Implement third party fingerprinting protection

BUILD.gn

@@ -17,6 +17,7 @@ group("child_dependencies") {
 group("browser_dependencies") {
   public_deps = [
     "//brave/browser",
+    "//brave/components/content_settings/core/browser",
     "//brave/extensions",
     "common",
     ":brave_framework_resources",

components/content_settings/core/browser/BUILD.gn

@@ -0,0 +1,12 @@
+source_set("browser") {
+  sources = [
+    "brave_host_content_settings_map.cc",
+    "brave_host_content_settings_map.h",
+  ]
+
+  deps = [
+  ]
+
+  public_deps = [
+  ]
+}

components/content_settings/core/browser/brave_host_content_settings_map.cc

@@ -0,0 +1,29 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "brave/components/content_settings/core/browser/brave_host_content_settings_map.h"
+
+#include "components/content_settings/core/common/content_settings_pattern.h"
+
+BraveHostContentSettingsMap::BraveHostContentSettingsMap(
+    PrefService* prefs,
+    bool is_incognito_profile,
+    bool is_guest_profile,
+    bool store_last_modified)
+    : HostContentSettingsMap(prefs, is_incognito_profile, is_guest_profile,
+        store_last_modified) {
+  InitializeFingerprintingContentSetting();
+}
+
+BraveHostContentSettingsMap::~BraveHostContentSettingsMap() {
+}
+
+void BraveHostContentSettingsMap::InitializeFingerprintingContentSetting() {
+  SetContentSettingCustomScope(
+      ContentSettingsPattern::Wildcard(),
+      ContentSettingsPattern::FromString("https://firstParty/*"),
+      CONTENT_SETTINGS_TYPE_PLUGINS,
+      "fingerprinting",
+      CONTENT_SETTING_ALLOW);
+}

components/content_settings/core/browser/brave_host_content_settings_map.h

@@ -0,0 +1,21 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef BRAVE_COMPONENTS_CONTENT_SETTINGS_CORE_BROWSER_BRAVE_HOST_CONTENT_SETTINGS_MAP_H_
+#define BRAVE_COMPONENTS_CONTENT_SETTINGS_CORE_BROWSER_BRAVE_HOST_CONTENT_SETTINGS_MAP_H_
+
+#include "components/content_settings/core/browser/host_content_settings_map.h"
+
+class BraveHostContentSettingsMap : public HostContentSettingsMap {
+ public:
+   BraveHostContentSettingsMap(PrefService* prefs,
+                               bool is_incognito_profile,
+                               bool is_guest_profile,
+                               bool store_last_modified);
+ private:
+   void InitializeFingerprintingContentSetting();
+   ~BraveHostContentSettingsMap() override;
+};
+
+#endif // BRAVE_COMPONENTS_CONTENT_SETTINGS_CORE_BROWSER_BRAVE_HOST_CONTENT_SETTINGS_MAP_H_

patches/chrome-browser-content_settings-host_content_settings_map_factory.cc.patch

@@ -0,0 +1,21 @@
+diff --git a/chrome/browser/content_settings/host_content_settings_map_factory.cc b/chrome/browser/content_settings/host_content_settings_map_factory.cc
+index 7bb265a57ba4c03489743add26adaeea40a9fb06..3f6b1af25a0118ac2b6d388948f0dee49d32f78a 100644
+--- a/chrome/browser/content_settings/host_content_settings_map_factory.cc
++++ b/chrome/browser/content_settings/host_content_settings_map_factory.cc
+@@ -7,6 +7,7 @@
+ #include <utility>
+ 
+ #include "base/feature_list.h"
++#include "brave/components/content_settings/core/browser/brave_host_content_settings_map.h"
+ #include "chrome/browser/profiles/off_the_record_profile_impl.h"
+ #include "chrome/browser/profiles/profile.h"
+ #include "chrome/common/chrome_features.h"
+@@ -81,7 +82,7 @@ scoped_refptr<RefcountedKeyedService>
+ 
+   bool store_last_modified = base::FeatureList::IsEnabled(features::kTabsInCbd);
+ 
+-  scoped_refptr<HostContentSettingsMap> settings_map(new HostContentSettingsMap(
++  scoped_refptr<HostContentSettingsMap> settings_map(new BraveHostContentSettingsMap(
+       profile->GetPrefs(),
+       profile->GetProfileType() == Profile::INCOGNITO_PROFILE,
+       profile->GetProfileType() == Profile::GUEST_PROFILE,

