New issue
Advanced search Search tips

Issue 893350 link

Starred by 1 user

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 3
Type: Bug



Sign in to add a comment

base64 decode not performed on official build.

Project Member Reported by cmumford@chromium.org, Oct 8

Issue description

It appears as though:

  NetInternalsMessageHandler::IOThreadImpl::OnExpectCTTestReport()

has a call to base64 decode a certificate that will be compiled away in an official build.

  std::string decoded_dummy_cert;
  DCHECK(base::Base64Decode(kTestReportCert, &decoded_dummy_cert));

This should be investigated and likely fixed.

https://cs.chromium.org/chromium/src/chrome/browser/ui/webui/net_internals/net_internals_ui.cc?l=648&rcl=c363b5b5f180353ffd6c926f17a484cb3c5a6051
 
Components: -Internals>Network>Logging Internals>Network>CertTrans
Cc: eroman@chromium.org
Components: -Internals>Network>CertTrans Internals>Network>Logging
Moving back to Internals>Network>Logging - it's a chrome://net-internals issue with simulating a test report, not CT.

Everything 'works' in terms of the code (hence no crashes), it just sends an empty cert chain in the test report instead of a dummy cert chain.

I think the plan is to rip this code out entirely, if chrome://net-internals is gone gone now.
Cc: rsleevi@chromium.org
This is owned by the CT team, isn't it?  Generally everything is owned by their corresponding teams (Except for the core events tab, and the associated polling information, which has all been removed).
"the CT team" is a bit confusing. No, it's not owned by the London team that runs the CT servers in Chrome, nor is it owned by the folks on Chrome Networking who work on CT. This is related to Expect-CT, which has actually been owned by Enamel/OWP, as it relates to the Expect-CT header. We don't have a dedicated component for "security headers".

It's also a bug in chrome://net-internals. If the description for Internals>Network>Logging is not correct, that should be fixed.
> I think the plan is to rip this code out entirely, if chrome://net-internals is gone gone now.

No, the #hsts tab is being kept.
I'll defer to eroman, but my general feeling if "If it's someone else's debugging code, and I have no familiarity with the APIs or data structures being used, it makes no sense for me to maintain this code."
Cc: est...@chromium.org
Labels: Enterprise-Triaged

Sign in to add a comment