Submit a sample of notification images to Safe Browsing

chrome/browser/safe_browsing/ping_manager.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_SAFE_BROWSING_PING_MANAGER_H_
 #define CHROME_BROWSER_SAFE_BROWSING_PING_MANAGER_H_
 
 // A class that reports safebrowsing statistics to Google's SafeBrowsing
 // servers.
 #include <memory>
 #include <set>
 #include <string>
 #include <vector>
 
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "chrome/browser/permissions/permission_uma_util.h"
 #include "chrome/browser/safe_browsing/protocol_manager_helper.h"
 #include "components/safe_browsing_db/hit_report.h"
 #include "components/safe_browsing_db/util.h"
 #include "content/public/browser/permission_type.h"
 #include "net/log/net_log_with_source.h"
 #include "net/url_request/url_fetcher_delegate.h"
 #include "url/gurl.h"
 
+class SkBitmap;
+
 namespace net {
 class URLRequestContextGetter;
 }  // namespace net
 
 namespace safe_browsing {
 
+class NotificationImageReporter;
 class PermissionReporter;
 
 class SafeBrowsingPingManager : public net::URLFetcherDelegate {
  public:
   ~SafeBrowsingPingManager() override;
 
   // Create an instance of the safe browsing ping manager.
   static std::unique_ptr<SafeBrowsingPingManager> Create(
       net::URLRequestContextGetter* request_context_getter,
       const SafeBrowsingProtocolConfig& config);
 
   // net::URLFetcherDelegate interface.
   void OnURLFetchComplete(const net::URLFetcher* source) override;
 
   // Report to Google when a SafeBrowsing warning is shown to the user.
   // |hit_report.threat_type| should be one of the types known by
   // SafeBrowsingtHitUrl.
   void ReportSafeBrowsingHit(const safe_browsing::HitReport& hit_report);
 
   // Users can opt-in on the SafeBrowsing interstitial to send detailed
   // threat reports. |report| is the serialized report.
   void ReportThreatDetails(const std::string& report);
 
   // Report permission action to SafeBrowsing servers.
   void ReportPermissionAction(const PermissionReportInfo& report_info);
 
+  // Report notification content image to SafeBrowsing CSD server if necessary.
+  void ReportNotificationImage(Profile* profile,
+                               const GURL& origin,
+                               const SkBitmap& image);
+
  private:
   friend class PermissionReporterBrowserTest;
   friend class SafeBrowsingPingManagerTest;
   FRIEND_TEST_ALL_PREFIXES(SafeBrowsingPingManagerTest,
                            TestSafeBrowsingHitUrl);
   FRIEND_TEST_ALL_PREFIXES(SafeBrowsingPingManagerTest, TestThreatDetailsUrl);
   FRIEND_TEST_ALL_PREFIXES(SafeBrowsingPingManagerTest,
                            TestReportThreatDetails);
   FRIEND_TEST_ALL_PREFIXES(SafeBrowsingPingManagerTest,
                            TestReportSafeBrowsingHit);
@@ skipping 27 matching lines @@
   // sends detaild threat reports for UMA users.
   std::string url_prefix_;
 
   // Track outstanding SafeBrowsing report fetchers for clean up.
   // We add both "hit" and "detail" fetchers in this set.
   Reports safebrowsing_reports_;
 
   // Sends reports of permission actions.
   std::unique_ptr<PermissionReporter> permission_reporter_;
 
+  // Sends reports of notification content images.
+  scoped_refptr<NotificationImageReporter> notification_image_reporter_;

[Peter Beverloo, 2017/01/11 18:23:56]

Higher level question: we could avoid ref counting if we're OK with dropping
events on the floor when the PingManager is being shut down. (I.e. use a
WeakPtr<>.)

That may be safer too, e.g. is the net::URLRequestContext* passed to the
net::ReportSender assumed to remain valid after the PingManager goes away?

WDYT?

[johnme, 2017/01/11 20:05:07]

I considered this, but it needs to be possible to post to methods on the IO, UI
and blocking pool worker threads. Especially for the latter, there seems no
practical way of satisfying weak pointers' requirement that the weak pointers
are always dereferenced on the same thread.

The lifetime question is relevant though - Nathan, do you know if it's ok that
NotificationImageReporter and its net::ReportSender might outlive the ping
manager due to ref counting?

[Nathan Parker, 2017/01/11 22:34:38]

It feels like a weak_ptr would be safer, since then we'd just drop the report
rather than access a bad URLRequestContext. I think we don't want report_sender_
to outlive PingManager. The PingManager will destruct the
NotificationImageReporter before the URLRequestContextGetter, so that would be
safe.

[johnme, 2017/01/13 02:38:16]

Switched to WeakPtrs. The trick was to only dereference them on the IO thread,
and make the method that run on other threads static (with a weak_this_on_io
parameter which will later get used to post to the non-static IO thread method).

+
   net::NetLogWithSource net_log_;
 
   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingPingManager);
 };
 
 }  // namespace safe_browsing
 
 #endif  // CHROME_BROWSER_SAFE_BROWSING_PING_MANAGER_H_