyInternal(Re
@@ -171,6 +178,7 @@ void ReportingContext::NotifyInternal(Report* report) {
void ReportingContext::SendToReportingAPI(Report* report,
const String& endpoint) const {
+#if BUILDFLAG(ENABLE_REPORTING)
const String& type = report->type();
if (!(type == ReportType::kCSPViolation || type == ReportType::kDeprecation ||
type == ReportType::kFeaturePolicyViolation ||
@@ -227,6 +235,7 @@ void ReportingContext::SendToReportingAP
"Document policy violation", body->sourceFile(), line_number,
column_number);
type == ReportType::kPermissionsPolicyViolation ||
@@ -226,6 +234,7 @@ void ReportingContext::SendToReportingAPI(Report* report,
url, endpoint, body->featureId(), body->disposition(), body->message(),
body->sourceFile(), line_number, column_number);
}
+#endif
}
} // namespace blink
diff --git a/third_party/blink/renderer/core/frame/reporting_context.h b/third_party/blink/renderer/core/frame/reporting_context.h
--- a/third_party/blink/renderer/core/frame/reporting_context.h
+++ b/third_party/blink/renderer/core/frame/reporting_context.h
@@ -5,6 +5,7 @@
@ -164,7 +180,7 @@
#include "third_party/blink/public/mojom/frame/reporting_observer.mojom-blink.h"
#include "third_party/blink/public/mojom/reporting/reporting.mojom-blink.h"
#include "third_party/blink/renderer/core/core_export.h"
@@ -53,10 +54,10 @@ class CORE_EXPORT ReportingContext : pub
@@ -53,10 +54,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
private:
// Counts the use of a report type via UseCounter.
void CountReport(Report*);
@ -177,7 +193,7 @@
void NotifyInternal(Report* report);
// Send |report| via the Reporting API to |endpoint|.
void SendToReportingAPI(Report* report, const String& endpoint) const;
@@ -67,8 +68,10 @@ class CORE_EXPORT ReportingContext : pub
@@ -67,8 +68,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
// This is declared mutable so that the service endpoint can be cached by
// const methods.
@ -188,3 +204,6 @@
HeapMojoReceiver<mojom::blink::ReportingObserver, ReportingContext> receiver_;
};
--
2.17.1

View file

@ -30573,7 +30573,7 @@ diff --git a/third_party/blink/renderer/core/frame/deprecation.cc b/third_party/
diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
--- a/third_party/blink/renderer/core/frame/local_frame.cc
+++ b/third_party/blink/renderer/core/frame/local_frame.cc
@@ -1706,7 +1706,7 @@ static bool CanNavigateHelper(LocalFrame& initiating_frame,
@@ -1709,7 +1709,7 @@ static bool CanNavigateHelper(LocalFrame& initiating_frame,
"The frame attempting navigation of the top-level window is "
"sandboxed with the 'allow-top-navigation-by-user-activation' "
"flag, but has no user activation (aka gesture). See "
@ -30582,7 +30582,7 @@ diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/
}
return false;
}
@@ -1807,7 +1807,7 @@ static bool CanNavigateHelper(LocalFrame& initiating_frame,
@@ -1810,7 +1810,7 @@ static bool CanNavigateHelper(LocalFrame& initiating_frame,
"The frame attempting navigation is targeting its top-level window, "
"but is neither same-origin with its target nor has it received a "
"user gesture. See "

View file

@ -0,0 +1,36 @@
From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Sun, 26 Sep 2021 11:17:53 +0200
Subject: Disable AGSA by default
---
chrome/browser/flags/android/chrome_feature_list.cc | 2 +-
.../org/chromium/chrome/browser/flags/CachedFeatureFlags.java | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
--- a/chrome/browser/flags/android/chrome_feature_list.cc
+++ b/chrome/browser/flags/android/chrome_feature_list.cc
@@ -575,7 +575,7 @@ const base::Feature kEnhancedProtectionPromoCard{
"EnhancedProtectionPromoCard", base::FEATURE_DISABLED_BY_DEFAULT};
const base::Feature kExperimentsForAgsa{"ExperimentsForAgsa",
- base::FEATURE_ENABLED_BY_DEFAULT};
+ base::FEATURE_DISABLED_BY_DEFAULT};
const base::Feature kExploreSites{"ExploreSites",
base::FEATURE_DISABLED_BY_DEFAULT};
diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/CachedFeatureFlags.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/CachedFeatureFlags.java
--- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/CachedFeatureFlags.java
+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/CachedFeatureFlags.java
@@ -84,7 +84,7 @@ public class CachedFeatureFlags {
put(ChromeFeatureList.CCT_REMOVE_REMOTE_VIEW_IDS, true);
put(ChromeFeatureList.OFFLINE_MEASUREMENTS_BACKGROUND_TASK, false);
put(ChromeFeatureList.CCT_INCOGNITO, true);
- put(ChromeFeatureList.EXPERIMENTS_FOR_AGSA, true);
+ put(ChromeFeatureList.EXPERIMENTS_FOR_AGSA, false);
put(ChromeFeatureList.APP_MENU_MOBILE_SITE_OPTION, false);
put(ChromeFeatureList.CLIPBOARD_SUGGESTION_CONTENT_HIDDEN, false);
put(ChromeFeatureList.OPTIMIZATION_GUIDE_PUSH_NOTIFICATIONS, false);
--
2.17.1

View file

@ -0,0 +1,46 @@
From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Thu, 22 Jul 2021 23:10:52 +0200
Subject: Disable UA client hint for model
Disable permissions policy by default
---
content/public/common/content_features.cc | 2 +-
third_party/blink/common/client_hints/client_hints.cc | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
@@ -296,7 +296,7 @@ const base::Feature kExtraSafelistedRequestHeadersForOutOfBlinkCors{
// Controls whether Client Hints are guarded by Permissions Policy.
const base::Feature kFeaturePolicyForClientHints{
- "FeaturePolicyForClientHints", base::FEATURE_ENABLED_BY_DEFAULT};
+ "FeaturePolicyForClientHints", base::FEATURE_DISABLED_BY_DEFAULT};
// Enables the AccessHandle surface for File System Access API's Origin Private
// File System. Tracking bug: https://crbug.com/1218431.
diff --git a/third_party/blink/common/client_hints/client_hints.cc b/third_party/blink/common/client_hints/client_hints.cc
--- a/third_party/blink/common/client_hints/client_hints.cc
+++ b/third_party/blink/common/client_hints/client_hints.cc
@@ -106,6 +106,9 @@ absl::optional<std::vector<network::mojom::WebClientHintsType>> FilterAcceptCH(
for (network::mojom::WebClientHintsType hint : in.value()) {
// Some hints are supported only conditionally.
switch (hint) {
+ case network::mojom::WebClientHintsType::kUAModel:
+ // model is never provided for privacy reasons
+ break;
case network::mojom::WebClientHintsType::kLang:
if (permit_lang_hints)
result.push_back(hint);
@@ -114,7 +117,6 @@ absl::optional<std::vector<network::mojom::WebClientHintsType>> FilterAcceptCH(
case network::mojom::WebClientHintsType::kUAArch:
case network::mojom::WebClientHintsType::kUAPlatform:
case network::mojom::WebClientHintsType::kUAPlatformVersion:
- case network::mojom::WebClientHintsType::kUAModel:
case network::mojom::WebClientHintsType::kUAMobile:
case network::mojom::WebClientHintsType::kUAFullVersion:
case network::mojom::WebClientHintsType::kUABitness:
--
2.17.1

