Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add default filter provider manager #18876

Merged

Conversation

ShivanKaul
Copy link
Collaborator

@ShivanKaul ShivanKaul commented Jun 12, 2023

Resolves brave/brave-browser#30996

If Localhost Permission feature is ON, $badfilter localhost adblock rules. This way, clients always get localhost protections, even as we slowly roll out Localhost Permission feature.
Also included in this PR: adblock engine/filter providers refactoring.

Submitter Checklist:

  • I confirm that no security/privacy review is needed, or that I have requested one
  • There is a ticket for my issue
  • Used Github auto-closing keywords in the PR description above
  • Wrote a good PR/commit description
  • Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
  • Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
  • Checked the PR locally:
    • npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
    • npm run lint, npm run presubmit wiki, npm run gn_check, npm run tslint
  • Ran git rebase master (if needed)

Reviewer Checklist:

  • A security review is not needed, or a link to one is included in the PR description
  • New files have MPL-2.0 license header
  • Adequate test coverage exists to prevent regressions
  • Major classes, functions and non-trivial code blocks are well-commented
  • Changes in component dependencies are properly reflected in gn
  • Code follows the style guide
  • Test plan is specified in PR before merging

After-merge Checklist:

Test Plan:

With brave://flags/#brave-localhost-access-permission on, you should not see anything blocked on https://shivankaul.com/brave/localhost/subresource.html (i.e. no 1 on Shields).
With the flag off, you should see it. This is because with the flag off, we inject the localhost blocking adblock rules, while we don't if the flag is on.

After this change, you don't need to add any exception adblock filter rules to test the localhost permission feature. Test plan from #17321 (comment) can be followed without the need to add the @@||localhost^$domain=shivankaul.com filter rule.

shivankaul.com still needs to be allowlisted locally -- see #18354 (comment) for how to do that.

@ShivanKaul ShivanKaul force-pushed the feature/localhost-permission-badfilter-adblock-rules branch from 695c03e to 0fc5447 Compare June 17, 2023 01:29
@ShivanKaul ShivanKaul marked this pull request as ready for review June 17, 2023 01:40
@ShivanKaul ShivanKaul force-pushed the feature/localhost-permission-badfilter-adblock-rules branch from 50a9ddc to 5376206 Compare June 20, 2023 20:56

// PostTask so this has an async return to match other loaders
base::SingleThreadTaskRunner::GetCurrentDefault()->PostTask(
FROM_HERE, base::BindOnce(std::move(cb), false, std::move(buffer)));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] BindOnce/BindRepeating may allow callers to access objects which may already be freed in the C++ lifecycle. Verify the occurrences manually

Source: Brave

Cc @brave/sec-team @fmarier @thypon

->LoadDATBufferForEngine(
adblock_engine_->IsDefaultEngine(),
base::BindOnce(&AdBlockService::SourceProviderObserver::OnDATLoaded,
weak_factory_.GetWeakPtr()));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] BindOnce/BindRepeating may allow callers to access objects which may already be freed in the C++ lifecycle. Verify the occurrences manually

Source: Brave

Cc @brave/sec-team @fmarier @thypon

} else {
filters_provider_->LoadDAT(
base::BindOnce(&AdBlockService::SourceProviderObserver::OnDATLoaded,
weak_factory_.GetWeakPtr()));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] BindOnce/BindRepeating may allow callers to access objects which may already be freed in the C++ lifecycle. Verify the occurrences manually

Source: Brave

Cc @brave/sec-team @fmarier @thypon

->LoadDATBufferForEngine(
adblock_engine_->IsDefaultEngine(),
base::BindOnce(&AdBlockService::SourceProviderObserver::OnDATLoaded,
weak_factory_.GetWeakPtr()));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] BindOnce/BindRepeating may allow callers to access objects which may already be freed in the C++ lifecycle. Verify the occurrences manually

Source: Brave

Cc @brave/sec-team @fmarier @thypon

} else {
filters_provider_->LoadDAT(
base::BindOnce(&AdBlockService::SourceProviderObserver::OnDATLoaded,
weak_factory_.GetWeakPtr()));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] BindOnce/BindRepeating may allow callers to access objects which may already be freed in the C++ lifecycle. Verify the occurrences manually

Source: Brave

Cc @brave/sec-team @fmarier @thypon

@ShivanKaul ShivanKaul merged commit b16667f into master Jun 22, 2023
@ShivanKaul ShivanKaul deleted the feature/localhost-permission-badfilter-adblock-rules branch June 22, 2023 06:17
@github-actions github-actions bot added this to the 1.55.x - Nightly milestone Jun 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Localhost adblock rules should only apply if localhost permission is switched off
2 participants