diff --git a/browser/ephemeral_storage/ephemeral_storage_1p_browsertest.cc b/browser/ephemeral_storage/ephemeral_storage_1p_browsertest.cc index c0f886421d4..6831185c508 100644 --- a/browser/ephemeral_storage/ephemeral_storage_1p_browsertest.cc +++ b/browser/ephemeral_storage/ephemeral_storage_1p_browsertest.cc @@ -417,6 +417,73 @@ IN_PROC_BROWSER_TEST_F(EphemeralStorage1pBrowserTest, ExpectValuesFromFramesAreEmpty(FROM_HERE, GetValuesFromFrames(site_a_tab2)); } +IN_PROC_BROWSER_TEST_F(EphemeralStorage1pBrowserTest, + PRE_DontEnable1PESWithGlobalSessionOnlyToggle) { + content_settings()->SetDefaultContentSetting( + ContentSettingsType::COOKIES, + ContentSetting::CONTENT_SETTING_SESSION_ONLY); + + WebContents* site_a_tab = LoadURLInNewTab(a_site_ephemeral_storage_url_); + + SetValuesInFrames(site_a_tab, "a.com", "from=a.com"); + { + ValuesFromFrames site_a_tab_values = GetValuesFromFrames(site_a_tab); + EXPECT_EQ("a.com", site_a_tab_values.main_frame.local_storage); + EXPECT_EQ("a.com", site_a_tab_values.iframe_1.local_storage); + EXPECT_EQ("a.com", site_a_tab_values.iframe_2.local_storage); + + EXPECT_EQ("a.com", site_a_tab_values.main_frame.session_storage); + EXPECT_EQ("a.com", site_a_tab_values.iframe_1.session_storage); + EXPECT_EQ("a.com", site_a_tab_values.iframe_2.session_storage); + + EXPECT_EQ("from=a.com", site_a_tab_values.main_frame.cookies); + EXPECT_EQ("from=a.com", site_a_tab_values.iframe_1.cookies); + EXPECT_EQ("from=a.com", site_a_tab_values.iframe_2.cookies); + } + + WebContents* site_b_tab = LoadURLInNewTab(b_site_ephemeral_storage_url_); + ExpectValuesFromFramesAreEmpty(FROM_HERE, GetValuesFromFrames(site_b_tab)); + + CloseWebContents(site_a_tab); + + // Load a.com tab again, expect non-ephemeral values are kept. + site_a_tab = LoadURLInNewTab(a_site_ephemeral_storage_url_); + { + ValuesFromFrames site_a_tab_values = GetValuesFromFrames(site_a_tab); + EXPECT_EQ("a.com", site_a_tab_values.main_frame.local_storage); + EXPECT_EQ(nullptr, site_a_tab_values.iframe_1.local_storage); + EXPECT_EQ(nullptr, site_a_tab_values.iframe_2.local_storage); + + EXPECT_EQ(nullptr, site_a_tab_values.main_frame.session_storage); + EXPECT_EQ(nullptr, site_a_tab_values.iframe_1.session_storage); + EXPECT_EQ(nullptr, site_a_tab_values.iframe_2.session_storage); + + EXPECT_EQ("from=a.com", site_a_tab_values.main_frame.cookies); + EXPECT_EQ("", site_a_tab_values.iframe_1.cookies); + EXPECT_EQ("", site_a_tab_values.iframe_2.cookies); + } + CloseWebContents(site_a_tab); +} + +IN_PROC_BROWSER_TEST_F(EphemeralStorage1pBrowserTest, + DontEnable1PESWithGlobalSessionOnlyToggle) { + // Load a.com after browser reopen, expect all values are cleared, because + // global CONTENT_SETTING_SESSION_ONLY mode is enabled. + WebContents* site_a_tab = LoadURLInNewTab(a_site_ephemeral_storage_url_); + ValuesFromFrames site_a_tab_values = GetValuesFromFrames(site_a_tab); + EXPECT_EQ(nullptr, site_a_tab_values.main_frame.local_storage); + EXPECT_EQ(nullptr, site_a_tab_values.iframe_1.local_storage); + EXPECT_EQ(nullptr, site_a_tab_values.iframe_2.local_storage); + + EXPECT_EQ(nullptr, site_a_tab_values.main_frame.session_storage); + EXPECT_EQ(nullptr, site_a_tab_values.iframe_1.session_storage); + EXPECT_EQ(nullptr, site_a_tab_values.iframe_2.session_storage); + + EXPECT_EQ("", site_a_tab_values.main_frame.cookies); + EXPECT_EQ("", site_a_tab_values.iframe_1.cookies); + EXPECT_EQ("", site_a_tab_values.iframe_2.cookies); +} + IN_PROC_BROWSER_TEST_F( EphemeralStorage1pBrowserTest, DisabledShieldsAllowsPersistentCookiesFor1PesHostsIn3pFrames) { diff --git a/chromium_src/components/content_settings/core/common/cookie_settings_base.cc