Merge pull request #14603 from brave/brave-24625

Sanitize chrome:// pages in serialized navigations

chromium_src/components/sessions/content/content_serialized_navigation_driver.cc

@@ -0,0 +1,25 @@
+/* Copyright (c) 2022 The Brave Authors. All rights reserved.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <string>
+
+#include "components/sessions/content/content_serialized_navigation_driver.h"
+#include "components/sessions/core/serialized_navigation_entry.h"
+#include "content/public/common/url_constants.h"
+
+#define GetSanitizedPageStateForPickle \
+  GetSanitizedPageStateForPickle_ChromiumImpl
+#include "src/components/sessions/content/content_serialized_navigation_driver.cc"
+#undef GetSanitizedPageStateForPickle
+
+namespace sessions {
+std::string ContentSerializedNavigationDriver::GetSanitizedPageStateForPickle(
+    const sessions::SerializedNavigationEntry* navigation) const {
+  if (navigation->virtual_url().SchemeIs(content::kChromeUIScheme))
+    return std::string();
+  return GetSanitizedPageStateForPickle_ChromiumImpl(navigation);
+}
+
+}  // namespace sessions

chromium_src/components/sessions/content/content_serialized_navigation_driver.h

@@ -0,0 +1,21 @@
+/* Copyright (c) 2022 The Brave Authors. All rights reserved.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef BRAVE_CHROMIUM_SRC_COMPONENTS_SESSIONS_CONTENT_CONTENT_SERIALIZED_NAVIGATION_DRIVER_H_
+#define BRAVE_CHROMIUM_SRC_COMPONENTS_SESSIONS_CONTENT_CONTENT_SERIALIZED_NAVIGATION_DRIVER_H_
+
+#include <string>
+
+#include "components/sessions/core/serialized_navigation_driver.h"
+#include "components/sessions/core/serialized_navigation_entry.h"
+
+#define GetSanitizedPageStateForPickle                    \
+  GetSanitizedPageStateForPickle_ChromiumImpl(            \
+      const SerializedNavigationEntry* navigation) const; \
+  std::string GetSanitizedPageStateForPickle
+#include "src/components/sessions/content/content_serialized_navigation_driver.h"
+#undef GetSanitizedPageStateForPickle
+
+#endif  // BRAVE_CHROMIUM_SRC_COMPONENTS_SESSIONS_CONTENT_CONTENT_SERIALIZED_NAVIGATION_DRIVER_H_

components/sessions/browser/BUILD.gn

@@ -0,0 +1,18 @@
+# Copyright (c) 2022 The Brave Authors. All rights reserved.
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+source_set("browser_tests") {
+  testonly = true
+  defines = [ "HAS_OUT_OF_PROC_TEST_RUNNER" ]
+  sources = [ "brave_session_restore_browsertest.cc" ]
+
+  deps = [
+    "//base/test:test_support",
+    "//chrome/browser",
+    "//chrome/browser/profiles:profile",
+    "//chrome/test:test_support_ui",
+    "//components/sessions",
+  ]
+}

components/sessions/browser/brave_session_restore_browsertest.cc

@@ -0,0 +1,55 @@
+/* Copyright (c) 2022 The Brave Authors. All rights reserved.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "base/test/bind.h"
+#include "chrome/browser/sessions/session_service.h"
+#include "chrome/browser/sessions/session_service_factory.h"
+#include "chrome/test/base/in_process_browser_test.h"
+#include "chrome/test/base/ui_test_utils.h"
+#include "components/prefs/pref_service.h"
+#include "components/sessions/core/serialized_navigation_entry.h"
+#include "components/sessions/core/session_types.h"
+#include "content/public/test/browser_test.h"
+
+using BraveSesstionRestoreBrowserTest = InProcessBrowserTest;
+
+IN_PROC_BROWSER_TEST_F(BraveSesstionRestoreBrowserTest, Serialization) {
+  auto* tab_model = browser()->tab_strip_model();
+  auto* web_contents = tab_model->GetActiveWebContents();
+  SessionService* const session_service =
+      SessionServiceFactory::GetForProfile(browser()->profile());
+  ui_test_utils::NavigateToURLBlockUntilNavigationsComplete(
+      browser(), GURL("brave://newtab/"), 1);
+  ASSERT_TRUE(EvalJs(web_contents,
+                     R"(
+        var textarea = document.createElement('textarea')
+        textarea.textContent = '__some_text__'
+        document.body.append(textarea);
+        var input = document.createElement('input')
+        input.autocomplete = 'on'
+        input.value = '__some_text__'
+        document.body.append(input);
+        var controls_ready = document.getElementsByTagName('textarea')[0].textContent === '__some_text__' &&
+                             document.getElementsByTagName('input')[0].value === '__some_text__';
+        window.domAutomationController.send(controls_ready);
+      )",
+                     content::EXECUTE_SCRIPT_USE_MANUAL_REPLY)
+                  .ExtractBool());
+  session_service->MoveCurrentSessionToLastSession();
+  base::RunLoop loop;
+  session_service->GetLastSession(base::BindLambdaForTesting(
+      [&](std::vector<std::unique_ptr<sessions::SessionWindow>> windows,
+          SessionID ignored_active_window, bool error_reading) {
+        EXPECT_EQ(windows.size(), 1u);
+        EXPECT_EQ(windows[0]->tabs.size(), 1u);
+        EXPECT_EQ(windows[0]->tabs[0]->navigations.size(), 2u);
+        const auto& serialized_navigation = windows[0]->tabs[0]->navigations[1];
+        EXPECT_EQ(serialized_navigation.virtual_url(),
+                  GURL("chrome://newtab/"));
+        EXPECT_TRUE(serialized_navigation.encoded_page_state().empty());
+        loop.Quit();
+      }));
+  loop.Run();
+}

