Reland "Make Clear-Site-Data: "cookies" respect third-party cookie bl…

…ocking"

The failure in the rollback [1] is because one cookie was not cleared when the first CSD header is sent in clear_site_data_handler_browsertest.cc. This should only be possible if 3P cookie blocking is already enabled at the beginning of the test.

To patch this, I explicitly disable 3PCB at the start of the test.

To be conservative, I also explicitly enable the partitioned cookies feature so that it does not rely on the environment's default. Right now, partitioned cookies are enabled via the field trial testing config.

[1]: https://ci.chromium.org/ui/p/chrome/builders/ci/linux-chromeos-chrome/31221/overview

This is a reland of commit d27d506

Original change's description:
> Make Clear-Site-Data: "cookies" respect third-party cookie blocking
>
> This will prevent Clear-Site-Data from being abused for cross-site
> tracking [1] when partitioned cookies are enabled by default.
>
> [1]: privacycg/storage-partitioning#11
>
> Old behavior: Clear-Site-Data could clear unpartitioned cookies from any context.
>
> New behavior: Clear-Site-Data cannot clear unpartitioned cookies if it came from a response where 3P cookie blocking applies.
>
> In both cases, CSD will delete partitioned cookies in the current partition.
>
> Low-Coverage-Reason:Some files have trial changes that do not impact behavior.
>
> Bug: 1416655
> Change-Id: Ieed1e050f8f376b7d7704b4948c8f59adc21a17f
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4312585
> Reviewed-by: Nasko Oskov <nasko@chromium.org>
> Reviewed-by: Andrey Zaytsev <andzaytsev@google.com>
> Reviewed-by: Maks Orlovich <morlovich@chromium.org>
> Reviewed-by: Daniel Murphy <dmurph@chromium.org>
> Commit-Queue: Dylan Cutler <dylancutler@google.com>
> Reviewed-by: Christian Dullweber <dullweber@chromium.org>
> Reviewed-by: Oleh Lamzin <lamzin@google.com>
> Cr-Commit-Position: refs/heads/main@{#1118080}

Bug: 1416655
Change-Id: I10e54ba18587c7c9a838e79dd52a535b5e8ff751
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4346675
Reviewed-by: Christian Dullweber <dullweber@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Reviewed-by: Maks Orlovich <morlovich@chromium.org>
Commit-Queue: Dylan Cutler <dylancutler@google.com>
Reviewed-by: Oleh Lamzin <lamzin@google.com>
Reviewed-by: Andrey Zaytsev <andzaytsev@google.com>
Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1119580}

chrome/browser/ash/wilco_dtc_supportd/wilco_dtc_supportd_network_context.cc

@@ -114,6 +114,7 @@ void WilcoDtcSupportdNetworkContextImpl::OnClearSiteData(
  const std::string& header_value,
  int32_t load_flags,
  const absl::optional<net::CookiePartitionKey>& cookie_partition_key,
+ bool partitioned_state_allowed_only,
  OnClearSiteDataCallback callback) {
  std::move(callback).Run();
 }

chrome/browser/ash/wilco_dtc_supportd/wilco_dtc_supportd_network_context.h

@@ -80,6 +80,7 @@ class WilcoDtcSupportdNetworkContextImpl
  const std::string& header_value,
  int32_t load_flags,
  const absl::optional<net::CookiePartitionKey>& cookie_partition_key,
+ bool partitioned_state_allowed_only,
  OnClearSiteDataCallback callback) override;
  void OnLoadingStateUpdate(network::mojom::LoadInfoPtr info,
  OnLoadingStateUpdateCallback callback) override;

chrome/browser/browsing_data/browsing_data_remover_browsertest.cc

@@ -786,6 +786,7 @@ class BrowsingDataRemoverWithPasswordsAccountStorageBrowserTest
  /*avoid_closing_connections=*/true,
  /*cookie_partition_key=*/cookie_partition_key,
  /*storage_key=*/storage_key,
+ /*partitioned_state_allowed_only=*/false,
  /*callback=*/loop.QuitClosure());
  loop.Run();
  }
@@ -972,6 +973,7 @@ class BrowsingDataRemoverStorageBucketsBrowserTest
  /*avoid_closing_connections=*/true,
  /*cookie_partition_key=*/absl::nullopt,
  /*storage_key=*/storage_key,
+ /*partitioned_state_allowed_only=*/false,
  /*callback=*/loop.QuitClosure());
  loop.Run();
  }