patches/chrome-renderer-content_settings_observer.cc.patch

@@ -1,27 +0,0 @@
-diff --git a/chrome/renderer/content_settings_observer.cc b/chrome/renderer/content_settings_observer.cc
-index f3947e48b3a67f534772366ce3ff45bdcc13eb39..c4b62d9087eb65a31085c61306de13eb70ecdce2 100644
---- a/chrome/renderer/content_settings_observer.cc
-+++ b/chrome/renderer/content_settings_observer.cc
-@@ -71,10 +71,12 @@ GURL GetOriginOrURL(const WebFrame* frame) {
-   return top_origin.GetURL();
- }
- 
-+} // namespace
-+
- // Allow passing both WebURL and GURL here, so that we can early return without
- // allocating a new backing string if only the default rule matches.
- template <typename URL>
--ContentSetting GetContentSettingFromRules(
-+ContentSetting ContentSettingsObserver::GetContentSettingFromRules(
-     const ContentSettingsForOneType& rules,
-     const WebFrame* frame,
-     const URL& secondary_url) {
-@@ -97,6 +99,8 @@ ContentSetting GetContentSettingFromRules(
-   return CONTENT_SETTING_DEFAULT;
- }
- 
-+namespace {
-+
- bool IsScriptDisabledForPreview(const content::RenderFrame* render_frame) {
-   return render_frame->GetPreviewsState() & content::NOSCRIPT_ON;
- }

patches/chrome-renderer-content_settings_observer.h.patch

@@ -1,5 +1,5 @@
 diff --git a/chrome/renderer/content_settings_observer.h b/chrome/renderer/content_settings_observer.h
-index 8030dcd98b1fc0e227fe07258c4f7f4ecf7fc46f..6532c1de6fc3fbd0f88d6fdcd4ed3bfcd7528b6d 100644
+index 8030dcd98b1fc0e227fe07258c4f7f4ecf7fc46f..249155b16e5faa0ef70d81c08377a4d3e0036fc2 100644
 --- a/chrome/renderer/content_settings_observer.h
 +++ b/chrome/renderer/content_settings_observer.h
 @@ -103,6 +103,7 @@ class ContentSettingsObserver
@@ -10,16 +10,3 @@ index 8030dcd98b1fc0e227fe07258c4f7f4ecf7fc46f..6532c1de6fc3fbd0f88d6fdcd4ed3bfc
    FRIEND_TEST_ALL_PREFIXES(ContentSettingsObserverTest, WhitelistedSchemes);
    FRIEND_TEST_ALL_PREFIXES(ContentSettingsObserverBrowserTest,
                             ContentSettingsInterstitialPages);
-@@ -149,6 +150,12 @@ class ContentSettingsObserver
-       const blink::WebSecurityOrigin& origin,
-       const blink::WebURL& document_url);
- 
-+  template <typename URL>
-+  ContentSetting GetContentSettingFromRules(
-+      const ContentSettingsForOneType& rules,
-+      const blink::WebFrame* frame,
-+      const URL& secondary_url);
-+
- #if BUILDFLAG(ENABLE_EXTENSIONS)
-   // Owned by ChromeContentRendererClient and outlive us.
-   extensions::Dispatcher* const extension_dispatcher_;

patches/components-content_settings-core-browser-host_content_settings_map.h.patch