View file

@ -1,23 +0,0 @@
From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Thu, 22 Jul 2021 23:10:52 +0200
Subject: Disable UA client hint
---
content/public/common/content_features.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
@@ -296,7 +296,7 @@ const base::Feature kExtraSafelistedRequestHeadersForOutOfBlinkCors{
// Controls whether Client Hints are guarded by Permissions Policy.
const base::Feature kFeaturePolicyForClientHints{
- "FeaturePolicyForClientHints", base::FEATURE_ENABLED_BY_DEFAULT};
+ "FeaturePolicyForClientHints", base::FEATURE_DISABLED_BY_DEFAULT};
// Enables the AccessHandle surface for File System Access API's Origin Private
// File System. Tracking bug: https://crbug.com/1218431.
--
2.17.1

View file

@ -0,0 +1,21 @@
From: csagan5 <32685696+csagan5@users.noreply.github.com>
Date: Fri, 8 Oct 2021 00:30:26 +0200
Subject: Disable lock icon in address bar by default
---
chrome/browser/ui/toolbar/chrome_location_bar_model_delegate.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/chrome/browser/ui/toolbar/chrome_location_bar_model_delegate.cc b/chrome/browser/ui/toolbar/chrome_location_bar_model_delegate.cc
--- a/chrome/browser/ui/toolbar/chrome_location_bar_model_delegate.cc
+++ b/chrome/browser/ui/toolbar/chrome_location_bar_model_delegate.cc
@@ -276,5 +276,5 @@ TemplateURLService* ChromeLocationBarModelDelegate::GetTemplateURLService() {
void ChromeLocationBarModelDelegate::RegisterProfilePrefs(
user_prefs::PrefRegistrySyncable* registry) {
registry->RegisterBooleanPref(omnibox::kPreventUrlElisionsInOmnibox, true);
- registry->RegisterBooleanPref(omnibox::kLockIconInAddressBarEnabled, false);
+ registry->RegisterBooleanPref(omnibox::kLockIconInAddressBarEnabled, true);
}
--
2.17.1

View file

@ -4,22 +4,26 @@ Subject: Enable darken websites checkbox in themes
Unexpire #darken-websites-checkbox-in-themes-setting
---
chrome/browser/flag-metadata.json | 2 +-
chrome/browser/flag-metadata.json | 6 +++---
chrome/browser/flags/android/chrome_feature_list.cc | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json
@@ -1142,7 +1142,7 @@
@@ -917,9 +917,9 @@
"expiry_milestone": 100
},
{
"name": "disable-keepalive-fetch",
"owners": [ "yhirano" ],
- "expiry_milestone": 83
- "name": "darken-websites-checkbox-in-themes-setting",
- "owners": [ "lazzzis@google.com", "twellington" ],
- "expiry_milestone": 92
+ "name": "darken-websites-checkbox-in-themes-setting",
+ "owners": [ "lazzzis@google.com", "twellington" ],
+ "expiry_milestone": -1
},
{
"name": "disable-office-editing-component-app",
"name": "dcheck-is-fatal",
diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
--- a/chrome/browser/flags/android/chrome_feature_list.cc
+++ b/chrome/browser/flags/android/chrome_feature_list.cc

