Remove Greaselion dependency from Rewards service (v2) #25949

zenparsing · 2024-10-11T13:56:43Z

Overview

Currently, Brave Creator "pages" are detected on some social media sites (on desktop) by using a combination of the persistent Brave extension and Greaselion extension content scripts. For performance reasons, we must migrate away from using a persistent background page, and for maintainability reasons (and to allow the feature to work cross-platform in the future) we must migrate away from Greaselion.

With this change, the Rewards service no longer uses Greaselion. Instead, scripts are injected by the RewardsTabHelper into the "Brave internal" isolated world (using a new CreatorDetectionScriptInjector class). The scripts are individually compiled and bundled for each site from TypeScript using our current TypeScript bundling process. They are executed in the "Brave internal" isolated world. In the future, the scripts can be moved out of brave-core and delivered via ComponentUpdater.

Submitter Checklist:

I confirm that no security/privacy review is needed and no other type of reviews are needed, or that I have requested them
There is a ticket for my issue
Used Github auto-closing keywords in the PR description above
Wrote a good PR/commit description
Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
Checked the PR locally:
- npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
- npm run presubmit wiki, npm run gn_check, npm run tslint
Ran git rebase master (if needed)

Reviewer Checklist:

A security review is not needed, or a link to one is included in the PR description
New files have MPL-2.0 license header
Adequate test coverage exists to prevent regressions
Major classes, functions and non-trivial code blocks are well-commented
Changes in component dependencies are properly reflected in gn
Code follows the style guide
Test plan is specified in PR before merging

After-merge Checklist:

The associated issue milestone is set to the smallest version that the
changes has landed on
All relevant documentation has been updated, for instance:

Test Plan:

browser/brave_rewards/creator_detection_script_injector.cc

components/brave_rewards/resources/creator_detection/helpers.ts

browser/brave_rewards/creator_detection_script_injector.cc

brave-builds · 2024-10-11T14:54:48Z

A Storybook has been deployed to preview UI for the latest push

browser/brave_rewards/rewards_tab_helper.cc

browser/brave_rewards/test/creator_detection_browsertest.cc

renderer/brave_content_renderer_client.cc

browser/brave_rewards/creator_detection_script_injector.h

browser/brave_rewards/test/creator_detection_browsertest.cc

browser/brave_rewards/rewards_tab_helper.cc

bridiver · 2024-10-17T20:14:21Z

browser/brave_rewards/rewards_tab_helper.cc

+      visit->provider = *platform;
+    }
+
+    rewards_service_->GetPublisherActivityFromUrl(visit->Clone());


this should really be encapsulated in something like RewardsService::UpdateCreatorForTab. I have no idea what is going on in these three calls and this also makes it hard to test vs unit testing a single method on RewardsService. We really shouldn't be exposing these kinds of low level calls in the service.

side note: why is this called GetPublisherActivityFromUrl if it doesn't actually return anything? Also it doesn't take a URL as a param which is confusing. Separately from this PR this method name should probably change.

oh, I guess an overloaded version of GetPublisherActivityFromUrl was added in this PR so the name should at least change to GetPublisherActivityFromVisitData and then change GetPublisherActivityFrom for both in a separate PR

Yes - these methods are pretty ancient and the names reflect that. I've updated the new method name as suggested, and I'll add an issue to fix the names up more generally.

what about my comment about wrapping these three method calls in a single call to the service? If multiple actions need to be taken in response to something it's best for the service to handle that, not the caller. Although this is not a user action, it should still follow the same principle of having a single call to the service for a given event that occurs outside the component

I'm not suggesting refactoring the entire class, but we can certainly simplify this specific case, no? Just because other code is problematic doesn't mean we should keep doing the same thing when we could at least wrap these calls. It's only adding a couple of methods to RewardsService to move the details inside of it

Filed a follow-up issue here: brave/brave-browser#41832 to address the RewardsService AC-related API issues. It will be more clear what the API should be after the upcoming AC changes have been finalized.

fyi I made a similar comment in this PR to make things more unit testable https://github.com/brave/brave-core/pull/26082/files#r1813441440

unit testing tab helpers is not very practical, but unit testing the service is

I won't block on this as long as we have good test coverage for everything that gets called here, but given that this is new code being added I'm struggling with why we can't just add a new method to the service to wrap these three calls so we can unit test it.

