Merge pull request #13139 from brave/pr13127_issues/22493_1.39.x

Don't enable 1PES everywhere when global SESSION_ONLY mode is enabled. (uplift to 1.39.x)
brave · Apr 23, 2022 · 3d2b8f9 · 3d2b8f9
2 parents d753d51 + 1d1ec7f
commit 3d2b8f9
Show file tree

Hide file tree

Showing 3 changed files with 94 additions and 5 deletions.
diff --git a/browser/ephemeral_storage/ephemeral_storage_1p_browsertest.cc b/browser/ephemeral_storage/ephemeral_storage_1p_browsertest.cc
@@ -417,6 +417,73 @@ IN_PROC_BROWSER_TEST_F(EphemeralStorage1pBrowserTest,
   ExpectValuesFromFramesAreEmpty(FROM_HERE, GetValuesFromFrames(site_a_tab2));
 }
 
+IN_PROC_BROWSER_TEST_F(EphemeralStorage1pBrowserTest,
+                       PRE_DontEnable1PESWithGlobalSessionOnlyToggle) {
+  content_settings()->SetDefaultContentSetting(
+      ContentSettingsType::COOKIES,
+      ContentSetting::CONTENT_SETTING_SESSION_ONLY);
+
+  WebContents* site_a_tab = LoadURLInNewTab(a_site_ephemeral_storage_url_);
+
+  SetValuesInFrames(site_a_tab, "a.com", "from=a.com");
+  {
+    ValuesFromFrames site_a_tab_values = GetValuesFromFrames(site_a_tab);
+    EXPECT_EQ("a.com", site_a_tab_values.main_frame.local_storage);
+    EXPECT_EQ("a.com", site_a_tab_values.iframe_1.local_storage);
+    EXPECT_EQ("a.com", site_a_tab_values.iframe_2.local_storage);
+
+    EXPECT_EQ("a.com", site_a_tab_values.main_frame.session_storage);
+    EXPECT_EQ("a.com", site_a_tab_values.iframe_1.session_storage);
+    EXPECT_EQ("a.com", site_a_tab_values.iframe_2.session_storage);
+
+    EXPECT_EQ("from=a.com", site_a_tab_values.main_frame.cookies);
+    EXPECT_EQ("from=a.com", site_a_tab_values.iframe_1.cookies);
+    EXPECT_EQ("from=a.com", site_a_tab_values.iframe_2.cookies);
+  }
+
+  WebContents* site_b_tab = LoadURLInNewTab(b_site_ephemeral_storage_url_);
+  ExpectValuesFromFramesAreEmpty(FROM_HERE, GetValuesFromFrames(site_b_tab));
+
+  CloseWebContents(site_a_tab);
+
+  // Load a.com tab again, expect non-ephemeral values are kept.
+  site_a_tab = LoadURLInNewTab(a_site_ephemeral_storage_url_);
+  {
+    ValuesFromFrames site_a_tab_values = GetValuesFromFrames(site_a_tab);
+    EXPECT_EQ("a.com", site_a_tab_values.main_frame.local_storage);
+    EXPECT_EQ(nullptr, site_a_tab_values.iframe_1.local_storage);
+    EXPECT_EQ(nullptr, site_a_tab_values.iframe_2.local_storage);
+
+    EXPECT_EQ(nullptr, site_a_tab_values.main_frame.session_storage);
+    EXPECT_EQ(nullptr, site_a_tab_values.iframe_1.session_storage);
+    EXPECT_EQ(nullptr, site_a_tab_values.iframe_2.session_storage);
+
+    EXPECT_EQ("from=a.com", site_a_tab_values.main_frame.cookies);
+    EXPECT_EQ("", site_a_tab_values.iframe_1.cookies);
+    EXPECT_EQ("", site_a_tab_values.iframe_2.cookies);
+  }
+  CloseWebContents(site_a_tab);
+}
+
+IN_PROC_BROWSER_TEST_F(EphemeralStorage1pBrowserTest,
+                       DontEnable1PESWithGlobalSessionOnlyToggle) {
+  // Load a.com after browser reopen, expect all values are cleared, because
+  // global CONTENT_SETTING_SESSION_ONLY mode is enabled.
+  WebContents* site_a_tab = LoadURLInNewTab(a_site_ephemeral_storage_url_);
+  ValuesFromFrames site_a_tab_values = GetValuesFromFrames(site_a_tab);
+  EXPECT_EQ(nullptr, site_a_tab_values.main_frame.local_storage);
+  EXPECT_EQ(nullptr, site_a_tab_values.iframe_1.local_storage);
+  EXPECT_EQ(nullptr, site_a_tab_values.iframe_2.local_storage);
+
+  EXPECT_EQ(nullptr, site_a_tab_values.main_frame.session_storage);
+  EXPECT_EQ(nullptr, site_a_tab_values.iframe_1.session_storage);
+  EXPECT_EQ(nullptr, site_a_tab_values.iframe_2.session_storage);
+
+  EXPECT_EQ("", site_a_tab_values.main_frame.cookies);
+  EXPECT_EQ("", site_a_tab_values.iframe_1.cookies);
+  EXPECT_EQ("", site_a_tab_values.iframe_2.cookies);
+}
+
 IN_PROC_BROWSER_TEST_F(
     EphemeralStorage1pBrowserTest,
     DisabledShieldsAllowsPersistentCookiesFor1PesHostsIn3pFrames) {