View file

@ -0,0 +1,414 @@
From: uazo <uazo@users.noreply.github.com>
Date: Sun, 3 Oct 2021 16:18:24 +0000
Subject: Enable share intent
This patch allows to activate the management of android.intent.action.SEND
with new flag "shared-intent-ui" default active.
See also: https://github.com/bromite/bromite/issues/1062
---
chrome/android/chrome_java_resources.gni | 1 +
chrome/android/chrome_java_sources.gni | 1 +
chrome/android/java/AndroidManifest.xml | 18 +++
.../res/layout/sharing_intent_content.xml | 83 +++++++++++++
.../init/ProcessInitializationHandler.java | 3 +
.../SharedIntentShareActivity.java | 114 ++++++++++++++++++
chrome/browser/about_flags.cc | 4 +
chrome/browser/flag_descriptions.cc | 5 +
chrome/browser/flag_descriptions.h | 3 +
.../flags/android/chrome_feature_list.cc | 4 +
.../flags/android/chrome_feature_list.h | 1 +
.../browser/flags/ChromeFeatureList.java | 1 +
.../strings/android_chrome_strings.grd | 13 ++
13 files changed, 251 insertions(+)
create mode 100644 chrome/android/java/res/layout/sharing_intent_content.xml
create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/sharing/shared_intent/SharedIntentShareActivity.java
diff --git a/chrome/android/chrome_java_resources.gni b/chrome/android/chrome_java_resources.gni
--- a/chrome/android/chrome_java_resources.gni
+++ b/chrome/android/chrome_java_resources.gni
@@ -716,6 +716,7 @@ chrome_java_resources = [
"java/res/layout/share_sheet_content.xml",
"java/res/layout/share_sheet_item.xml",
"java/res/layout/sharing_device_picker.xml",
+ "java/res/layout/sharing_intent_content.xml",
"java/res/layout/sheet_tab_toolbar.xml",
"java/res/layout/signin_activity.xml",
"java/res/layout/status_indicator_container.xml",
diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
--- a/chrome/android/chrome_java_sources.gni
+++ b/chrome/android/chrome_java_sources.gni
@@ -1046,6 +1046,7 @@ chrome_java_sources = [
"java/src/org/chromium/chrome/browser/sharing/shared_clipboard/SharedClipboardMessageHandler.java",
"java/src/org/chromium/chrome/browser/sharing/shared_clipboard/SharedClipboardMetrics.java",
"java/src/org/chromium/chrome/browser/sharing/shared_clipboard/SharedClipboardShareActivity.java",
+ "java/src/org/chromium/chrome/browser/sharing/shared_intent/SharedIntentShareActivity.java",
"java/src/org/chromium/chrome/browser/sharing/sms_fetcher/SmsFetcherMessageHandler.java",
"java/src/org/chromium/chrome/browser/site_settings/ChromeSiteSettingsDelegate.java",
"java/src/org/chromium/chrome/browser/site_settings/CookieControlsServiceBridge.java",
diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/AndroidManifest.xml
--- a/chrome/android/java/AndroidManifest.xml
+++ b/chrome/android/java/AndroidManifest.xml
@@ -803,6 +803,24 @@ by a child template that "extends" this file.
</intent-filter>
</activity>
+ <activity
+ android:name="org.chromium.chrome.browser.sharing.shared_intent.SharedIntentShareActivity"
+ android:icon="@drawable/ic_launcher"
+ android:roundIcon="@drawable/ic_launcher_round"
+ android:label="@string/shared_intent_share_activity_title"
+ android:enabled="false"
+ android:excludeFromRecents="true"
+ android:exported="true"
+ android:noHistory="true"
+ android:theme="@style/Theme.Chromium.Activity.TranslucentNoAnimations"
+ android:configChanges="orientation|keyboardHidden|keyboard|screenSize|mcc|mnc|screenLayout|smallestScreenSize" >
+ <intent-filter>
+ <action android:name="android.intent.action.SEND" />
+ <category android:name="android.intent.category.DEFAULT" />
+ <data android:mimeType="text/plain" />
+ </intent-filter>
+ </activity>
+
<activity
android:name="org.chromium.chrome.browser.vr.VrCancelAnimationActivity"
android:exported="false"
diff --git a/chrome/android/java/res/layout/sharing_intent_content.xml b/chrome/android/java/res/layout/sharing_intent_content.xml
new file mode 100644
--- /dev/null
+++ b/chrome/android/java/res/layout/sharing_intent_content.xml
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2019 The Chromium Authors. All rights reserved.
+ Use of this source code is governed by a BSD-style license that can be
+ found in the LICENSE file. -->
+<LinearLayout
+ xmlns:android="http://schemas.android.com/apk/res/android"
+ xmlns:app="http://schemas.android.com/apk/res-auto"
+ android:layout_width="match_parent"
+ android:layout_height="match_parent"
+ android:orientation="vertical">
+
+ <View
+ android:id="@+id/mask"
+ android:layout_width="match_parent"
+ android:layout_height="0dp"
+ android:layout_weight="1"
+ android:background="@android:color/transparent"/>
+
+ <LinearLayout
+ android:layout_width="match_parent"
+ android:layout_height="wrap_content"
+ android:orientation="vertical"
+ android:background="@color/sheet_bg_color">
+
+ <LinearLayout
+ android:layout_width="match_parent"
+ android:layout_height="wrap_content"
+ android:paddingBottom="32dp"
+ android:orientation="vertical">
+
+ <ImageView
+ android:layout_height="wrap_content"
+ android:layout_width ="match_parent"
+ app:srcCompat="@drawable/ic_launcher"/>
+
+ <TextView
+ android:layout_width="match_parent"
+ android:layout_height="@dimen/min_touch_target_size"
+ android:gravity="center"
+ android:paddingStart="30dp"
+ android:paddingEnd="30dp"
+ android:paddingTop="16dp"
+ android:ellipsize="end"
+ android:textAppearance="@style/TextAppearance.BlackToolbarTitle"
+ android:text="@string/shared_intent_share_activity_title"/>
+
+ <TextView
+ android:id="@+id/share_message_text"
+ android:layout_width="match_parent"
+ android:layout_height="wrap_content"
+ android:gravity="center"
+ android:paddingStart="30dp"
+ android:paddingEnd="30dp"
+ android:paddingTop="16dp"
+ android:ellipsize="end"
+ android:textAppearance="@style/TextAppearance.TextLarge.Secondary"
+ android:text="@string/shared_intent_share_activity_text"/>
+
+ <org.chromium.ui.widget.ButtonCompat
+ android:id="@+id/open_url_button"
+ android:layout_height="wrap_content"
+ android:layout_width="wrap_content"
+ android:layout_gravity="center"
+ android:layout_marginTop="16dp"
+ android:text="@string/shared_intent_share_activity_open_text"
+ android:visibility="gone"
+ style="@style/FilledButton"/>
+
+ <org.chromium.ui.widget.ButtonCompat
+ android:id="@+id/open_url_incognito_button"
+ android:layout_height="wrap_content"
+ android:layout_width="wrap_content"
+ android:layout_gravity="center"
+ android:layout_marginTop="16dp"
+ android:text="@string/shared_intent_share_activity_openincognito_text"
+ android:visibility="gone"
+ style="@style/TextButton"/>
+
+ </LinearLayout>
+
+ </LinearLayout>
+
+</LinearLayout>
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java
--- a/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java
@@ -73,6 +73,7 @@ import org.chromium.chrome.browser.rlz.RevenueStats;
import org.chromium.chrome.browser.searchwidget.SearchWidgetProvider;
import org.chromium.chrome.browser.share.clipboard.ClipboardImageFileProvider;
import org.chromium.chrome.browser.sharing.shared_clipboard.SharedClipboardShareActivity;
+import org.chromium.chrome.browser.sharing.shared_intent.SharedIntentShareActivity;
import org.chromium.chrome.browser.webapps.WebApkVersionManager;
import org.chromium.chrome.browser.webapps.WebappRegistry;
import org.chromium.components.background_task_scheduler.BackgroundTaskSchedulerFactory;
@@ -399,6 +400,8 @@ public class ProcessInitializationHandler {
deferredStartupHandler.addDeferredTask(
() -> IncognitoTabLauncher.updateComponentEnabledState());
+ deferredStartupHandler.addDeferredTask(
+ () -> SharedIntentShareActivity.updateComponentEnabledState());
deferredStartupHandler.addDeferredTask(
() -> SharedClipboardShareActivity.updateComponentEnabledState());
deferredStartupHandler.addDeferredTask(
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/sharing/shared_intent/SharedIntentShareActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/sharing/shared_intent/SharedIntentShareActivity.java
new file mode 100644
--- /dev/null
+++ b/chrome/android/java/src/org/chromium/chrome/browser/sharing/shared_intent/SharedIntentShareActivity.java
@@ -0,0 +1,114 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.sharing.shared_intent;
+
+import org.chromium.base.Log;
+
+import android.content.res.Resources;
+import android.content.ComponentName;
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.view.View;
+import android.widget.TextView;
+import android.net.Uri;
+
+import org.chromium.base.ContextUtils;
+import org.chromium.base.IntentUtils;
+import org.chromium.base.ThreadUtils;
+import org.chromium.base.task.PostTask;
+import org.chromium.base.task.TaskTraits;
+import org.chromium.chrome.R;
+import org.chromium.chrome.browser.flags.ChromeFeatureList;