chrome/browser/ui/views/web_apps/web_app_uninstall_dialog_view.cc

@@ -196,7 +196,9 @@ void WebAppUninstallDialogDelegateView::ClearWebAppSiteData() {
  /*storage_buckets_to_remove=*/{},
  /*avoid_closing_connections=*/false,
  /*cookie_partition_key=*/absl::nullopt,
- /*storage_key=*/absl::nullopt, base::DoNothing());
+ /*storage_key=*/absl::nullopt,
+ /*partitioned_state_allowed_only=*/false,
+ base::DoNothing());
 }
 
 void WebAppUninstallDialogDelegateView::ProcessAutoConfirmValue() {

chrome/browser/web_applications/app_service/web_app_publisher_helper.cc

@@ -772,16 +772,17 @@ void WebAppPublisherHelper::UninstallWebApp(
  constexpr bool kClearCache = true;
  constexpr bool kAvoidClosingConnections = false;
 
- content::ClearSiteData(base::BindRepeating(
- [](content::BrowserContext* browser_context) {
- return browser_context;
- },
- base::Unretained(profile())),
- origin, kClearCookies, kClearStorage, kClearCache,
- /*storage_buckets_to_remove=*/{},
- kAvoidClosingConnections,
- /*cookie_partition_key=*/absl::nullopt,
- /*storage_key=*/absl::nullopt, base::DoNothing());
+ content::ClearSiteData(
+ base::BindRepeating(
+ [](content::BrowserContext* browser_context) {
+ return browser_context;
+ },
+ base::Unretained(profile())),
+ origin, kClearCookies, kClearStorage, kClearCache,
+ /*storage_buckets_to_remove=*/{}, kAvoidClosingConnections,
+ /*cookie_partition_key=*/absl::nullopt,
+ /*storage_key=*/absl::nullopt,
+ /*partitioned_state_allowed_only=*/false, base::DoNothing());
 }
 
 void WebAppPublisherHelper::SetIconEffect(const std::string& app_id) {

content/browser/browsing_data/browsing_data_filter_builder_impl.cc

@@ -213,6 +213,10 @@ bool BrowsingDataFilterBuilderImpl::MatchesAllOriginsAndDomains() {
  return mode_ == Mode::kPreserve && origins_.empty() && domains_.empty();
 }
 
+void BrowsingDataFilterBuilderImpl::SetPartitionedStateAllowedOnly(bool value) {
+ partitioned_state_only_ = value;
+}
+
 base::RepeatingCallback<bool(const GURL&)>
 BrowsingDataFilterBuilderImpl::BuildUrlFilter() {
  if (MatchesAllOriginsAndDomains())
@@ -274,6 +278,8 @@ BrowsingDataFilterBuilderImpl::BuildCookieDeletionFilter() {
  deletion_filter->cookie_partition_key_collection =
  cookie_partition_key_collection_;
 
+ deletion_filter->partitioned_state_only = partitioned_state_only_;
+
  switch (mode_) {
  case Mode::kDelete:
  deletion_filter->including_domains.emplace(domains_.begin(),

content/browser/browsing_data/browsing_data_filter_builder_impl.h

@@ -41,6 +41,7 @@ class CONTENT_EXPORT BrowsingDataFilterBuilderImpl
  bool MatchesWithSavedStorageKey(
  const blink::StorageKey& other_key) const override;
  bool MatchesAllOriginsAndDomains() override;
+ void SetPartitionedStateAllowedOnly(bool value) override;
  base::RepeatingCallback<bool(const GURL&)> BuildUrlFilter() override;
  content::StoragePartition::StorageKeyMatcherFunction BuildStorageKeyFilter()
  override;
@@ -68,6 +69,7 @@ class CONTENT_EXPORT BrowsingDataFilterBuilderImpl
  net::CookiePartitionKeyCollection cookie_partition_key_collection_ =
  net::CookiePartitionKeyCollection::ContainsAll();
  absl::optional<blink::StorageKey> storage_key_ = absl::nullopt;
+ bool partitioned_state_only_ = false;
 };
 
