diff options
| author | Daniel Cheng <dcheng@chromium.org> | 2025-03-28 13:30:27 -0700 |
|---|---|---|
| committer | Michael Brüning <michael.bruning@qt.io> | 2025-05-02 15:16:55 +0000 |
| commit | 35b2fd5a66733b0d57b94bdb1df2baad4d888f5e (patch) | |
| tree | db3f0407b0949a46f23cac8fcf9a6aec8e0037c2 /chromium/ui/base/ui_base_features.h | |
| parent | 37f56f75e9713727f79e44b4688febcea06f5e90 (diff) | |
Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/6400553:
Don't allow text -> URL conversion when dropping to bypass URL filtering
When starting a drag from a renderer, the browser process filters out
URLs that the initiating renderer process should not be able to navigate
to, e.g. a random http/https page should not be able to specify
chrome://settings/ as URL to navigate to when dropped.
However, when dropping, Chrome is clever and tries to interpret text as
URLs when needed. To prevent this from bypassing the URL filtering, only
allow this conversion if:
- the drag data does not originate from the renderer
- or the text to URL conversion results in a HTTP or HTTPS url
Bug: 404000989
Change-Id: I28baf7e6385b440af7e76b08471588299e24e247
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6400553
Reviewed-by: Avi Drissman <avi@chromium.org>
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1439671}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/643276
Reviewed-by: Anu Aliyas <anu.aliyas@qt.io>
Diffstat (limited to 'chromium/ui/base/ui_base_features.h')
| -rw-r--r-- | chromium/ui/base/ui_base_features.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/chromium/ui/base/ui_base_features.h b/chromium/ui/base/ui_base_features.h index 67f99842c04..09d4dec9214 100644 --- a/chromium/ui/base/ui_base_features.h +++ b/chromium/ui/base/ui_base_features.h @@ -19,6 +19,9 @@ namespace features { COMPONENT_EXPORT(UI_BASE_FEATURES) BASE_DECLARE_FEATURE(kExperimentalFlingAnimation); COMPONENT_EXPORT(UI_BASE_FEATURES) BASE_DECLARE_FEATURE(kFocusFollowsCursor); +COMPONENT_EXPORT(UI_BASE_FEATURES) +BASE_DECLARE_FEATURE(kDragDropOnlySynthesizeHttpOrHttpsUrlsFromText); + #if BUILDFLAG(IS_CHROMEOS_ASH) COMPONENT_EXPORT(UI_BASE_FEATURES) BASE_DECLARE_FEATURE(kSettingsShowsPerKeyboardSettings); |