+import org.chromium.chrome.browser.init.AsyncInitializationActivity;
+import org.chromium.chrome.browser.LaunchIntentDispatcher;
+import org.chromium.chrome.browser.IntentHandler;
+import org.chromium.ui.widget.ButtonCompat;
+
+/**
+ * Activity to display device targets to share text.
+ */
+public class SharedIntentShareActivity
+ extends AsyncInitializationActivity {
+
+ /**
+ * Checks whether sending shared clipboard message is enabled for the user and enables/disables
+ * the SharedIntentShareActivity appropriately. This call requires native to be loaded.
+ */
+ public static void updateComponentEnabledState() {
+ boolean enabled = ChromeFeatureList.isEnabled(ChromeFeatureList.SHARED_INTENT_UI);
+ PostTask.postTask(TaskTraits.USER_VISIBLE, () -> setComponentEnabled(enabled));
+ }
+
+ /**
+ * Sets whether or not the SharedIntentShareActivity should be enabled. This may trigger a
+ * StrictMode violation so shouldn't be called on the UI thread.
+ */
+ private static void setComponentEnabled(boolean enabled) {
+ ThreadUtils.assertOnBackgroundThread();
+ Context context = ContextUtils.getApplicationContext();
+ PackageManager packageManager = context.getPackageManager();
+ ComponentName componentName =
+ new ComponentName(context, SharedIntentShareActivity.class);
+
+ int newState = enabled ? PackageManager.COMPONENT_ENABLED_STATE_ENABLED
+ : PackageManager.COMPONENT_ENABLED_STATE_DISABLED;
+
+ // This indicates that we don't want to kill Chrome when changing component enabled state.
+ int flags = PackageManager.DONT_KILL_APP;
+
+ if (packageManager.getComponentEnabledSetting(componentName) != newState) {
+ packageManager.setComponentEnabledSetting(componentName, newState, flags);
+ }
+ }
+
+ @Override
+ protected void triggerLayoutInflation() {
+ setContentView(R.layout.sharing_intent_content);
+
+ String linkUrl = IntentUtils.safeGetStringExtra(getIntent(), Intent.EXTRA_TEXT);
+ Resources resources = ContextUtils.getApplicationContext().getResources();
+ TextView share_message_text = findViewById(R.id.share_message_text);
+ share_message_text.setText(
+ resources.getString(R.string.shared_intent_share_activity_text, linkUrl));
+
+ View mask = findViewById(R.id.mask);
+ mask.setOnClickListener(v -> finish());
+
+ ButtonCompat open_url_button = findViewById(R.id.open_url_button);
+ open_url_button.setVisibility(View.VISIBLE);
+ open_url_button.setOnClickListener(view -> {
+ Context applicationContext = ContextUtils.getApplicationContext();
+ Intent chromeIntent = new Intent(Intent.ACTION_VIEW, Uri.parse(linkUrl));
+ chromeIntent.setPackage(applicationContext.getPackageName());
+ chromeIntent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+
+ LaunchIntentDispatcher.dispatch(this, chromeIntent);
+ finish();
+ });
+
+ ButtonCompat open_url_incognito_button = findViewById(R.id.open_url_incognito_button);
+ open_url_incognito_button.setVisibility(View.VISIBLE);
+ open_url_incognito_button.setOnClickListener(view -> {
+ Context applicationContext = ContextUtils.getApplicationContext();
+ Intent chromeIntent = IntentHandler.createTrustedOpenNewTabIntent(applicationContext,
+ /*incognito*/true);
+
+ chromeIntent.setData(Uri.parse(linkUrl));
+ chromeIntent.setPackage(applicationContext.getPackageName());
+ chromeIntent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+
+ LaunchIntentDispatcher.dispatch(this, chromeIntent);
+ finish();
+ });
+
+ onInitialLayoutInflationComplete();
+ }
+
+ @Override
+ public boolean shouldStartGpuProcess() {
+ return false;
+ }
+}
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -5536,6 +5536,10 @@ const FeatureEntry kFeatureEntries[] = {
flag_descriptions::kSharedClipboardUIDescription, kOsAll,
FEATURE_VALUE_TYPE(kSharedClipboardUI)},
+ {"shared-intent-ui", flag_descriptions::kSharedIntentUIName,
+ flag_descriptions::kSharedIntentUIDescription, kOsAll,
+ FEATURE_VALUE_TYPE(chrome::android::kSharedIntentUI)},
+
{"sharing-prefer-vapid", flag_descriptions::kSharingPreferVapidName,
flag_descriptions::kSharingPreferVapidDescription, kOsAll,
FEATURE_VALUE_TYPE(kSharingPreferVapid)},
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -2382,6 +2382,11 @@ const char kSharedClipboardUIDescription[] =
"Enables shared clipboard feature signals to be handled by showing "
"a list of user's available devices to share the clipboard.";
+const char kSharedIntentUIName[] =
+ "Enable shared feature";
+const char kSharedIntentUIDescription[] =
+ "Enables shared feature";
+
const char kSharingHubDesktopAppMenuName[] = "Desktop Sharing Hub in App Menu";
const char kSharingHubDesktopAppMenuDescription[] =
"Enables the Chrome Sharing Hub in the 3-dot menu for desktop.";
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -1364,6 +1364,9 @@ extern const char kServiceWorkerSubresourceFilterDescription[];
extern const char kSharedClipboardUIName[];
extern const char kSharedClipboardUIDescription[];
+extern const char kSharedIntentUIName[];
+extern const char kSharedIntentUIDescription[];
+
extern const char kSharingHubDesktopAppMenuName[];
extern const char kSharingHubDesktopAppMenuDescription[];
diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
--- a/chrome/browser/flags/android/chrome_feature_list.cc
+++ b/chrome/browser/flags/android/chrome_feature_list.cc
@@ -243,6 +243,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
&kServiceManagerForDownload,
&kShareButtonInTopToolbar,
&kSharedClipboardUI,
+ &kSharedIntentUI,
&kSharingHubLinkToggle,
&kSingleTouchSelect,
&kSpannableInlineAutocomplete,
@@ -607,6 +608,9 @@ const base::Feature kSearchEnginePromoExistingDevice{
const base::Feature kSearchEnginePromoNewDevice{
"SearchEnginePromo.NewDevice", base::FEATURE_ENABLED_BY_DEFAULT};
+const base::Feature kSharedIntentUI{
+ "SharedIntentUI", base::FEATURE_ENABLED_BY_DEFAULT};
+
const base::Feature kNewWindowAppMenu{"NewWindowAppMenu",
base::FEATURE_ENABLED_BY_DEFAULT};
diff --git a/chrome/browser/flags/android/chrome_feature_list.h b/chrome/browser/flags/android/chrome_feature_list.h
--- a/chrome/browser/flags/android/chrome_feature_list.h
+++ b/chrome/browser/flags/android/chrome_feature_list.h
@@ -117,6 +117,7 @@ extern const base::Feature kRelatedSearchesSimplifiedUx;
extern const base::Feature kRelatedSearchesUi;
extern const base::Feature kSearchEnginePromoExistingDevice;
extern const base::Feature kSearchEnginePromoNewDevice;
+extern const base::Feature kSharedIntentUI;
extern const base::Feature kSearchReadyOmniboxFeature;
extern const base::Feature kServiceManagerForBackgroundPrefetch;
extern const base::Feature kServiceManagerForDownload;
diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
--- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
@@ -477,6 +477,7 @@ public abstract class ChromeFeatureList {
public static final String SHARE_BUTTON_IN_TOP_TOOLBAR = "ShareButtonInTopToolbar";
public static final String SHARE_USAGE_RANKING = "ShareUsageRanking";
public static final String SHARED_CLIPBOARD_UI = "SharedClipboardUI";
+ public static final String SHARED_INTENT_UI = "SharedIntentUI";
public static final String SHARED_HIGHLIGHTING_V2 = "SharedHighlightingV2";
public static final String SHARED_HIGHLIGHTING_AMP = "SharedHighlightingAmp";
public static final String SHARING_HUB_LINK_TOGGLE = "SharingHubLinkToggle";
diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
--- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
+++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
@@ -4272,6 +4272,19 @@ To change this setting, <ph name="BEGIN_LINK">&lt;resetlink&gt;</ph>reset sync<p
Send text to Your Devices
</message>
+ <message name="IDS_SHARED_INTENT_SHARE_ACTIVITY_TITLE" desc="Text that will appear in the Android share dialog to open an URL with Bromite.">
+ Open URL with Bromite
+ </message>
+ <message name="IDS_SHARED_INTENT_SHARE_ACTIVITY_TEXT" desc="Text to show for opening with Bromite.">
+ Will open <ph name="URL">%1$s</ph> with Bromite
+ </message>
+ <message name="IDS_SHARED_INTENT_SHARE_ACTIVITY_OPEN_TEXT" desc="Text to show in the button for opening with Bromite.">
+ Open with Bromite
+ </message>
+ <message name="IDS_SHARED_INTENT_SHARE_ACTIVITY_OPENINCOGNITO_TEXT" desc="Text to show in the button for opening with Bromite in incognito.">
+ Open with Bromite Incognito
+ </message>
+
<!-- Sms Fetcher -->
<message name="IDS_SMS_FETCHER_NOTIFICATION_TITLE" desc="Title text shown when the Android Chrome receives a ONE_TIME_CODE from an incoming SMS and ask users for permission to submit the code to their linked Desktop Chrome">
Submit <ph name="ONE_TIME_CODE">%1$s<ex>123</ex></ph> on <ph name="CLIENT_NAME">%2$s<ex>Zoe's Macbook</ex></ph>?
--
2.17.1

