1302211 - Sync download protection code with Chrome

Status: RESOLVED FIXED

(Toolkit :: Safe Browsing, defect, P2)

Description

[François Marier [:francois]]

Chrome has updated the Application Reputation protobuf file to make the verdict optional to make it future-proof: https://codereview.chromium.org/2292963004/

They are also removing the .osx file extension: https://bugs.chromium.org/p/chromium/issues/detail?id=641614

Comment 1

[François Marier [:francois]]

For the rest of the extensions (https://cs.chromium.org/chromium/src/chrome/browser/resources/safe_browsing/download_file_types.asciipb), Chrome only does remote verification for file extensions marked as FULL_PING.

The DangerLevel determines the behavior of the browser when an UNKNOWN verdict is received. We don't currently make use of this information and treat UNKNOWN as SAFE.

Comment 2

[François Marier [:francois]]

Attachment: Bug 1302211 - Import latest Safe Browsing CSD file from Chrome.

Review commit: https://reviewboard.mozilla.org/r/78282/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/78282/

Comment 3

[François Marier [:francois]]

Attachment: Bug 1302211 - Remove .osx extension from download protection.

https://bugs.chromium.org/p/chromium/issues/detail?id=641614

Review commit: https://reviewboard.mozilla.org/r/78284/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/78284/

Comment 4

[François Marier [:francois]]

Attachment: Bug 1302211 - Sync file extension list with Chrome.

Directly executable file types were added and types that Chrome
doesn't submit to the remote server were removed.

PDF is retained for now and many archive types are commented-out.

https://cs.chromium.org/chromium/src/chrome/browser/resources/safe_browsing/download_file_types.asciipb

Review commit: https://reviewboard.mozilla.org/r/78286/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/78286/

Comment 5

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8790503 [details]
Bug 1302211 - Import latest Safe Browsing CSD file from Chrome.

https://reviewboard.mozilla.org/r/78282/#review77396

rs+

Comment 6

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8790504 [details]
Bug 1302211 - Remove .osx extension from download protection.

https://reviewboard.mozilla.org/r/78284/#review77398

Comment 7

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8790505 [details]
Bug 1302211 - Sync file extension list with Chrome.

https://reviewboard.mozilla.org/r/78286/#review77402

::: toolkit/components/downloads/ApplicationReputation.cpp:452
(Diff revision 1)
> -    StringEndsWith(fileName, NS_LITERAL_STRING(".dll")) || // Windows
> +    StringEndsWith(fileName, NS_LITERAL_STRING(".dll")) || // Windows executable
>      StringEndsWith(fileName, NS_LITERAL_STRING(".dmg")) || // Mac disk image
>      StringEndsWith(fileName, NS_LITERAL_STRING(".dmgpart")) || // Mac disk image
> -    //StringEndsWith(fileName, NS_LITERAL_STRING(".docb")) ||
> -    StringEndsWith(fileName, NS_LITERAL_STRING(".docm")) || // MS Word
> -    StringEndsWith(fileName, NS_LITERAL_STRING(".docx")) || // MS Word
> +    //StringEndsWith(fileName, NS_LITERAL_STRING(".docb")) || // MS Office
> +    //StringEndsWith(fileName, NS_LITERAL_STRING(".docm")) || // MS Word
> +    //StringEndsWith(fileName, NS_LITERAL_STRING(".docx")) || // MS Word

"Huh"

No more afraid of Office Macros?

Comment 8

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8790505 [details]
Bug 1302211 - Sync file extension list with Chrome.

https://reviewboard.mozilla.org/r/78286/#review77406

Comment 9

[François Marier [:francois]]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #7)
> > -    //StringEndsWith(fileName, NS_LITERAL_STRING(".docb")) ||
> > -    StringEndsWith(fileName, NS_LITERAL_STRING(".docm")) || // MS Word
> > -    StringEndsWith(fileName, NS_LITERAL_STRING(".docx")) || // MS Word
> > +    //StringEndsWith(fileName, NS_LITERAL_STRING(".docb")) || // MS Office
> > +    //StringEndsWith(fileName, NS_LITERAL_STRING(".docm")) || // MS Word
> > +    //StringEndsWith(fileName, NS_LITERAL_STRING(".docx")) || // MS Word
> 
> "Huh"
> 
> No more afraid of Office Macros?

I was also surprised, but Chrome doesn't send them through the remote lookup server:

  # OOXML MS Office files.  These can embed executables, but they don't
  # execute automatically when opened.  These are here to produce UMA metrics.

https://cs.chromium.org/chromium/src/chrome/browser/resources/safe_browsing/download_file_types.asciipb?l=1131

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/248f9c35af3a
Import latest Safe Browsing CSD file from Chrome. r=gcp
https://hg.mozilla.org/integration/autoland/rev/262d65accc67
Remove .osx extension from download protection. r=gcp
https://hg.mozilla.org/integration/autoland/rev/6795bb0cdda6
Sync file extension list with Chrome. r=gcp

Comment 11

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/248f9c35af3a
https://hg.mozilla.org/mozilla-central/rev/262d65accc67
https://hg.mozilla.org/mozilla-central/rev/6795bb0cdda6