@@ -0,0 +1,12 @@
+diff --git a/components/content_settings/core/browser/host_content_settings_map.h b/components/content_settings/core/browser/host_content_settings_map.h
+index 890e8959ae155618b78661dc8e97a81332d654f8..2a1f562e3b37ce85c3de48ea3f753c34c8586bbd 100644
+--- a/components/content_settings/core/browser/host_content_settings_map.h
++++ b/components/content_settings/core/browser/host_content_settings_map.h
+@@ -303,6 +303,7 @@ class HostContentSettingsMap : public content_settings::Observer,
+   }
+ 
+  private:
++  friend class BraveHostContentSettingsMap;
+   friend class base::RefCountedThreadSafe<HostContentSettingsMap>;
+   friend class content_settings::TestUtils;
+ 

renderer/brave_content_settings_observer.cc

@@ -6,6 +6,7 @@
 
 #include "base/strings/utf_string_conversions.h"
 #include "brave/common/render_messages.h"
+#include "components/content_settings/core/common/content_settings_pattern.h"
 #include "content/public/renderer/render_frame.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
@@ -46,6 +47,45 @@ void BraveContentSettingsObserver::DidBlockFingerprinting(
   Send(new BraveViewHostMsg_FingerprintingBlocked(routing_id(), details));
 }
 
+GURL BraveContentSettingsObserver::GetOriginOrURL(const blink::WebFrame* frame) {
+  url::Origin top_origin = url::Origin(frame->Top()->GetSecurityOrigin());
+  // The |top_origin| is unique ("null") e.g., for file:// URLs. Use the
+  // document URL as the primary URL in those cases.
+  // TODO(alexmos): This is broken for --site-per-process, since top() can be a
+  // WebRemoteFrame which does not have a document(), and the WebRemoteFrame's
+  // URL is not replicated.  See https://crbug.com/628759.
+  if (top_origin.unique() && frame->Top()->IsWebLocalFrame())
+    return frame->Top()->ToWebLocalFrame()->GetDocument().Url();
+  return top_origin.GetURL();
+}
+
+ContentSetting BraveContentSettingsObserver::GetContentSettingFromRules(
+    const ContentSettingsForOneType& rules,
+    const blink::WebLocalFrame* frame,
+    const GURL& secondary_url) {
+
+  const GURL& primary_url = GetOriginOrURL(frame);
+
+  for (const auto& rule : rules) {
+    ContentSettingsPattern secondary_pattern = rule.secondary_pattern;
+    if (rule.secondary_pattern ==
+        ContentSettingsPattern::FromString("https://firstParty/*")) {
+      secondary_pattern = ContentSettingsPattern::FromString(
+          "[*.]" + GetOriginOrURL(frame).HostNoBrackets());
+    }
+
+    if (rule.primary_pattern.Matches(primary_url) &&
+        (secondary_pattern == ContentSettingsPattern::Wildcard() ||
+         secondary_pattern.Matches(secondary_url))) {
+      return rule.GetContentSetting();
+    }
+  }
+
+  // for cases which are third party resources and doesn't match any existing
+  // rules, block them by default
+  return CONTENT_SETTING_BLOCK;
+}
+
 bool BraveContentSettingsObserver::AllowFingerprinting(
     bool enabled_per_settings) {
   if (!enabled_per_settings)

renderer/brave_content_settings_observer.h

@@ -7,8 +7,13 @@
 
 #include "base/strings/string16.h"
 #include "chrome/renderer/content_settings_observer.h"
+#include "components/content_settings/core/common/content_settings.h"
 #include "components/content_settings/core/common/content_settings_types.h"
 
+namespace blink {
+class WebLocalFrame;
+}
+
 // Handles blocking content per content settings for each RenderFrame.
 class BraveContentSettingsObserver
     : public ContentSettingsObserver {
@@ -31,6 +36,14 @@ class BraveContentSettingsObserver
   void DidBlockFingerprinting(
     const base::string16& details);
 
+ private:
+  GURL GetOriginOrURL(const blink::WebFrame* frame);
+
+  ContentSetting GetContentSettingFromRules(
+      const ContentSettingsForOneType& rules,
+      const blink::WebLocalFrame* frame,
+      const GURL& secondary_url);
+
   DISALLOW_COPY_AND_ASSIGN(BraveContentSettingsObserver);
 };