View file

@ -0,0 +1,67 @@
From: uazo <uazo@users.noreply.github.com>
Date: Mon, 4 Oct 2021 11:48:18 +0000
Subject: Force open external links in incognito
---
chrome/android/java/res/xml/privacy_preferences.xml | 5 +++++
.../chrome/browser/LaunchIntentDispatcher.java | 11 +++++++++++
.../ui/android/strings/android_chrome_strings.grd | 8 ++++++++
3 files changed, 24 insertions(+)
diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
--- a/chrome/android/java/res/xml/privacy_preferences.xml
+++ b/chrome/android/java/res/xml/privacy_preferences.xml
@@ -57,6 +57,11 @@
android:title="@string/allow_custom_tab_intents_title"
android:summary="@string/allow_custom_tab_intents_summary"
android:defaultValue="false" />
+ <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
+ android:key="open_external_links_incognito"
+ android:title="@string/open_external_links_incognito_title"
+ android:summary="@string/open_external_links_incognito_summary"
+ android:defaultValue="false" />
<Preference
android:key="privacy_sandbox"
android:title="@string/prefs_privacy_sandbox"
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
--- a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
@@ -427,6 +427,17 @@ public class LaunchIntentDispatcher implements IntentHandler.IntentHandlerDelega
if (Intent.ACTION_VIEW.equals(newIntent.getAction())
&& !IntentHandler.wasIntentSenderChrome(newIntent)) {
+
+ if (ContextUtils.getAppSharedPreferences().getBoolean(
+ "open_external_links_incognito", false)) {
+ Context applicationContext = ContextUtils.getApplicationContext();
+ newIntent = IntentHandler.createTrustedOpenNewTabIntent(applicationContext,
+ /*incognito*/true);
+ newIntent.setData(mIntent.getData());
+ newIntent.setPackage(applicationContext.getPackageName());
+ newIntent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+ }
+
long time = SystemClock.elapsedRealtime();
if (!chromeTabbedTaskExists()) {
newIntent.putExtra(IntentHandler.EXTRA_STARTED_TABBED_CHROME_TASK, true);
diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
--- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
+++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
@@ -4317,6 +4317,14 @@ To change this setting, <ph name="BEGIN_LINK">&lt;resetlink&gt;</ph>reset sync<p
Allow applications to open custom tab intents, similar to webview.
</message>
+ <!-- Open External Links in Incognito -->
+ <message name="IDS_OPEN_EXTERNAL_LINKS_INCOGNITO_TITLE" desc="Text for 'Open external links in incognito' settings-privacy option.">
+ Open external links in incognito
+ </message>
+ <message name="IDS_OPEN_EXTERNAL_LINKS_INCOGNITO_SUMMARY" desc="Summary text for 'Open external links in incognito' settings-privacy option.">
+ Force the opening of all external links in incognito mode
+ </message>
+
<!-- Autofill Assistant preferences -->
<!-- TODO(b/168178344): Move to Assistant settings strings section below. -->
<message name="IDS_PREFS_AUTOFILL_ASSISTANT_TITLE" desc="Title for the Autofill Assistant preferences screen. [CHAR_LIMIT=32]">
--
2.17.1