components/sessions/content/BUILD.gn

@@ -0,0 +1,17 @@
+# Copyright (c) 2022 The Brave Authors. All rights reserved.
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+source_set("unit_tests") {
+  testonly = true
+  sources = [ "brave_content_serialized_navigation_driver_unittest.cc" ]
+
+  deps = [
+    "//base/test:test_support",
+    "//components/sessions:test_support",
+    "//testing/gmock",
+    "//testing/gtest",
+    "//url",
+  ]
+}

components/sessions/content/brave_content_serialized_navigation_driver_unittest.cc

@@ -0,0 +1,45 @@
+/* Copyright (c) 2022 The Brave Authors. All rights reserved.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "components/sessions/content/content_serialized_navigation_driver.h"
+
+#include "components/sessions/core/serialized_navigation_entry.h"
+#include "components/sessions/core/serialized_navigation_entry_test_helper.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace sessions {
+
+// Tests that PageState data is properly sanitized when post data is present.
+TEST(BraveContentSerializedNavigationDriverTest,
+     PickleSanitizationWithPostDataForChromePages) {
+  ContentSerializedNavigationDriver* driver =
+      ContentSerializedNavigationDriver::GetInstance();
+  SerializedNavigationEntry navigation =
+      SerializedNavigationEntryTestHelper::CreateNavigationForTest();
+  ASSERT_TRUE(navigation.has_post_data());
+
+  // When post data is present, the page state should be sanitized.
+  EXPECT_EQ(std::string(), driver->GetSanitizedPageStateForPickle(&navigation));
+
+  navigation.set_virtual_url(GURL("chrome://wallet"));
+  EXPECT_EQ(std::string(), driver->GetSanitizedPageStateForPickle(&navigation));
+}
+
+// Tests that PageState data is left unsanitized when post data is absent.
+TEST(BraveContentSerializedNavigationDriverTest,
+     PickleSanitizationNoPostDataForChromePages) {
+  ContentSerializedNavigationDriver* driver =
+      ContentSerializedNavigationDriver::GetInstance();
+  SerializedNavigationEntry navigation =
+      SerializedNavigationEntryTestHelper::CreateNavigationForTest();
+  SerializedNavigationEntryTestHelper::SetHasPostData(false, &navigation);
+  ASSERT_FALSE(navigation.has_post_data());
+  EXPECT_EQ(test_data::kEncodedPageState,
+            driver->GetSanitizedPageStateForPickle(&navigation));
+  navigation.set_virtual_url(GURL("chrome://wallet"));
+  EXPECT_EQ(std::string(), driver->GetSanitizedPageStateForPickle(&navigation));
+}
+
+}  // namespace sessions

test/BUILD.gn

@@ -245,6 +245,7 @@ test("brave_unit_tests") {
     "//brave/components/permissions:unit_tests",
     "//brave/components/search_engines:unit_tests",
     "//brave/components/services/ipfs/test:ipfs_service_unit_tests",
+    "//brave/components/sessions/content:unit_tests",
     "//brave/components/sidebar:unit_tests",
     "//brave/components/signin/public/identity_manager:unit_tests",
     "//brave/components/skus/browser:unit_tests",
@@ -825,6 +826,7 @@ if (!is_android) {
       "//brave/components/l10n/common",
       "//brave/components/ntp_background_images/buildflags",
       "//brave/components/resources:strings_grit",
+      "//brave/components/sessions/browser:browser_tests",
       "//brave/components/skus/common",
       "//brave/components/tor",
       "//brave/renderer/skus:browser_tests",