OLD | NEW |
---|---|
(Empty) | |
1 # Behavior of Download File Types in Chrome | |
2 | |
3 This describes how to adjust file-type download behavior in Chrome including | |
4 interactions with Safe Browsing. The metadata in download_file_types.asciipb | |
asanka
2016/04/06 02:12:31
Embedded underscores could be interpreted as _emph
Nathan Parker
2016/04/11 20:12:07
yea, hrm. I thought intra-word was disabled. I'l
| |
5 is both baked into Chrome and pushable to Chrome between releases. | |
6 | |
7 Rendered version of this file: https://chromium.googlesource.com/chromium/src/+/ master/chrome/browser/resources/safe_browsing/README.md | |
8 | |
9 | |
10 # Procedure for adding a new type | |
11 * Edit `download_file_types.asciipb`. Update `histograms.xml` | |
12 * Get it reviewed, submit. | |
13 * Push via component update (PROCEDURE TBD) | |
14 | |
15 # Guidelines for a DownloadFileType entry: | |
16 See `download_file_types.proto` for all fields. | |
17 * `extension` value must be unique within the config. It should be | |
18 lowercase ASCII and not contain a dot. If there _is_ a duplicate, | |
19 last one will win. | |
20 * `uma_value` value must be unique and match one in the | |
21 SBClientDownloadExtensions enum in histograms.xml | |
22 * `is_archive`: True if this filetype is a container for other files. | |
23 * `platform_settings`: (repeated) Must have one entry with platform=ALL, and | |
24 optionally additional entries with overrides for one or more | |
25 platforms. platform=ALL acts as a default for any platforms that | |
26 don't have an override. There shouldn't be two settings with the | |
27 same `platform`, but if there are, last one wins. Keep them sorted | |
28 by platform. | |
29 * `platform_settings.danger_level`: Required. | |
30 * `NOT_DANGEROUS`: Safe to download and open, even if the download | |
31 was accidental. | |
32 * `DANGEROUS`: Always warn the user that this file may harm their | |
33 computer. We let them continue or discard the file. If Safe | |
34 Browsing returns a SAFE verdict, we still warn the user. | |
35 * `ALLOW_ON_USER_GESTURE`: Warn the user normally but skip the warning | |
36 if there was a user gesture or the user visited this site before | |
37 midnight last night (i.e. is a repeat visit). If Safe Browsing | |
38 returns a SAFE verdict for this file, it won't show a warning. | |
39 * `platform_settings.auto_open_hint`: Required. | |
40 * `ALLOW_AUTO_OPEN`: File type can be opened automatically if the user | |
41 selected that option from the download tray on a previous download | |
42 of this type. | |
43 * `DISALLOW_AUTO_OPEN`: Never let the file automatically open. | |
44 Files that should be disallowed from auto-opening include those that | |
45 execute arbitrary or harmful code with user privileges, or change | |
46 configuration of the system to cause harmful behavior immediately | |
47 or at some time in the future. We *do* allow auto-open for files | |
48 that upon opening sufficiently warn the user about the fact that it | |
49 was downloaded from the internet and can do damage. (TODO(asanka): | |
50 Clarify this sentence: We don't warn for files that... | |
51 "do nothing particularly dangerous, despite the act | |
52 of downloading itself being dangerous (E.g. .local and .manifest | |
53 files)). | |
54 * `platform_settings.ping_setting`: Required. This controls what sort | |
55 of ping is sent to Safe Browsing and if a verdict is checked before | |
56 the user can access the file. | |
57 * `SAMPLE_WITH_LIGHT_PING`: Don't send a full Safe Browsing ping, but | |
58 send a no-PII "light-ping" for a random sample of SBER users. | |
59 This should be the default for unknown types. The verdict won't be | |
60 used. | |
61 * `NO_PING`: Don’t send any pings. This file is whitelisted. All | |
62 NOT_DANGEROUS files should normally use this. | |
63 * `FULL_PING`: Send full pings and use the verdict. All dangerous | |
64 file should use this. | |
65 | |
66 # Guidelines for the top level DownloadFileTypeConfig entry: | |
67 * `version_id`: Must be increased (+1) every time the file is checked in. | |
68 Will be logged to UMA. | |
69 | |
70 * `light_ping_probability`: For what fraction of extended-reporting users' | |
71 downloads with unknown extensions (or ping_setting=TREAT_AS_UNKNOWN) | |
72 should we send light-pings? [0..1] | |
73 | |
74 * `file_type`: The big list of all known file types. Keep them | |
75 sorted by extension. | |
76 | |
77 * `default_file_type`: Settings used if a file is not in the above list. | |
78 `extension` is ignored, but other settings are used. The ping_setting | |
79 should be TREAT_AS_UNKNOWN for all platforms. | |
80 | |
OLD | NEW |