Filter personal data out of download protection pings (fixes brave/br…

…ave-browser#6267)

chromium_src/chrome/browser/safe_browsing/download_protection/check_client_download_request_base.cc

@@ -0,0 +1,29 @@
+/* Copyright (c) 2020 The Brave Authors. All rights reserved.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "components/safe_browsing/core/proto/csd.pb.h"
+
+#define BRAVE_SEND_REQUEST_FILTER BraveFilterRequest(request.get());
+
+namespace safe_browsing {
+
+void BraveFilterRequest(ClientDownloadRequest* request) {
+  request->set_url("");  // URL must be present or we get a 400.
+  request->clear_file_basename();
+  request->clear_locale();
+  request->clear_resources();  // Contains URLs and referrers
+  request->clear_referrer_chain();
+
+  // Filter binaries within archives.
+  for (int i = 0; i < request->archived_binary_size(); i++) {
+    ClientDownloadRequest_ArchivedBinary* archived_binary =
+        request->mutable_archived_binary(i);
+    archived_binary->clear_file_basename();
+  }
+}
+
+}  // namespace safe_browsing
+
+#include "../../../../../../chrome/browser/safe_browsing/download_protection/check_client_download_request_base.cc"  // NOLINT

chromium_src/chrome/browser/safe_browsing/download_protection/check_client_download_request_base_browsertest.cc

@@ -0,0 +1,86 @@
+/* Copyright (c) 2020 The Brave Authors. All rights reserved.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#include "base/path_service.h"
+#include "base/strings/stringprintf.h"
+#include "brave/common/brave_paths.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ui/browser.h"
+#include "chrome/common/pref_names.h"
+#include "chrome/test/base/in_process_browser_test.h"
+#include "chrome/test/base/ui_test_utils.h"
+#include "components/network_session_configurator/common/network_switches.h"
+#include "components/prefs/pref_service.h"
+#include "components/safe_browsing/content/web_ui/safe_browsing_ui.h"
+#include "components/safe_browsing/core/proto/csd.pb.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/download_manager.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/download_test_observer.h"
+#include "content/public/test/test_utils.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/default_handlers.h"
+#include "net/test/embedded_test_server/http_request.h"
+#include "ui/base/window_open_disposition.h"
+
+class BraveCheckClientDownloadRequestBaseBrowserTest
+    : public InProcessBrowserTest {
+ public:
+  BraveCheckClientDownloadRequestBaseBrowserTest()
+      : https_server_(net::EmbeddedTestServer::TYPE_HTTPS) {}
+
+  void SetUpOnMainThread() override {
+    InProcessBrowserTest::SetUpOnMainThread();
+
+    host_resolver()->AddRule("*", "127.0.0.1");
+
+    browser()->profile()->GetPrefs()->SetBoolean(prefs::kPromptForDownload,
+                                                 false);
+
+    brave::RegisterPathProvider();
+    base::PathService::Get(brave::DIR_TEST_DATA, &test_data_dir_);
+    https_server_.ServeFilesFromDirectory(test_data_dir_);
+    https_server_.AddDefaultHandlers(GetChromeTestDataDir());
+    safe_browsing::WebUIInfoSingleton::GetInstance()->AddListenerForTesting();
+
+    ASSERT_TRUE(https_server_.Start());
+
+    download_url_ = https_server_.GetURL("a.com", "/test.exe");
+  }
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    InProcessBrowserTest::SetUpCommandLine(command_line);
+    // This is needed to load pages from "domain.com" without an interstitial.
+    command_line->AppendSwitch(switches::kIgnoreCertificateErrors);
+  }
+
+  const net::EmbeddedTestServer& https_server() { return https_server_; }
+  const GURL& download_url() { return download_url_; }
+
+ private:
+  GURL download_url_;
+  base::FilePath test_data_dir_;
+
+  net::test_server::EmbeddedTestServer https_server_;
+};
+
+IN_PROC_BROWSER_TEST_F(BraveCheckClientDownloadRequestBaseBrowserTest,
+                       FilterRequest) {
+  ui_test_utils::DownloadURL(browser(), download_url());
+
+  const std::vector<std::unique_ptr<safe_browsing::ClientDownloadRequest>>&
+      requests = safe_browsing::WebUIInfoSingleton::GetInstance()
+                     ->client_download_requests_sent();
+
+  ASSERT_EQ(requests.size(), 1u);
+
+  EXPECT_TRUE(requests[0]->has_url());
+  EXPECT_EQ(requests[0]->url(), "");
+  EXPECT_FALSE(requests[0]->has_locale());
+  EXPECT_FALSE(requests[0]->has_file_basename());
+  EXPECT_EQ(requests[0]->referrer_chain_size(), 0);
+  EXPECT_EQ(requests[0]->resources_size(), 0);
+}

patches/chrome-browser-safe_browsing-download_protection-check_client_download_request_base.cc.patch

@@ -0,0 +1,12 @@
+diff --git a/chrome/browser/safe_browsing/download_protection/check_client_download_request_base.cc b/chrome/browser/safe_browsing/download_protection/check_client_download_request_base.cc
+index 4f7fd86c5e6edd387254d0eab6aa399db5e42105..1edf51b8e80c967e275e327d8143973ec4881871 100644
+--- a/chrome/browser/safe_browsing/download_protection/check_client_download_request_base.cc
++++ b/chrome/browser/safe_browsing/download_protection/check_client_download_request_base.cc
+@@ -554,6 +554,7 @@ void CheckClientDownloadRequestBase::SendRequest() {
+   request->set_archive_directory_count(directory_count_);
+   request->set_request_ap_verdicts(is_under_advanced_protection_);
+
++  BRAVE_SEND_REQUEST_FILTER
+   if (!request->SerializeToString(&client_download_request_data_)) {
+     FinishRequest(DownloadCheckResult::UNKNOWN, REASON_INVALID_REQUEST_PROTO);
+     return;

test/BUILD.gn

@@ -552,6 +552,7 @@ if (!is_android) {
       "//brave/browser/ui/webui/brave_welcome_ui_browsertest.cc",
       "//brave/chromium_src/chrome/browser/media/router/media_router_feature_browsertest.cc",
       "//brave/chromium_src/chrome/browser/profiles/profile_window_browsertest.cc",
+      "//brave/chromium_src/chrome/browser/safe_browsing/download_protection/check_client_download_request_base_browsertest.cc",
       "//brave/chromium_src/chrome/browser/ui/views/location_bar/location_bar_view_browsertest.cc",
       "//brave/chromium_src/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view_browsertest.cc",
       "//brave/chromium_src/components/content_settings/core/browser/brave_content_settings_registry_browsertest.cc",