Add a new group policy to disable safe browsing for files downloaded from trusted sources.

components/policy/resources/policy_templates.json

 {
 # policy_templates.json - Metafile for policy templates
 #
 # The content of this file is evaluated as a Python expression.
 #
 # This file is used as input to generate the following policy templates:
 # ADM, ADMX+ADML, MCX/plist and html documentation.
 #
 # Policy templates are user interface definitions or documents about the
 # policies that can be used to configure Chrome. Each policy is a name-value
@@ skipping 125 matching lines @@
 #   templates and documentation. The policy definition list that Chrome sees
 #   will include policies marked with 'future'. If a WIP policy isn't meant to
 #   be seen by the policy providers either, the 'supported_on' key should be set
 #   to an empty list.
 #
 # IDs:
 #   Since a Protocol Buffer definition is generated from this file, unique and
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 374
+#   For your editing convenience: highest ID currently used: 375
 #   And don't forget to also update the EnterprisePolicies enum of
 #   histograms.xml (run 'python tools/metrics/histograms/update_policies.py').
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
 #     $1 -> Google Chrome / Chromium
 #     $2 -> Google Chrome OS / Chromium OS
 #     $3 -> Google Chrome Frame / Chromium Frame
 #     $6 is reserved for doc_writer
 #
@@ skipping 94 matching lines @@
 
           The home page is the page opened by the Home button. The pages that open on startup are controlled by the RestoreOnStartup policies.
 
           The home page type can either be set to a URL you specify here or set to the New Tab Page. If you select the New Tab Page, then this policy does not take effect.
 
           If you enable this setting, users cannot change their home page URL in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>, but they can still choose the New Tab Page as their home page.
 
           Leaving this policy not set will allow the user to choose their home page on their own if HomepageIsNewTabPage is not set too.
 
           This policy is not available on Windows instances that are not joined
-          to a Microsoft® Active Directory® domain.''',
+          to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.''',
           'label': '''Home page URL''',
         },
         {
           'name': 'HomepageIsNewTabPage',
           'type': 'main',
           'schema': { 'type': 'boolean' },
           'supported_on': ['chrome.*:8-', 'chrome_os:11-'],
           'features': {
             'can_be_recommended': True,
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': True,
           'id': 2,
           'caption': '''Use New Tab Page as homepage''',
           'tags': [],
           'desc': '''Configures the type of the default home page in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and prevents users from changing home page preferences. The home page can either be set to a URL you specify or set to the New Tab Page.
 
           If you enable this setting, the New Tab Page is always used for the home page, and the home page URL location is ignored.
 
           If you disable this setting, the user's homepage will never be the New Tab Page, unless its URL is set to 'chrome://newtab'.
 
           If you enable or disable this setting, users cannot change their homepage type in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
 
           Leaving this policy not set will allow the user to choose whether the new tab page is their home page on their own.
 
           This policy is not available on Windows instances that are not joined
-          to a Microsoft® Active Directory® domain.''',
+          to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.''',
         },
       ],
     },
     {
       'name': 'NewTabPage',
       'type': 'group',
       'caption': '''New Tab Page''',
       'desc': '''Configure the default New Tab page in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.''',
       'policies': [
         {
@@ skipping 11 matching lines @@
           'caption': '''Configure the New Tab page URL''',
           'tags': [],
           'desc': '''Configures the default New Tab page URL and prevents users from changing it.
 
           The New Tab page is the page opened when new tabs are created (including the one opened in new windows).
 
           This policy does not decide which pages are to be opened on start up. Those are controlled by the <ph name="RESTORE_ON_STARTUP_POLICY_NAME">RestoreOnStartup</ph> policies. Yet this policy does affect the Home Page if that is set to open the New Tab page, as well as the startup page if that is set to open the New Tab page.
 
           If the policy is not set or left empty the default new tab page is used.
 
-          This policy is not available on Windows instances that are not joined to a Microsoft® Active Directory® domain.''',
+          This policy is not available on Windows instances that are not joined to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.''',
           'label': '''New Tab page URL''',
         },
       ],
     },
     {
       'name': 'DefaultBrowserSettingEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:11-'],
       'features': {
@@ skipping 966 matching lines @@
       'tags': ['google-sharing'],
       'desc': '''Enables anonymous reporting of usage and crash-related data about <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> to Google and prevents users from changing this setting.
 
