Full hash responses are parsed correctly only for certain threat types |
|||
Issue descriptionIn ParseMetadata, if match.threat_type() isn't one of the following, we consider the response invalid and return UNEXPECTED_THREAT_TYPE_ERROR: * API_ABUSE * MALWARE_THREAT * POTENTIALLY_HARMFUL_APPLICATION * SOCIAL_ENGINEERING_PUBLIC This is incorrect since it fails to parse any full hash responses for other threat types, such as UWS.
,
Oct 27 2016
Failure to parse the metadata should not lead to discarding the entire full hash response. Consider the following case: 1. example.com/hello goes on the API blacklist. 2. due to a change/bug in the server code related to metadata, the server stops sending the metadata or sends it in a different format. 3. Clients fail to parse the metadata and discard all full hash responses for that full hash. 4. example.com/hello can now not only abuse API, it can also start phishing since Chrome would always discard the full hash response for that full hash. I am going to change the code in V4GetHashProtocolManager::ParseMetadata() to record the cases when metadata parsing fails (i.e. no change in UMA recording), but that won't discard the full hash response. kcarattini@, awoz@: Let me know if you think that's incorrect. I'll CC you on the CL.
,
Oct 27 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4588549b86714ddb6b770a7ef420043c49b6af4e commit 4588549b86714ddb6b770a7ef420043c49b6af4e Author: vakh <vakh@chromium.org> Date: Thu Oct 27 23:40:01 2016 Failure to parse full hash metadata shouldn't discard the response. TBR since kcarattini is OOO. BUG= 660133 TBR=kcarattini Review-Url: https://codereview.chromium.org/2458743003 Cr-Commit-Position: refs/heads/master@{#428218} [modify] https://crrev.com/4588549b86714ddb6b770a7ef420043c49b6af4e/components/safe_browsing_db/v4_get_hash_protocol_manager.cc [modify] https://crrev.com/4588549b86714ddb6b770a7ef420043c49b6af4e/components/safe_browsing_db/v4_get_hash_protocol_manager.h [modify] https://crrev.com/4588549b86714ddb6b770a7ef420043c49b6af4e/components/safe_browsing_db/v4_get_hash_protocol_manager_unittest.cc
,
Oct 27 2016
|
|||
►
Sign in to add a comment |
|||
Comment 1 by vakh@chromium.org
, Oct 27 2016