browser/brave_rewards/test/creator_detection_browsertest.cc

components/brave_rewards/browser/rewards_service_impl.cc

browser/brave_rewards/creator_detection_script_injector.cc

browser/brave_rewards/rewards_tab_helper.cc

browser/brave_rewards/creator_detection_script_injector.cc

browser/brave_rewards/test/creator_detection_browsertest.cc

browser/brave_rewards/rewards_tab_helper.cc

github-actions · 2024-10-24T13:01:09Z

browser/brave_rewards/rewards_tab_helper.cc

+    creator_detection_.DetectCreator(
+        navigation_handle->GetRenderFrameHost(),
+        base::BindOnce(&RewardsTabHelper::OnCreatorDetected,
+                       base::Unretained(this), detection_navigation_id_));


_{reported by reviewdog 🐶}
[semgrep] base::Unretained is most of the time unrequited, and a weak reference is better suited for secure coding.
Consider swapping Unretained for a weak reference.
base::Unretained usage may be acceptable when a callback owner is guaranteed
to be destroyed with the object base::Unretained is pointing to, for example:

- PrefChangeRegistrar
- base::*Timer
- mojo::Receiver
- any other class member destroyed when the class is deallocated

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/chromium-uaf.yaml

Cc @thypon @goodov @iefremov

browser/brave_rewards/creator_detection_script_injector.cc

github-actions · 2024-10-24T20:54:01Z

browser/brave_rewards/creator_detection_script_injector.cc

+  injector_->RequestAsyncExecuteScript(
+      ISOLATED_WORLD_ID_BRAVE_INTERNAL, base::UTF8ToUTF16(script),
+      blink::mojom::UserActivationOption::kDoNotActivate,
+      blink::mojom::PromiseResultOption::kAwait, std::move(callback));


_{reported by reviewdog 🐶}
[semgrep] RequestAsyncExecuteScript usages should be vet by the security-team.

References:
- https://github.com/brave/brave-browser/wiki/Security-reviews (point 13)

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/brave-execute-script.yaml

Cc @thypon @diracdeltas @bridiver

github-actions · 2024-10-24T20:54:02Z

components/brave_rewards/resources/creator_detection/helpers.ts

+}
+
+export function urlPath(url: string) {
+  try { return new URL(url, location.href).pathname }


_{reported by reviewdog 🐶}
[semgrep] Are you using the URL(url, base) constructor as a security control to limit the origin with base location.href? The base is ignored whenever url looks like an absolute URL, e.g. when it begins protocol://. \\\\ or //x.y. Verify that the URL's origin is as expected rather than relying on the URL constructor.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/url-constructor-base.yaml

Cc @thypon @kdenhartog

github-actions · 2024-10-24T20:54:02Z

components/brave_rewards/resources/creator_detection/helpers.ts

+}
+
+export function absoluteURL(url: string) {
+  try { return new URL(url, location.href).toString() }


_{reported by reviewdog 🐶}
[semgrep] Are you using the URL(url, base) constructor as a security control to limit the origin with base location.href? The base is ignored whenever url looks like an absolute URL, e.g. when it begins protocol://. \\\\ or //x.y. Verify that the URL's origin is as expected rather than relying on the URL constructor.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/url-constructor-base.yaml

Cc @thypon @kdenhartog

github-actions · 2024-10-24T20:54:02Z

browser/brave_rewards/creator_detection_script_injector.cc

+    ExecuteScriptCallback callback) {
+  CHECK(injector_.is_bound());
+  injector_->RequestAsyncExecuteScript(
+      ISOLATED_WORLD_ID_BRAVE_INTERNAL, base::UTF8ToUTF16(script),


_{reported by reviewdog 🐶}
[semgrep] Security hotspot found (ISOLATED_WORLD). A security-team member should analyze the code security for possible vulnerabilities.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/brave-isolated-world.yaml

Cc @thypon @diracdeltas @bridiver

github-actions · 2024-10-25T15:42:12Z

[puLL-Merge] - brave/brave-core@25949

Description

This pull request introduces a new feature for detecting Brave Creators on media platform sites. It removes the existing Greaselion-based implementation and replaces it with a new, more efficient system that uses JavaScript injection to detect creators directly on supported platforms.

Changes

Changes

browser/about_flags.cc:
- Added a new feature flag for the platform creator detection feature.
browser/brave_rewards/BUILD.gn:
- Updated dependencies and added new source files for the creator detection feature.
browser/brave_rewards/creator_detection_script_injector.cc and creator_detection_script_injector.h:
- Introduced new files for injecting and managing creator detection scripts.
browser/brave_rewards/rewards_service_factory.cc:
- Removed Greaselion-related dependencies and initialization.
browser/brave_rewards/rewards_tab_helper.cc and rewards_tab_helper.h:
- Updated to use the new creator detection system instead of Greaselion.
browser/extensions/api/brave_rewards_api.cc and brave_rewards_api.h:
- Removed several deprecated API methods related to the old publisher detection system.
browser/extensions/brave_component_loader.cc:
- Removed Brave Rewards-related preference change handling.
browser/greaselion/:
- Removed Greaselion-related files and tests.
common/extensions/api/brave_rewards.json:
- Removed deprecated API methods related to the old publisher detection system.
components/brave_extension/extension/brave_extension/background/greaselion.ts:
- Removed this file as it's no longer needed.
components/brave_rewards/:
- Moved publisher utility functions from browser/ to common/.
- Added new creator detection scripts for various platforms (GitHub, Reddit, Twitch, Twitter, Vimeo, YouTube).
- Updated various files to use the new creator detection system.
test/BUILD.gn:
- Removed Greaselion-related test dependencies.

Possible Issues

The removal of Greaselion might affect other parts of the system that were relying on it. Thorough testing across different scenarios is recommended.
The new creator detection scripts may need fine-tuning for edge cases on each platform.

Security Hotspots

browser/brave_rewards/creator_detection_script_injector.cc:
- The script injection mechanism should be carefully reviewed to ensure it doesn't introduce any security vulnerabilities.
components/brave_rewards/resources/creator_detection/:
- The platform-specific detection scripts should be audited to ensure they don't expose sensitive information or introduce potential XSS vulnerabilities.

brave-builds · 2024-10-25T19:18:57Z

Released in v1.73.50

zenparsing requested review from a team as code owners October 11, 2024 13:56

github-actions bot added CI/storybook-url Deploy storybook and provide a unique URL for each build CI/run-upstream-tests Run upstream unit and browser tests on Linux and Windows (otherwise only on Linux) labels Oct 11, 2024

github-actions bot assigned zenparsing Oct 11, 2024

github-actions bot added the puLL-Merge label Oct 11, 2024

github-actions bot reviewed Oct 11, 2024

View reviewed changes

github-actions bot added the needs-security-review label Oct 11, 2024

github-actions bot assigned bridiver, diracdeltas, goodov, iefremov, kdenhartog and thypon Oct 11, 2024

zenparsing force-pushed the ksmith-gl-dodo-2 branch 2 times, most recently from fb5cc24 to a3c13cd Compare October 11, 2024 17:32

diracdeltas reviewed Oct 11, 2024

View reviewed changes

browser/brave_rewards/rewards_tab_helper.cc Outdated Show resolved Hide resolved

diracdeltas reviewed Oct 11, 2024

View reviewed changes

browser/brave_rewards/rewards_tab_helper.cc Show resolved Hide resolved

diracdeltas reviewed Oct 11, 2024

View reviewed changes

browser/brave_rewards/test/creator_detection_browsertest.cc Show resolved Hide resolved

diracdeltas reviewed Oct 11, 2024

View reviewed changes

renderer/brave_content_renderer_client.cc Outdated Show resolved Hide resolved

diracdeltas reviewed Oct 11, 2024

View reviewed changes

renderer/brave_content_renderer_client.cc Outdated Show resolved Hide resolved

emerick approved these changes Oct 12, 2024

View reviewed changes

zenparsing force-pushed the ksmith-gl-dodo-2 branch 2 times, most recently from 805281a to 442ee26 Compare October 16, 2024 14:58

diracdeltas requested a review from bridiver October 16, 2024 16:51

bridiver reviewed Oct 17, 2024

View reviewed changes

browser/brave_rewards/creator_detection_script_injector.h Outdated Show resolved Hide resolved

bridiver reviewed Oct 17, 2024

View reviewed changes

browser/brave_rewards/test/creator_detection_browsertest.cc Outdated Show resolved Hide resolved

bridiver reviewed Oct 17, 2024

View reviewed changes

browser/brave_rewards/rewards_tab_helper.cc Show resolved Hide resolved

bridiver reviewed Oct 17, 2024

View reviewed changes

browser/brave_rewards/test/creator_detection_browsertest.cc Outdated Show resolved Hide resolved

bridiver reviewed Oct 17, 2024

View reviewed changes

browser/brave_rewards/test/creator_detection_browsertest.cc Outdated Show resolved Hide resolved

atuchin-m reviewed Oct 17, 2024

View reviewed changes

browser/brave_rewards/test/creator_detection_browsertest.cc Outdated Show resolved Hide resolved

bridiver reviewed Oct 17, 2024

View reviewed changes

components/brave_rewards/browser/rewards_service_impl.cc Show resolved Hide resolved

zenparsing force-pushed the ksmith-gl-dodo-2 branch from 442ee26 to bafbb4a Compare October 18, 2024 12:09

github-actions bot reviewed Oct 18, 2024

View reviewed changes

browser/brave_rewards/creator_detection_script_injector.cc Show resolved Hide resolved