       If this setting is enabled, anonymous reporting of usage and crash-related
       data is sent to Google.  If it is disabled, this information is not sent
       to Google.  In both cases, users cannot change or override the setting.
       If this policy is left not set, the setting will be what the user chose
       upon installation / first run.
 
       This policy is not available on Windows instances that are not joined to
-      a Microsoft® Active Directory® domain.  (For Chrome OS, see
+      a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.  (For Chrome OS, see
       DeviceMetricsReportingEnabled.)''',
     },
     {
       'name': 'PasswordManager',
       'type': 'group',
       'caption': '''Password manager''',
       'desc': '''Configures the password manager.''',
       'policies': [
         {
           'name': 'PasswordManagerEnabled',
@@ skipping 438 matching lines @@
       If you set this policy, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will prevent certain types of downloads, and won't let user bypass the security warnings.
 
       When the 'Block dangerous downloads' option is chosen, all downloads are allowed, except for those that carry SafeBrowsing warnings.
 
       When the 'Block potentially dangerous downloads' option is chosen, all downloads allowed, except for those that carry SafeBrowsing warnings of potentially dangerous downloads.
 
       When the 'Block all downloads' option is chosen, all downloads are blocked.
 
       When this policy is not set, (or the 'No special restrictions' option is chosen), the dowloads will go through the usual security restrictions based on SafeBrowsing analysis results.
 
-      Note that these restrictions apply to downloads triggered from web page content, as well as the 'download link...' context menu option.
-
-      These restrictions do not apply to the save / download of the currently displayed page, nor does it apply to saving as PDF from the printing options.
+      Note that these restrictions apply to downloads triggered from web page content, as well as the 'download link...' context menu option. These restrictions do not apply to the save / download of the currently displayed page, nor does it apply to saving as PDF from the printing options.
 
       See https://developers.google.com/safe-browsing for more info on SafeBrowsing.''',
       'label': '''Download restrictions''',
     },
     {
       'name': 'DownloadDirectory',
       'type': 'string',
       'schema': { 'type': 'string' },
       'supported_on': ['chrome.*:11-', 'chrome_os:35-'],
       'features': {
         'can_be_recommended': True,
         'dynamic_refresh': True,
         'per_profile': True,
       },
       'example_value': '/home/${user_name}/Downloads',
       'id': 64,
       'caption': '''Set download directory''',
       'tags': ['local-data-access'],
       'desc': '''Configures the directory that <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will use for downloading files.
 
       If you set this policy, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will use the provided directory regardless whether the user has specified one or enabled the flag to be prompted for download location every time.
 
       See https://www.chromium.org/administrators/policy-list-3/user-data-directory-variables for a list of variables that can be used.
 
       If this policy is left not set the default download directory will be used and the user will be able to change it.''',
       'label': '''Set download directory''',
       'arc_support': 'This policy has no effect on Android apps. Android apps always use the default downloads directory and cannot access any files downloaded by <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> into a non-default downloads directory.',
     },
     {
+      'name': 'SafeBrowsingForTrustedSourcesEnabled',
+      'type': 'main',
+      'schema': { 'type': 'boolean' },
+      'supported_on': ['chrome.win:61-'],
+      'features': {
+        'can_be_recommended': True,
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': False,
+      'id': 375,
+      'caption': '''SafeBrowsing enable state for trusted sources''',
+      'tags': ['local-data-access'],
+      'desc': '''Identify if <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> can allow download without Safe Browsing checks when it's from a trusted source.
+
+      When False, downloaded files will not be sent to be analyzed by Safe Browsing when it's from a trusted source.
+
+      When not set (or set to True), downloaded files are sent to be analyzed by Safe Browsing, even when it's from a trusted source.
+
+      Note that these restrictions apply to downloads triggered from web page content, as well as the 'download link...' context menu option. These restrictions do not apply to the save / download of the currently displayed page, nor does it apply to saving as PDF from the printing options.
+
+      This policy is not available on Windows instances that are not joined
+      to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.''',
+      'label': '''SafeBrowsing enable state for trusted sources''',
+    },
+    {
       'name': 'ClearSiteDataOnExit',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:11-28', 'chrome_os:11-28'],
       'features': {
         'can_be_recommended': True,
         'dynamic_refresh': True,
         'per_profile': True,
       },
       'deprecated': True,
@@ skipping 874 matching lines @@
           If you choose 'Restore the last session', the URLs that were open last time <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> was closed will be reopened and the browsing session will be restored as it was left.
           Choosing this option disables some settings that rely on sessions or that perform actions on exit (such as Clear browsing data on exit or session-only cookies).
 
