New issue
Advanced search Search tips

Issue 894871 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Guard to disable Previews features on desktop unless testing

Project Member Reported by creis@chromium.org, Oct 12

Issue description

IIUC, Previews features are meant for Android-only, but they are currently tested on Linux because there are no Android browser_tests (see issue 611756).  They can also be enabled as a base::Feature on Linux to allow manual testing for development/debugging.  See:
https://cs.chromium.org/chromium/src/components/previews/core/previews_features.cc?rcl=cb343f3c5acf70010afafa8c498ff5104a533493&l=15

However, there's an unnecessary risk of accidentally enabling these features on desktop via field trial configs (which has happened to other features in the past).  I'm concerned about this for Previews, since there are security risks for some of the features if they became enabled on desktop.  For example, content scripts might inject into Lite pages and run active script in a page that was meant to be passive by design, possibly violating some of the guarantees of that mode.

It would be better to have a guard to ensure that the kPreviews feature can't be enabled on desktop platforms via Finch, unless we're either inside a test or a developer runs with a command line flag to make it possible.

This could be done by setting a boolean in something like a EnableDesktopPreviewsForTesting method, and checking for that or a --enable-desktop-previews-for-testing flag within previews::params::ArePreviewsAllowed().
 
Cc: -robertogden@chromium.org
Owner: robertogden@chromium.org
Status: Assigned (was: Untriaged)
Refreshed during triage.
Labels: Hotlist-GoodFirstBug
Robert, are you planning to do this? I'm looking for a couple of easy starter bugs and this might be a good one for me to grab. Thanks!

Cc: robertogden@chromium.org
Owner: ----
Help yourself :)
PS: Feel free to wheel over and chat about this. I've thought about it a little but haven't done any actual coding
Refreshed during triage.

Sign in to add a comment