diff --git a/chromium_src/components/content_settings/core/common/cookie_settings_base.cc b/chromium_src/components/content_settings/core/common/cookie_settings_base.cc
@@ -60,6 +60,12 @@ bool IsFirstPartyAccessAllowed(
   return cookie_settings->IsAllowed(setting);
 }
 
+bool IsSessionOnlyExplicit(
+    const CookieSettingWithBraveMetadata& setting_with_brave_metadata) {
+  return setting_with_brave_metadata.setting == CONTENT_SETTING_SESSION_ONLY &&
+         setting_with_brave_metadata.IsExplicitSetting();
+}
+
 }  // namespace
 
 CookieSettingsBase::CookieSettingsBase() = default;
@@ -77,6 +83,11 @@ CookieSettingWithBraveMetadata& CookieSettingWithBraveMetadata::operator=(
     CookieSettingWithBraveMetadata&&) = default;
 CookieSettingWithBraveMetadata::~CookieSettingWithBraveMetadata() = default;
 
+bool CookieSettingWithBraveMetadata::IsExplicitSetting() const {
+  return !primary_pattern_matches_all_hosts ||
+         !secondary_pattern_matches_all_hosts;
+}
+
 bool CookieSettingsBase::ShouldUseEphemeralStorage(
     const GURL& url,
     const net::SiteForCookies& site_for_cookies,
@@ -92,10 +103,14 @@ bool CookieSettingsBase::ShouldUseEphemeralStorage(
 
   // Enable ephemeral storage for a first party URL if SESSION_ONLY cookie
   // setting is set and the feature is enabled.
+  absl::optional<CookieSettingWithBraveMetadata> first_party_setting;
   if (base::FeatureList::IsEnabled(
-          net::features::kBraveFirstPartyEphemeralStorage) &&
-      IsCookieSessionOnly(first_party_url)) {
-    return true;
+          net::features::kBraveFirstPartyEphemeralStorage)) {
+    first_party_setting =
+        GetCookieSettingWithBraveMetadata(first_party_url, first_party_url);
+    if (IsSessionOnlyExplicit(*first_party_setting)) {
+      return true;
+    }
   }
 
   if (net::registry_controlled_domains::SameDomainOrHost(
@@ -105,7 +120,9 @@ bool CookieSettingsBase::ShouldUseEphemeralStorage(
 
   bool allow_3p =
       IsCookieAccessAllowedImpl(url, site_for_cookies, top_frame_origin);
-  bool allow_1p = IsFirstPartyAccessAllowed(first_party_url, this);
+  bool allow_1p = first_party_setting
+                      ? IsAllowed(first_party_setting->setting)
+                      : IsFirstPartyAccessAllowed(first_party_url, this);
 
   // only use ephemeral storage for block 3p
   return allow_1p && !allow_3p;
@@ -180,7 +197,8 @@ bool CookieSettingsBase::IsCookieAccessAllowedImpl(
     CookieSettingWithBraveMetadata setting_with_brave_metadata =
         GetCookieSettingWithBraveMetadata(first_party_url, first_party_url);
 
-    if (setting_with_brave_metadata.setting == CONTENT_SETTING_SESSION_ONLY) {
+    // Ephemeral mode for the main frame can be enabled only via explicit rule.
+    if (IsSessionOnlyExplicit(setting_with_brave_metadata)) {
       main_frame_mode = MainFrameMode::kEphemeral;
     } else {
       // Disabled shields mode allows everything in nested frames. To properly

diff --git a/chromium_src/components/content_settings/core/common/cookie_settings_base.h b/chromium_src/components/content_settings/core/common/cookie_settings_base.h
@@ -22,6 +22,10 @@ struct CookieSettingWithBraveMetadata {
   CookieSettingWithBraveMetadata& operator=(CookieSettingWithBraveMetadata&&);
   ~CookieSettingWithBraveMetadata();
 
+  // Return true if any of the patterns is not "*", similar to
+  // content_settings::IsExplicitSetting().
+  bool IsExplicitSetting() const;
+
   ContentSetting setting = CONTENT_SETTING_DEFAULT;
   bool primary_pattern_matches_all_hosts = false;
   bool secondary_pattern_matches_all_hosts = false;