b/chromium_src/components/content_settings/core/common/cookie_settings_base.cc index 6c8f5f579be..58fe8a4177c 100644 --- a/chromium_src/components/content_settings/core/common/cookie_settings_base.cc +++ b/chromium_src/components/content_settings/core/common/cookie_settings_base.cc @@ -60,6 +60,12 @@ bool IsFirstPartyAccessAllowed( return cookie_settings->IsAllowed(setting); } +bool IsSessionOnlyExplicit( + const CookieSettingWithBraveMetadata& setting_with_brave_metadata) { + return setting_with_brave_metadata.setting == CONTENT_SETTING_SESSION_ONLY && + setting_with_brave_metadata.IsExplicitSetting(); +} + } // namespace CookieSettingsBase::CookieSettingsBase() = default; @@ -77,6 +83,11 @@ CookieSettingWithBraveMetadata& CookieSettingWithBraveMetadata::operator=( CookieSettingWithBraveMetadata&&) = default; CookieSettingWithBraveMetadata::~CookieSettingWithBraveMetadata() = default; +bool CookieSettingWithBraveMetadata::IsExplicitSetting() const { + return !primary_pattern_matches_all_hosts || + !secondary_pattern_matches_all_hosts; +} + bool CookieSettingsBase::ShouldUseEphemeralStorage( const GURL& url, const net::SiteForCookies& site_for_cookies, @@ -92,10 +103,14 @@ bool CookieSettingsBase::ShouldUseEphemeralStorage( // Enable ephemeral storage for a first party URL if SESSION_ONLY cookie // setting is set and the feature is enabled. + absl::optional first_party_setting; if (base::FeatureList::IsEnabled( - net::features::kBraveFirstPartyEphemeralStorage) && - IsCookieSessionOnly(first_party_url)) { - return true; + net::features::kBraveFirstPartyEphemeralStorage)) { + first_party_setting = + GetCookieSettingWithBraveMetadata(first_party_url, first_party_url); + if (IsSessionOnlyExplicit(*first_party_setting)) { + return true; + } } if (net::registry_controlled_domains::SameDomainOrHost( @@ -105,7 +120,9 @@ bool CookieSettingsBase::ShouldUseEphemeralStorage( bool allow_3p = IsCookieAccessAllowedImpl(url, site_for_cookies, top_frame_origin); - bool allow_1p = IsFirstPartyAccessAllowed(first_party_url, this); + bool allow_1p = first_party_setting + ? IsAllowed(first_party_setting->setting) + : IsFirstPartyAccessAllowed(first_party_url, this); // only use ephemeral storage for block 3p return allow_1p && !allow_3p; @@ -180,7 +197,8 @@ bool CookieSettingsBase::IsCookieAccessAllowedImpl( CookieSettingWithBraveMetadata setting_with_brave_metadata = GetCookieSettingWithBraveMetadata(first_party_url, first_party_url); - if (setting_with_brave_metadata.setting == CONTENT_SETTING_SESSION_ONLY) { + // Ephemeral mode for the main frame can be enabled only via explicit rule. + if (IsSessionOnlyExplicit(setting_with_brave_metadata)) { main_frame_mode = MainFrameMode::kEphemeral; } else { // Disabled shields mode allows everything in nested frames. To properly diff --git a/chromium_src/components/content_settings/core/common/cookie_settings_base.h b/chromium_src/components/content_settings/core/common/cookie_settings_base.h index ecb6b39a04d..e28b19d40ff 100644 --- a/chromium_src/components/content_settings/core/common/cookie_settings_base.h +++ b/chromium_src/components/content_settings/core/common/cookie_settings_base.h @@ -22,6 +22,10 @@ struct CookieSettingWithBraveMetadata { CookieSettingWithBraveMetadata& operator=(CookieSettingWithBraveMetadata&&); ~CookieSettingWithBraveMetadata(); + // Return true if any of the patterns is not "*", similar to + // content_settings::IsExplicitSetting(). + bool IsExplicitSetting() const; + ContentSetting setting = CONTENT_SETTING_DEFAULT; bool primary_pattern_matches_all_hosts = false; bool secondary_pattern_matches_all_hosts = false;