View file

@ -0,0 +1,91 @@
From: Daniel Rubery <drubery@chromium.org>
Date: Tue, 28 Sep 2021 19:16:15 +0000
Subject: Observe WebContents in PPAPIDownloadRequest
If the WebContents is destroyed while the PPAPIDownloadRequest is
checking the allowlist, we end up with a UaF. The fix for this is to
observe the WebContents and cancel the request.
(cherry picked from commit e7d560979f89705ea2844f9f64b5c7a598a03f2b)
Bug: 1245578
Change-Id: Idbe5c1cb966fe21ab1a49a7345a5b197afa0b807
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3150060
Reviewed-by: Bettina Dea <bdea@chromium.org>
Commit-Queue: Daniel Rubery <drubery@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#919488}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3188403
Auto-Submit: Daniel Rubery <drubery@chromium.org>
Commit-Queue: Bettina Dea <bdea@chromium.org>
Cr-Commit-Position: refs/branch-heads/4606@{#1241}
Cr-Branched-From: 35b0d5a9dc8362adfd44e2614f0d5b7402ef63d0-refs/heads/master@{#911515}
---
.../download_protection/ppapi_download_request.cc | 6 ++++++
.../download_protection/ppapi_download_request.h | 8 ++++++--
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc b/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc
--- a/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc
+++ b/chrome/browser/safe_browsing/download_protection/ppapi_download_request.cc
@@ -71,6 +71,8 @@ PPAPIDownloadRequest::PPAPIDownloadRequest(
return;
}
+ Observe(web_contents);
+
SafeBrowsingNavigationObserverManager* observer_manager =
service->GetNavigationObserverManager(web_contents);
if (observer_manager) {
@@ -138,6 +140,10 @@ GURL PPAPIDownloadRequest::GetDownloadRequestUrl() {
return url;
}
+void PPAPIDownloadRequest::WebContentsDestroyed() {
+ Finish(RequestOutcome::REQUEST_DESTROYED, DownloadCheckResult::UNKNOWN);
+}
+
// Allowlist checking needs to the done on the IO thread.
void PPAPIDownloadRequest::CheckAllowlistsOnIOThread(
const GURL& requestor_url,
diff --git a/chrome/browser/safe_browsing/download_protection/ppapi_download_request.h b/chrome/browser/safe_browsing/download_protection/ppapi_download_request.h
--- a/chrome/browser/safe_browsing/download_protection/ppapi_download_request.h
+++ b/chrome/browser/safe_browsing/download_protection/ppapi_download_request.h
@@ -12,6 +12,7 @@
#include "base/memory/weak_ptr.h"
#include "chrome/browser/safe_browsing/download_protection/download_protection_util.h"
#include "components/sessions/core/session_id.h"
+#include "content/public/browser/web_contents_observer.h"
#include "url/gurl.h"
namespace content {
@@ -43,7 +44,7 @@ class PPAPIDownloadRequest;
//
// PPAPIDownloadRequest objects are owned by the DownloadProtectionService
// indicated by |service|.
-class PPAPIDownloadRequest {
+class PPAPIDownloadRequest : public content::WebContentsObserver {
public:
// The outcome of the request. These values are used for UMA. New values
// should only be added at the end.
@@ -70,7 +71,7 @@ class PPAPIDownloadRequest {
DownloadProtectionService* service,
scoped_refptr<SafeBrowsingDatabaseManager> database_manager);
- ~PPAPIDownloadRequest();
+ ~PPAPIDownloadRequest() override;
// Start the process of checking the download request. The callback passed as
// the |callback| parameter to the constructor will be invoked with the result
@@ -89,6 +90,9 @@ class PPAPIDownloadRequest {
// Returns the URL that will be used for download requests.
static GURL GetDownloadRequestUrl();
+ // WebContentsObserver implementation
+ void WebContentsDestroyed() override;
+
private:
static const char kDownloadRequestUrl[];
--
2.17.1

