New issue
Advanced search Search tips

Issue 808137 link

Starred by 2 users
Status: Fixed
Owner:
torne@chromium.org
Closed: Mar 2018
Cc:
torne@chromium.org
tobiasjs@chromium.org
ntfschr@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 2
Type: Bug

Blocked on:
issue 777737


Sign in to add a comment

WebView should disallow file: MIME type sniffing for apps that target new OS versions

Project Member Reported by torne@chromium.org, Feb 1 2018 
The MIME type sniffing for file: URLs was disabled for other platforms in  issue 777737  but this was left enabled for WebView as existing apps may be relying on it (using file: URLs that don't have .htm or .html extensions and expecting them to render as HTML).

We should disallow this for apps targeting P and later and require that the file extensions be correct, as this is a security feature.

See my comments on https://chromium-review.googlesource.com/853036 for some of the considerations about implementing this (wanting to cache the value appropriately).
Project Member

Comment 1 by bugdroid1@chromium.org, Mar 20 2018 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b6e210a40d04c74aa2bc7dfee2d4f56da8b47e2a

commit b6e210a40d04c74aa2bc7dfee2d4f56da8b47e2a
Author: Torne (Richard Coles) <torne@google.com>
Date: Tue Mar 20 16:54:52 2018

Disallow file: URL type sniffing for apps that target P.

WebView was exempted from the change in
https://chromium-review.googlesource.com/853036 to disallow MIME type
sniffing for file: URLs as existing apps rely on this. Check the
application target API level and disallow it for apps that target P or
later.

Bug:  808137 
Change-Id: I12378d914caa006c4c9fe321fd4007e990ff95fd
Reviewed-on: https://chromium-review.googlesource.com/911754
Reviewed-by: Tobias Sargeant <tobiasjs@chromium.org>
Commit-Queue: Richard Coles <torne@chromium.org>
Cr-Commit-Position: refs/heads/master@{#544409}
[modify] https://crrev.com/b6e210a40d04c74aa2bc7dfee2d4f56da8b47e2a/android_webview/browser/aw_content_browser_client.cc
[modify] https://crrev.com/b6e210a40d04c74aa2bc7dfee2d4f56da8b47e2a/android_webview/browser/aw_content_browser_client.h
[modify] https://crrev.com/b6e210a40d04c74aa2bc7dfee2d4f56da8b47e2a/android_webview/browser/aw_settings.cc
[modify] https://crrev.com/b6e210a40d04c74aa2bc7dfee2d4f56da8b47e2a/android_webview/browser/aw_settings.h
[modify] https://crrev.com/b6e210a40d04c74aa2bc7dfee2d4f56da8b47e2a/android_webview/java/src/org/chromium/android_webview/AwSettings.java

Comment 2 by torne@chromium.org, Mar 20 2018

Labels: Merge-Request-66 OS-Android
Project Member

Comment 3 by sheriffbot@chromium.org, Mar 20 2018

Labels: -Merge-Request-66 Merge-Review-66 Hotlist-Merge-Review
This bug requires manual review: M66 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 4 by ntfschr@chromium.org, Mar 20 2018

Cc: ntfschr@chromium.org
Owner: torne@chromium.org
Status: Assigned (was: Available)

Comment 5 by cmasso@google.com, Mar 20 2018 

Please verify in the next canary

Comment 6 by cmasso@google.com, Mar 23 2018 

Ping!

Comment 7 by torne@chromium.org, Mar 23 2018 

Sorry; verified manually on 67.0.3379.0.

Comment 8 by cmasso@google.com, Mar 26 2018

Labels: -Hotlist-Merge-Review -Merge-Review-66 Merge-Approved-66
Project Member

Comment 9 by bugdroid1@chromium.org, Mar 26 2018

Labels: -merge-approved-66 merge-merged-3359
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c9319955d9cd479f998628f93032d7ac4a111b9d

commit c9319955d9cd479f998628f93032d7ac4a111b9d
Author: Torne (Richard Coles) <torne@google.com>
Date: Mon Mar 26 19:35:11 2018

Disallow file: URL type sniffing for apps that target P.

WebView was exempted from the change in
https://chromium-review.googlesource.com/853036 to disallow MIME type
sniffing for file: URLs as existing apps rely on this. Check the
application target API level and disallow it for apps that target P or
later.

TBR=torne@google.com

(cherry picked from commit b6e210a40d04c74aa2bc7dfee2d4f56da8b47e2a)

Bug:  808137 
Change-Id: I12378d914caa006c4c9fe321fd4007e990ff95fd
Reviewed-on: https://chromium-review.googlesource.com/911754
Reviewed-by: Tobias Sargeant <tobiasjs@chromium.org>
Commit-Queue: Richard Coles <torne@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#544409}
Reviewed-on: https://chromium-review.googlesource.com/980955
Reviewed-by: Richard Coles <torne@chromium.org>
Cr-Commit-Position: refs/branch-heads/3359@{#448}
Cr-Branched-From: 66afc5e5d10127546cc4b98b9117aff588b5e66b-refs/heads/master@{#540276}
[modify] https://crrev.com/c9319955d9cd479f998628f93032d7ac4a111b9d/android_webview/browser/aw_content_browser_client.cc
[modify] https://crrev.com/c9319955d9cd479f998628f93032d7ac4a111b9d/android_webview/browser/aw_content_browser_client.h
[modify] https://crrev.com/c9319955d9cd479f998628f93032d7ac4a111b9d/android_webview/browser/aw_settings.cc
[modify] https://crrev.com/c9319955d9cd479f998628f93032d7ac4a111b9d/android_webview/browser/aw_settings.h
[modify] https://crrev.com/c9319955d9cd479f998628f93032d7ac4a111b9d/android_webview/java/src/org/chromium/android_webview/AwSettings.java

Comment 10 by torne@chromium.org, Mar 26 2018

Status: Fixed (was: Assigned)
Need to update android-side docs and release notes but chromium side is done.
►

Sign in to add a comment