[C129] [Android] Fix for brave scheme pages #25602
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Chromium change: https://source.chromium.org/chromium/chromium/src/+/4d2cab773589a430dfae515994c3e6cad0eb0270 [M129] Disallow VerbatimMatches to open non-navigable URLs by default. This change prevents non-navigable URLs from being opened upon paste, refine, autocomplete etc., effectively disallowing accidental execution of inline javascript: blocks. The non-navigable (e.g. executable) URIs will be effectively pushed down on the suggestions list, making them still available, but moving forward these will require an explicit user action to be invoked (i.e. the user now has to intentionally tap these suggestions to initiate the corresponding action). The change removes redundant test that relies on inline page injection. This is already covered by another test: http://shortn/_NG1M484b41 (cherry picked from commit 04938340e1a93e5e5588badd5e01600dd3356d52) Bug: b/360642942
mkarolin
reviewed
Sep 17, 2024
|
|
||
| #include "components/omnibox/browser/verbatim_match.h" | ||
|
|
||
| #include "content/public/common/url_constants.h" |
There was a problem hiding this comment.
I think this include should also be under #if BUILDFLAG(IS_ANDROID), but they didn't do it right upstream, so we can probably just keep it the same for now.
There was a problem hiding this comment.
I think it will fail on iOS if we keep it like this, actually, but we can see what CI says.
There was a problem hiding this comment.
iOS passed, as @mkarolin mentioned they don't guard it in the upstream as well, so should be ok for us too
There was a problem hiding this comment.
It passed iOS because of 97aab4f, but we will remove that fix at some point (hopefully, brave/brave-browser#41014) and then we would have to update the override here as well.
brave-builds
added a commit
that referenced
this pull request
Sep 17, 2024
brave-builds
added a commit
that referenced
this pull request
Sep 17, 2024
This was referenced Sep 17, 2024
|
Verification PASSED on
|
kjozwiak
pushed a commit
that referenced
this pull request
Sep 18, 2024
Uplift of #25602 (squashed) to beta
kjozwiak
pushed a commit
that referenced
this pull request
Sep 18, 2024
Uplift of #25602 (squashed) to release
6 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Chromium change:
https://source.chromium.org/chromium/chromium/src/+/4d2cab773589a430dfae515994c3e6cad0eb0270
[M129] Disallow VerbatimMatches to open non-navigable URLs by default.
This change prevents non-navigable URLs from being opened upon paste, refine, autocomplete etc., effectively disallowing accidental execution of inline javascript: blocks.
The non-navigable (e.g. executable) URIs will be effectively pushed down on the suggestions list, making them still available, but moving forward these will require an explicit user action to be invoked (i.e. the user now has to intentionally tap these suggestions to initiate the corresponding action).
The change removes redundant test that relies on inline page injection. This is already covered by another test: http://shortn/_NG1M484b41
(cherry picked from commit 04938340e1a93e5e5588badd5e01600dd3356d52)
Bug: b/360642942
Resolves brave/brave-browser#41069
Submitter Checklist:
QA/YesorQA/No;release-notes/includeorrelease-notes/exclude;OS/...) to the associated issuenpm run test -- brave_browser_tests,npm run test -- brave_unit_testswikinpm run presubmitwiki,npm run gn_check,npm run tslintgit rebase master(if needed)Reviewer Checklist:
gnAfter-merge Checklist:
changes has landed on
Test Plan: