Chromium Code Reviews| OLD | NEW |
|---|---|
| (Empty) | |
| 1 # Behavior of Download File Types in Chrome | |
| 2 | |
| 3 This describes how to adjust file-type download behavior in Chrome including | |
| 4 interactions with Safe Browsing. The metadata in download_file_types.asciipb | |
|
asanka
2016/04/06 02:12:31
Embedded underscores could be interpreted as _emph
Nathan Parker
2016/04/11 20:12:07
yea, hrm. I thought intra-word was disabled. I'l
| |
| 5 is both baked into Chrome and pushable to Chrome between releases. | |
| 6 | |
| 7 Rendered version of this file: https://chromium.googlesource.com/chromium/src/+/ master/chrome/browser/resources/safe_browsing/README.md | |
| 8 | |
| 9 | |
| 10 # Procedure for adding a new type | |
| 11 * Edit `download_file_types.asciipb`. Update `histograms.xml` | |
| 12 * Get it reviewed, submit. | |
| 13 * Push via component update (PROCEDURE TBD) | |
| 14 | |
| 15 # Guidelines for a DownloadFileType entry: | |
| 16 See `download_file_types.proto` for all fields. | |
| 17 * `extension` value must be unique within the config. It should be | |
| 18 lowercase ASCII and not contain a dot. If there _is_ a duplicate, | |
| 19 last one will win. | |
| 20 * `uma_value` value must be unique and match one in the | |
| 21 SBClientDownloadExtensions enum in histograms.xml | |
| 22 * `is_archive`: True if this filetype is a container for other files. | |
| 23 * `platform_settings`: (repeated) Must have one entry with platform=ALL, and | |
| 24 optionally additional entries with overrides for one or more | |
| 25 platforms. platform=ALL acts as a default for any platforms that | |
| 26 don't have an override. There shouldn't be two settings with the | |
| 27 same `platform`, but if there are, last one wins. Keep them sorted | |
| 28 by platform. | |
| 29 * `platform_settings.danger_level`: Required. | |
| 30 * `NOT_DANGEROUS`: Safe to download and open, even if the download | |
| 31 was accidental. | |
| 32 * `DANGEROUS`: Always warn the user that this file may harm their | |
| 33 computer. We let them continue or discard the file. If Safe | |
| 34 Browsing returns a SAFE verdict, we still warn the user. | |
| 35 * `ALLOW_ON_USER_GESTURE`: Warn the user normally but skip the warning | |
| 36 if there was a user gesture or the user visited this site before | |
| 37 midnight last night (i.e. is a repeat visit). If Safe Browsing | |
| 38 returns a SAFE verdict for this file, it won't show a warning. | |
| 39 * `platform_settings.auto_open_hint`: Required. | |
| 40 * `ALLOW_AUTO_OPEN`: File type can be opened automatically if the user | |
| 41 selected that option from the download tray on a previous download | |
| 42 of this type. | |
| 43 * `DISALLOW_AUTO_OPEN`: Never let the file automatically open. | |
| 44 Files that should be disallowed from auto-opening include those that | |
| 45 execute arbitrary or harmful code with user privileges, or change | |
| 46 configuration of the system to cause harmful behavior immediately | |
| 47 or at some time in the future. We *do* allow auto-open for files | |
| 48 that upon opening sufficiently warn the user about the fact that it | |
| 49 was downloaded from the internet and can do damage. (TODO(asanka): | |
| 50 Clarify this sentence: We don't warn for files that... | |
| 51 "do nothing particularly dangerous, despite the act | |
| 52 of downloading itself being dangerous (E.g. .local and .manifest | |
| 53 files)). | |
| 54 * `platform_settings.ping_setting`: Required. This controls what sort | |
| 55 of ping is sent to Safe Browsing and if a verdict is checked before | |
| 56 the user can access the file. | |
| 57 * `SAMPLE_WITH_LIGHT_PING`: Don't send a full Safe Browsing ping, but | |
| 58 send a no-PII "light-ping" for a random sample of SBER users. | |
| 59 This should be the default for unknown types. The verdict won't be | |
| 60 used. | |
| 61 * `NO_PING`: Don’t send any pings. This file is whitelisted. All | |
| 62 NOT_DANGEROUS files should normally use this. | |
| 63 * `FULL_PING`: Send full pings and use the verdict. All dangerous | |
| 64 file should use this. | |
| 65 | |
| 66 # Guidelines for the top level DownloadFileTypeConfig entry: | |
| 67 * `version_id`: Must be increased (+1) every time the file is checked in. | |
| 68 Will be logged to UMA. | |
| 69 | |
| 70 * `light_ping_probability`: For what fraction of extended-reporting users' | |
| 71 downloads with unknown extensions (or ping_setting=TREAT_AS_UNKNOWN) | |
| 72 should we send light-pings? [0..1] | |
| 73 | |
| 74 * `file_type`: The big list of all known file types. Keep them | |
| 75 sorted by extension. | |
| 76 | |
| 77 * `default_file_type`: Settings used if a file is not in the above list. | |
| 78 `extension` is ignored, but other settings are used. The ping_setting | |
| 79 should be TREAT_AS_UNKNOWN for all platforms. | |
| 80 | |
| OLD | NEW |