Require user gesture for powerful download operations

Require user gesture for powerful download operations

BUG=668653
TEST=Manually clicking on the open download folder works,
running the test case from the bug report triggers NOTREACHED.
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation

Committed: https://crrev.com/f49156a6624e78d73636eb0f4113f541e599cefb
Cr-Commit-Position: refs/heads/master@{#434786}

[robwu, 2016-11-25 14:42:36]

Description was changed from

==========
Require user gesture for powerful download operations

BUG=668653
TEST=Manually clicking on the open download folder works,
running the test case from the bug report triggers NOTREACHED.
==========

to

==========
Require user gesture for powerful download operations

BUG=668653
TEST=Manually clicking on the open download folder works,
running the test case from the bug report triggers NOTREACHED.
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation
==========

[robwu, 2016-11-25 14:54:27]

The CQ bit was checked by rob@robwu.nl to run a CQ dry run

[commit-bot: I haz the power, 2016-11-25 14:54:39]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[robwu, 2016-11-25 14:59:00]

rob@robwu.nl changed reviewers:
+ dbeam@chromium.org, jochen@chromium.org

[robwu, 2016-11-25 14:59:01]

dbeam: PTAL

jochen: I need a stamp for content/renderer/web_ui_extension.cc.

[commit-bot: I haz the power, 2016-11-25 15:49:23]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-11-25 15:49:24]

Dry run: This issue passed the CQ dry run.

[jochen (gone - plz use gerrit), 2016-11-28 08:35:53]

a user gesture is pretty easy to fake, esp. for an extension.

Why can an extension run anything in the context of a webui page?

[robwu, 2016-11-28 08:49:53]

On 2016/11/28 08:35:53, jochen wrote:
> a user gesture is pretty easy to fake, esp. for an extension.
> 
> Why can an extension run anything in the context of a webui page?

Requiring a gesture is just an extra layer of defense, and cannot be faked in
this case. See the linked bug for details. If there is anything unclear about
the report, please follow up there. Note that the bug report shows a fully
automated exploit, that would have been less severe if there was a user gesture
requirement.

[jochen (gone - plz use gerrit), 2016-11-28 09:06:18]

On 2016/11/28 at 08:49:53, rob wrote:
> On 2016/11/28 08:35:53, jochen wrote:
> > a user gesture is pretty easy to fake, esp. for an extension.
> > 
> > Why can an extension run anything in the context of a webui page?
> 
> Requiring a gesture is just an extra layer of defense, and cannot be faked in
this case. See the linked bug for details. If there is anything unclear about
the report, please follow up there. Note that the bug report shows a fully
automated exploit, that would have been less severe if there was a user gesture
requirement.

an extension with tabs permission can create user gestures using
window.open("javascript:...") to execute the code wrapped in a gesture.

[robwu, 2016-11-28 09:21:56]

On 2016/11/28 09:06:18, jochen wrote:
> On 2016/11/28 at 08:49:53, rob wrote:
> > On 2016/11/28 08:35:53, jochen wrote:
> > > a user gesture is pretty easy to fake, esp. for an extension.
> > > 
> > > Why can an extension run anything in the context of a webui page?
> > 
> > Requiring a gesture is just an extra layer of defense, and cannot be faked
in
> this case. See the linked bug for details. If there is anything unclear about
> the report, please follow up there. Note that the bug report shows a fully
> automated exploit, that would have been less severe if there was a user
gesture
> requirement.
> 
> an extension with tabs permission can create user gestures using
> window.open("javascript:...") to execute the code wrapped in a gesture.

That script would then run with the origin of the extension, not the download
page's origin.

[jochen (gone - plz use gerrit), 2016-11-28 10:29:53]

ok, for the specific example you're fixing here, it's true.

lgtm

[Dan Beam, 2016-11-28 18:32:10]

lgtm

[robwu, 2016-11-28 21:26:51]

The CQ bit was checked by rob@robwu.nl

[robwu, 2016-11-28 21:26:52]

The patchset sent to the CQ was uploaded after l-g-t-m from jochen@chromium.org,
dbeam@chromium.org
Link to the patchset: https://codereview.chromium.org/2535483003/#ps20001
(title: "Run vulcanize.py")

[commit-bot: I haz the power, 2016-11-28 21:28:23]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-11-29 00:08:05]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1480368411930000,
"parent_rev": "7767858f95e7f53e23cef4e9a7e07329a397bff4", "commit_rev":
"17c55f77ff58560af16b913788ed937af2d213d6"}

[commit-bot: I haz the power, 2016-11-29 00:08:31]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-11-29 00:12:48]

Description was changed from

==========
Require user gesture for powerful download operations

BUG=668653
TEST=Manually clicking on the open download folder works,
running the test case from the bug report triggers NOTREACHED.
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation
==========

to

==========
Require user gesture for powerful download operations

BUG=668653
TEST=Manually clicking on the open download folder works,
running the test case from the bug report triggers NOTREACHED.
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation

Committed: https://crrev.com/f49156a6624e78d73636eb0f4113f541e599cefb
Cr-Commit-Position: refs/heads/master@{#434786}
==========

[commit-bot: I haz the power, 2016-11-29 00:12:49]

Patchset 2 (id:??) landed as
https://crrev.com/f49156a6624e78d73636eb0f4113f541e599cefb
Cr-Commit-Position: refs/heads/master@{#434786}