View file

@ -0,0 +1,234 @@
From: Erik Chen <erikchen@chromium.org>
Date: Wed, 29 Sep 2021 21:16:47 +0000
Subject: Prevents non-browser processes from requesting memory dumps.
This CL makes several changes:
(1) Causes the browser to reset non-browser
mojo::PendingReceiver<Coordinator>. This means that non-browser
processes will never be able to use the Coordinator interface.
(2) Add CHECKs to existing code to prevent non-browser processes from
attempting to use the Coordinator interface.
A code audit shows that all Coordinator usages should already only be
from the browser process.
Note that (2) is important since attempting to use an unbound interface
will trigger a nullptr dereference, which is undefined behavior.
(cherry picked from commit d9cc471e122e9a2391a68fa7cd72ea50587d8d97)
Bug: 1251787
Change-Id: Ifbe9610cc0e373edaaa60fad46b447e8bdb3ec04
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3174305
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: ssid <ssid@chromium.org>
Auto-Submit: Erik Chen <erikchen@chromium.org>
Commit-Queue: Erik Chen <erikchen@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#923693}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3194811
Reviewed-by: Avi Drissman <avi@chromium.org>
Reviewed-by: Krishna Govind <govind@chromium.org>
Commit-Queue: Krishna Govind <govind@chromium.org>
Owners-Override: Krishna Govind <govind@chromium.org>
Cr-Commit-Position: refs/branch-heads/4606@{#1253}
Cr-Branched-From: 35b0d5a9dc8362adfd44e2614f0d5b7402ef63d0-refs/heads/master@{#911515}
---
.../browser/browser_child_process_host_impl.cc | 3 +++
.../renderer_host/render_process_host_impl.cc | 3 +++
.../memory_instrumentation/coordinator_impl.cc | 3 ++-
.../client_process_impl.cc | 13 +++++++++++--
.../client_process_impl.h | 3 +++
.../memory_instrumentation.cc | 17 ++++++++++++-----
.../memory_instrumentation.h | 9 +++++++--
7 files changed, 41 insertions(+), 10 deletions(-)
diff --git a/content/browser/browser_child_process_host_impl.cc b/content/browser/browser_child_process_host_impl.cc
--- a/content/browser/browser_child_process_host_impl.cc
+++ b/content/browser/browser_child_process_host_impl.cc
@@ -708,6 +708,9 @@ void BrowserChildProcessHostImpl::RegisterCoordinatorClient(
mojo::PendingReceiver<memory_instrumentation::mojom::Coordinator> receiver,
mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess>
client_process) {
+ // Intentionally disallow non-browser processes from getting a Coordinator.
+ receiver.reset();
+
// The child process may have already terminated by the time this message is
// dispatched. We do nothing in that case.
if (!IsProcessLaunched())
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -2838,6 +2838,9 @@ void RenderProcessHostImpl::RegisterCoordinatorClient(
mojo::PendingReceiver<memory_instrumentation::mojom::Coordinator> receiver,
mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess>
client_process) {
+ // Intentionally disallow non-browser processes from getting a Coordinator.
+ receiver.reset();
+
if (!GetProcess().IsValid()) {
// If the process dies before we get this message. we have no valid PID
// and there's nothing to register.
diff --git a/services/resource_coordinator/memory_instrumentation/coordinator_impl.cc b/services/resource_coordinator/memory_instrumentation/coordinator_impl.cc
--- a/services/resource_coordinator/memory_instrumentation/coordinator_impl.cc
+++ b/services/resource_coordinator/memory_instrumentation/coordinator_impl.cc
@@ -105,7 +105,8 @@ void CoordinatorImpl::RegisterClientProcess(
const absl::optional<std::string>& service_name) {
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
mojo::Remote<mojom::ClientProcess> process(std::move(client_process));
- coordinator_receivers_.Add(this, std::move(receiver), process_id);
+ if (receiver.is_valid())
+ coordinator_receivers_.Add(this, std::move(receiver), process_id);
process.set_disconnect_handler(
base::BindOnce(&CoordinatorImpl::UnregisterClientProcess,
base::Unretained(this), process_id));
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.cc b/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.cc
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.cc
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.cc
@@ -24,6 +24,11 @@ void ClientProcessImpl::CreateInstance(
mojo::PendingReceiver<mojom::ClientProcess> receiver,
mojo::PendingRemote<mojom::Coordinator> coordinator,
bool is_browser_process) {
+ // Intentionally disallow non-browser processes from ever holding a
+ // Coordinator.
+ if (!is_browser_process)
+ coordinator.reset();
+
static ClientProcessImpl* instance = nullptr;
if (!instance) {
instance = new ClientProcessImpl(
@@ -39,10 +44,12 @@ ClientProcessImpl::ClientProcessImpl(
mojo::PendingRemote<mojom::Coordinator> coordinator,
bool is_browser_process,
bool initialize_memory_instrumentation)
- : receiver_(this, std::move(receiver)) {
+ : receiver_(this, std::move(receiver)),
+ is_browser_process_(is_browser_process) {
if (initialize_memory_instrumentation) {
// Initialize the public-facing MemoryInstrumentation helper.
- MemoryInstrumentation::CreateInstance(std::move(coordinator));
+ MemoryInstrumentation::CreateInstance(std::move(coordinator),
+ is_browser_process);
} else {
coordinator_.Bind(std::move(coordinator));
}
@@ -110,6 +117,8 @@ void ClientProcessImpl::OnChromeMemoryDumpDone(
void ClientProcessImpl::RequestGlobalMemoryDump_NoCallback(
base::trace_event::MemoryDumpType dump_type,
base::trace_event::MemoryDumpLevelOfDetail level_of_detail) {
+ CHECK(is_browser_process_);
+
if (!task_runner_->RunsTasksInCurrentSequence()) {
task_runner_->PostTask(
FROM_HERE,
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h b/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h
@@ -96,6 +96,9 @@ class COMPONENT_EXPORT(RESOURCE_COORDINATOR_PUBLIC_MEMORY_INSTRUMENTATION)
mojo::Remote<mojom::Coordinator> coordinator_;
scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+ // Only browser process is allowed to request memory dumps.
+ const bool is_browser_process_;
+
// TODO(crbug.com/728199): The observer is only used to setup and tear down
// MemoryDumpManager in each process. Setting up MemoryDumpManager should
// be moved away from TracingObserver.
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/memory_instrumentation.cc b/services/resource_coordinator/public/cpp/memory_instrumentation/memory_instrumentation.cc
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/memory_instrumentation.cc
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/memory_instrumentation.cc
@@ -21,10 +21,11 @@ void WrapGlobalMemoryDump(
// static
void MemoryInstrumentation::CreateInstance(
- mojo::PendingRemote<memory_instrumentation::mojom::Coordinator>
- coordinator) {
+ mojo::PendingRemote<memory_instrumentation::mojom::Coordinator> coordinator,
+ bool is_browser_process) {
DCHECK(!g_instance);
- g_instance = new MemoryInstrumentation(std::move(coordinator));
+ g_instance =
+ new MemoryInstrumentation(std::move(coordinator), is_browser_process);
}
// static
@@ -33,8 +34,10 @@ MemoryInstrumentation* MemoryInstrumentation::GetInstance() {
}
MemoryInstrumentation::MemoryInstrumentation(
- mojo::PendingRemote<memory_instrumentation::mojom::Coordinator> coordinator)
- : coordinator_(std::move(coordinator)) {}
+ mojo::PendingRemote<memory_instrumentation::mojom::Coordinator> coordinator,
+ bool is_browser_process)
+ : coordinator_(std::move(coordinator)),
+ is_browser_process_(is_browser_process) {}
MemoryInstrumentation::~MemoryInstrumentation() {
g_instance = nullptr;
@@ -43,6 +46,7 @@ MemoryInstrumentation::~MemoryInstrumentation() {
void MemoryInstrumentation::RequestGlobalDump(
const std::vector<std::string>& allocator_dump_names,
RequestGlobalDumpCallback callback) {
+ CHECK(is_browser_process_);
coordinator_->RequestGlobalMemoryDump(
MemoryDumpType::SUMMARY_ONLY, MemoryDumpLevelOfDetail::BACKGROUND,
MemoryDumpDeterminism::NONE, allocator_dump_names,
@@ -52,6 +56,7 @@ void MemoryInstrumentation::RequestGlobalDump(
void MemoryInstrumentation::RequestPrivateMemoryFootprint(
base::ProcessId pid,
RequestGlobalDumpCallback callback) {
+ CHECK(is_browser_process_);
coordinator_->RequestPrivateMemoryFootprint(
pid, base::BindOnce(&WrapGlobalMemoryDump, std::move(callback)));
}
@@ -60,6 +65,7 @@ void MemoryInstrumentation::RequestGlobalDumpForPid(
base::ProcessId pid,
const std::vector<std::string>& allocator_dump_names,
RequestGlobalDumpCallback callback) {
+ CHECK(is_browser_process_);
coordinator_->RequestGlobalMemoryDumpForPid(
pid, allocator_dump_names,
base::BindOnce(&WrapGlobalMemoryDump, std::move(callback)));
@@ -70,6 +76,7 @@ void MemoryInstrumentation::RequestGlobalDumpAndAppendToTrace(
MemoryDumpLevelOfDetail level_of_detail,
MemoryDumpDeterminism determinism,
RequestGlobalMemoryDumpAndAppendToTraceCallback callback) {
+ CHECK(is_browser_process_);
coordinator_->RequestGlobalMemoryDumpAndAppendToTrace(
dump_type, level_of_detail, determinism, std::move(callback));
}
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/memory_instrumentation.h b/services/resource_coordinator/public/cpp/memory_instrumentation/memory_instrumentation.h
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/memory_instrumentation.h
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/memory_instrumentation.h
@@ -34,7 +34,8 @@ class COMPONENT_EXPORT(RESOURCE_COORDINATOR_PUBLIC_MEMORY_INSTRUMENTATION)
static void CreateInstance(
mojo::PendingRemote<memory_instrumentation::mojom::Coordinator>
- coordinator);
+ coordinator,
+ bool is_browser_process);
static MemoryInstrumentation* GetInstance();
// Retrieves a Coordinator interface to communicate with the service. This is
@@ -100,12 +101,16 @@ class COMPONENT_EXPORT(RESOURCE_COORDINATOR_PUBLIC_MEMORY_INSTRUMENTATION)
private:
explicit MemoryInstrumentation(
mojo::PendingRemote<memory_instrumentation::mojom::Coordinator>
- coordinator);
+ coordinator,
+ bool is_browser_process);
~MemoryInstrumentation();
const mojo::SharedRemote<memory_instrumentation::mojom::Coordinator>
coordinator_;
+ // Only browser process is allowed to request memory dumps.
+ const bool is_browser_process_;
+
DISALLOW_COPY_AND_ASSIGN(MemoryInstrumentation);
};
--
2.17.1