browser/brave_rewards/creator_detection_script_injector.cc Show resolved Hide resolved

browser/brave_rewards/rewards_tab_helper.cc Outdated Show resolved Hide resolved

zenparsing mentioned this pull request Oct 18, 2024

Remove Greaselion dependency from Rewards service #25394

Closed

24 tasks

bridiver reviewed Oct 18, 2024

View reviewed changes

browser/brave_rewards/creator_detection_script_injector.cc Outdated Show resolved Hide resolved

zenparsing force-pushed the ksmith-gl-dodo-2 branch from bafbb4a to c3ffb61 Compare October 18, 2024 19:32

diracdeltas mentioned this pull request Oct 18, 2024

move cosmetic filters into separate isolated world brave/brave-browser#41727

Open

zenparsing force-pushed the ksmith-gl-dodo-2 branch from c3ffb61 to e8666ab Compare October 22, 2024 20:40

diracdeltas approved these changes Oct 22, 2024

View reviewed changes

bridiver reviewed Oct 22, 2024

View reviewed changes

browser/brave_rewards/creator_detection_script_injector.cc Show resolved Hide resolved

bridiver reviewed Oct 22, 2024

View reviewed changes

browser/brave_rewards/test/creator_detection_browsertest.cc Show resolved Hide resolved

bridiver reviewed Oct 22, 2024

View reviewed changes

browser/brave_rewards/rewards_tab_helper.cc Outdated Show resolved Hide resolved

bridiver reviewed Oct 22, 2024

View reviewed changes

browser/brave_rewards/rewards_tab_helper.cc Outdated Show resolved Hide resolved

zenparsing force-pushed the ksmith-gl-dodo-2 branch 2 times, most recently from f019ae7 to 445543d Compare October 24, 2024 12:56

github-actions bot reviewed Oct 24, 2024

View reviewed changes

bridiver reviewed Oct 24, 2024

View reviewed changes

browser/brave_rewards/creator_detection_script_injector.cc Outdated Show resolved Hide resolved

bridiver approved these changes Oct 24, 2024

View reviewed changes

zenparsing force-pushed the ksmith-gl-dodo-2 branch from 445543d to cd73dc4 Compare October 24, 2024 20:49

github-actions bot reviewed Oct 24, 2024

View reviewed changes

Remove Greaselion dependency from Rewards service

b650615

zenparsing force-pushed the ksmith-gl-dodo-2 branch from cd73dc4 to b650615 Compare October 25, 2024 15:41

zenparsing merged commit dc4430d into master Oct 25, 2024
17 checks passed

zenparsing deleted the ksmith-gl-dodo-2 branch October 25, 2024 18:14

github-actions bot added this to the 1.73.x - Nightly milestone Oct 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove Greaselion dependency from Rewards service (v2) #25949

Remove Greaselion dependency from Rewards service (v2) #25949

zenparsing commented Oct 11, 2024 •

edited

Loading

brave-builds commented Oct 11, 2024

bridiver Oct 17, 2024 •

edited

Loading

bridiver Oct 17, 2024

bridiver Oct 17, 2024

zenparsing Oct 18, 2024

bridiver Oct 18, 2024

bridiver Oct 22, 2024

zenparsing Oct 23, 2024

bridiver Oct 23, 2024

bridiver Oct 23, 2024

bridiver Oct 23, 2024

github-actions bot Oct 24, 2024

github-actions bot Oct 24, 2024

github-actions bot Oct 24, 2024

github-actions bot Oct 24, 2024

github-actions bot Oct 24, 2024

github-actions bot commented Oct 25, 2024

Changes

brave-builds commented Oct 25, 2024

Remove Greaselion dependency from Rewards service (v2) #25949

Remove Greaselion dependency from Rewards service (v2) #25949

Conversation

zenparsing commented Oct 11, 2024 • edited Loading

Overview

Submitter Checklist:

Reviewer Checklist:

After-merge Checklist:

Test Plan:

brave-builds commented Oct 11, 2024

bridiver Oct 17, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot Oct 24, 2024

Choose a reason for hiding this comment

github-actions bot Oct 24, 2024

Choose a reason for hiding this comment

github-actions bot Oct 24, 2024

Choose a reason for hiding this comment

github-actions bot Oct 24, 2024

Choose a reason for hiding this comment

github-actions bot Oct 24, 2024

Choose a reason for hiding this comment

github-actions bot commented Oct 25, 2024

Description

Changes

Possible Issues

Security Hotspots

brave-builds commented Oct 25, 2024

zenparsing commented Oct 11, 2024 •

edited

Loading

bridiver Oct 17, 2024 •

edited

Loading