           If you choose 'Open a list of URLs', the list of 'URLs to open on startup' will be opened when a user starts <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
 
           If you enable this setting, users cannot change or override it in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
 
           Disabling this setting is equivalent to leaving it not configured. The user will still be able to change it in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
 
           This policy is not available on Windows instances that are not joined
-          to a Microsoft® Active Directory® domain.''',
+          to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.''',
         },
         {
           'name': 'RestoreOnStartupURLs',
           'type': 'list',
           'schema': {
             'type': 'array',
             'items': { 'type': 'string' },
           },
           'supported_on': ['chrome.*:8-', 'chrome_os:11-'],
           'features': {
             'can_be_recommended': True,
             'dynamic_refresh': True,
             'per_profile': True,
           },
           'example_value': ['https://example.com', 'https://www.chromium.org'],
           'id': 38,
           'caption': '''URLs to open on startup''',
           'tags': [],
           'desc': '''If 'Open a list of URLs' is selected as the startup action, this allows you to specify the list of URLs that are opened. If left not set no URL will be opened on start up.
 
           This policy only works if the 'RestoreOnStartup' policy is set to 'RestoreOnStartupIsURLs'.
 
           This policy is not available on Windows instances that are not joined
-          to a Microsoft® Active Directory® domain.''',
+          to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.''',
         },
       ],
     },
     {
       'name': 'BlockThirdPartyCookies',
       'type': 'main',
       'schema': { 'type': 'boolean' },
       'supported_on': ['chrome.*:10-', 'chrome_os:11-'],
       'features': {
         'can_be_recommended': True,
@@ skipping 42 matching lines @@
 
           You can specify the default search provider to be used by setting the rest of the default search policies. If these are left empty, the user can choose the default provider.
 
           If you disable this setting, no search is performed when the user enters non-URL text in the omnibox.
 
           If you enable or disable this setting, users cannot change or override this setting in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
 
           If this policy is left not set, the default search provider is enabled, and the user will be able to set the search provider list.
 
           This policy is not available on Windows instances that are not joined
-          to a Microsoft® Active Directory® domain.''',
+          to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.''',
         },
         {
           'name': 'DefaultSearchProviderName',
           'type': 'string',
           'schema': { 'type': 'string' },
           'supported_on': [
             'chrome.*:8-',
             'chrome_os:11-',
             'android:30-',
             'ios:34-47',
@@ skipping 7018 matching lines @@
       example, in a publicly distributed program) is considered malware and will
       likely be labeled as malware by Google and anti-virus vendors.
 
       These settings don't need to be configured manually!  Easy-to-use
       templates for Windows, Mac and Linux are available for download from <ph
       name="POLICY_TEMPLATE_DOWNLOAD_URL">https://www.chromium.org/administrators/policy-templates<ex>
       https://www.chromium.org/administrators/policy-templates</ex></ph>.
 
       The recommended way to configure policy on Windows is via GPO, although
       provisioning policy via registry is still supported for Windows instances
-      that are joined to a Microsoft® Active Directory® domain.'''
+      that are joined to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain.'''
     },
     'doc_back_to_top': {
       'desc': '''Text of a link in the generated policy documentation, that takes the user to the top of the page''',
       'text': '''Back to top'''
     },
     'doc_supported': {
       'desc': '''Appears next to the name of each supported feature in the 'list of supported policy features' in the generated policy documentation''',
       'text': '''Yes'''
     },
     'doc_not_supported': {
@@ skipping 32 matching lines @@
       'desc': '''Text appended in parentheses next to the policies top-level container to indicate that those policies are of the Recommended level''',
       'text': 'Default Settings (users can override)',
     },
     'doc_complex_policies_on_windows': {
       'desc': '''Text pointing the user to a help article for complex policies on Windows''',
       'text': '''encoded as a JSON string, for details see <ph name="COMPLEX_POLICIES_URL">https://www.chromium.org/administrators/complex-policies-on-windows<ex>https://www.chromium.org/administrators/complex-policies-on-windows</ex></ph>''',
     },
   },
   'placeholders': [],
 }