View file

@ -416,7 +416,7 @@ diff --git a/components/browser_ui/strings/android/site_settings.grdp b/componen
diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
--- a/components/content_settings/core/browser/content_settings_registry.cc
+++ b/components/content_settings/core/browser/content_settings_registry.cc
@@ -337,7 +337,7 @@ void ContentSettingsRegistry::Init() {
@@ -326,7 +326,7 @@ void ContentSettingsRegistry::Init() {
ContentSettingsInfo::PERSISTENT,
ContentSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);

View file

@ -27,7 +27,7 @@ See also: https://github.com/bromite/bromite/wiki/TimezoneOverride
.../strings/android/site_settings.grdp | 35 ++++
.../browser/content_settings_pref_provider.cc | 16 ++
.../browser/content_settings_pref_provider.h | 5 +
.../core/browser/content_settings_registry.cc | 23 +++
.../core/browser/content_settings_registry.cc | 12 ++
.../core/browser/content_settings_utils.cc | 7 +
.../core/browser/host_content_settings_map.cc | 8 +
.../core/browser/host_content_settings_map.h | 3 +
@ -42,7 +42,7 @@ See also: https://github.com/bromite/bromite/wiki/TimezoneOverride
.../renderer/content_settings_agent_impl.cc | 89 ++++++++
.../renderer/content_settings_agent_impl.h | 4 +
.../WebLayerSiteSettingsDelegate.java | 3 +
36 files changed, 735 insertions(+), 18 deletions(-)
36 files changed, 724 insertions(+), 18 deletions(-)
create mode 100755 components/browser_ui/site_settings/android/java/res/layout/time_zone_select_dialog.xml
create mode 100755 components/browser_ui/site_settings/android/java/res/layout/timezoneoverride_site_settings_preference.xml
create mode 100755 components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/TimezoneOverrideSiteSettingsPreference.java
@ -1086,7 +1086,7 @@ diff --git a/components/content_settings/core/browser/content_settings_pref_prov
diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
--- a/components/content_settings/core/browser/content_settings_registry.cc
+++ b/components/content_settings/core/browser/content_settings_registry.cc
@@ -291,6 +291,29 @@ void ContentSettingsRegistry::Init() {
@@ -291,6 +291,18 @@ void ContentSettingsRegistry::Init() {
ContentSettingsInfo::PERSISTENT,
ContentSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
@ -1101,17 +1101,6 @@ diff --git a/components/content_settings/core/browser/content_settings_registry.
+ ContentSettingsInfo::INHERIT_IN_INCOGNITO,
+ ContentSettingsInfo::PERSISTENT,
+ ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
+ Register(ContentSettingsType::TIMEZONE_OVERRIDE, "timezone-override", CONTENT_SETTING_ALLOW,
+ WebsiteSettingsInfo::SYNCABLE,
+ AllowlistedSchemes(kChromeUIScheme, kChromeDevToolsScheme),
+ ValidSettings(CONTENT_SETTING_ALLOW, // use system time
+ CONTENT_SETTING_ASK, // custom timezone, default UTC
+ CONTENT_SETTING_BLOCK), // random
+ WebsiteSettingsInfo::SINGLE_ORIGIN_WITH_EMBEDDED_EXCEPTIONS_SCOPE,
+ WebsiteSettingsRegistry::PLATFORM_ANDROID,
+ ContentSettingsInfo::INHERIT_IN_INCOGNITO,
+ ContentSettingsInfo::PERSISTENT,
+ ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
+
Register(ContentSettingsType::DURABLE_STORAGE, "durable-storage",
CONTENT_SETTING_ASK, WebsiteSettingsInfo::UNSYNCABLE,

View file

@ -4,9 +4,10 @@ Subject: Unexpire tab groups flags
Disable by default
---
chrome/browser/flag-metadata.json | 4 ++--
chrome/browser/flags/android/chrome_feature_list.cc | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
chrome/browser/flag-metadata.json | 4 ++--
chrome/browser/flags/android/chrome_feature_list.cc | 4 ++--
.../org/chromium/chrome/browser/flags/CachedFeatureFlags.java | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
--- a/chrome/browser/flag-metadata.json
@ -48,6 +49,18 @@ diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browse
const base::Feature kTabGridLayoutAndroid{"TabGridLayoutAndroid",
base::FEATURE_ENABLED_BY_DEFAULT};
diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/CachedFeatureFlags.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/CachedFeatureFlags.java
--- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/CachedFeatureFlags.java
+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/CachedFeatureFlags.java
@@ -66,7 +66,7 @@ public class CachedFeatureFlags {
put(ChromeFeatureList.PREFETCH_NOTIFICATION_SCHEDULING_INTEGRATION, false);
put(ChromeFeatureList.STORE_HOURS, false);
put(ChromeFeatureList.TAB_GRID_LAYOUT_ANDROID, true);
- put(ChromeFeatureList.TAB_GROUPS_ANDROID, true);
+ put(ChromeFeatureList.TAB_GROUPS_ANDROID, false);
put(ChromeFeatureList.TAB_GROUPS_CONTINUATION_ANDROID, false);
put(ChromeFeatureList.TOOLBAR_USE_HARDWARE_BITMAP_DRAW, false);
put(ChromeFeatureList.CLOSE_TAB_SUGGESTIONS, false);
--
2.17.1