 } // content

content/browser/browsing_data/browsing_data_filter_builder_impl_unittest.cc

@@ -869,4 +869,51 @@ TEST(BrowsingDataFilterBuilderImplTest, GetRegisterableDomains) {
  UnorderedElementsAre(kGoogleDomain, kLongETLDDomain));
 }
 
+TEST(BrowsingDataFilterBuilderImplTest, ExcludeUnpartitionedCookies) {
+ BrowsingDataFilterBuilderImpl builder(
+ BrowsingDataFilterBuilderImpl::Mode::kDelete);
+
+ builder.SetPartitionedStateAllowedOnly(true);
+
+ CookieDeletionInfo delete_info =
+ network::DeletionFilterToInfo(builder.BuildCookieDeletionFilter());
+
+ // Unpartitioned cookie should NOT match.
+ std::unique_ptr<net::CanonicalCookie> cookie = net::CanonicalCookie::Create(
+ GURL("https://www.cookie.com/"),
+ "__Host-A=B; Secure; SameSite=None; Path=/;", base::Time::Now(),
+ absl::nullopt, absl::nullopt);
+ EXPECT_TRUE(cookie);
+ EXPECT_FALSE(delete_info.Matches(
+ *cookie, net::CookieAccessParams{
+ net::CookieAccessSemantics::NONLEGACY, false,
+ net::CookieSamePartyStatus::kNoSamePartyEnforcement}));
+
+ // Partitioned cookie should match.
+ cookie = net::CanonicalCookie::Create(
+ GURL("https://www.cookie.com/"),
+ "__Host-A=B; Secure; SameSite=None; Path=/; Partitioned;",
+ base::Time::Now(), absl::nullopt,
+ net::CookiePartitionKey::FromURLForTesting(
+ GURL("https://toplevelsite.com")));
+ EXPECT_TRUE(cookie);
+ EXPECT_TRUE(delete_info.Matches(
+ *cookie, net::CookieAccessParams{
+ net::CookieAccessSemantics::NONLEGACY, false,
+ net::CookieSamePartyStatus::kNoSamePartyEnforcement}));
+
+ // Nonced partitioned cookie should match.
+ cookie = net::CanonicalCookie::Create(
+ GURL("https://www.cookie.com/"),
+ "__Host-A=B; Secure; SameSite=None; Path=/;", base::Time::Now(),
+ absl::nullopt,
+ net::CookiePartitionKey::FromURLForTesting(
+ GURL("https://toplevelsite.com"), base::UnguessableToken::Create()));
+ EXPECT_TRUE(cookie);
+ EXPECT_TRUE(delete_info.Matches(
+ *cookie, net::CookieAccessParams{
+ net::CookieAccessSemantics::NONLEGACY, false,
+ net::CookieSamePartyStatus::kNoSamePartyEnforcement}));
+}
+
 } // namespace content

content/browser/browsing_data/browsing_data_remover_impl_browsertest.cc

@@ -407,6 +407,36 @@ IN_PROC_BROWSER_TEST_F(CookiesBrowsingDataRemoverImplBrowserTest,
  EXPECT_EQ("F", cookies[2].Name());
 }
 
+IN_PROC_BROWSER_TEST_F(CookiesBrowsingDataRemoverImplBrowserTest,
+ ClearSiteData_PartitionedStateAllowedOnly) {
+ // Unpartitioned cookie should not be removed when third-party cookie blocking
+ // applies to the request that sent Clear-Site-Data.
+ ASSERT_TRUE(SetCookie(GURL("https://a.com"), "A=0; secure;",
+ /*cookie_partition_key=*/absl::nullopt));
+ // Partitioned cookies should still be removed.
+ ASSERT_TRUE(SetCookie(
+ GURL("https://a.com"), "B=1; secure; partitioned",
+ net::CookiePartitionKey::FromURLForTesting(GURL("https://b.com"))));
+ // Nonced partitioned cookies should still be removed.
+ ASSERT_TRUE(
+ SetCookie(GURL("https://a.com"), "C=2; secure;",
+ net::CookiePartitionKey::FromURLForTesting(
+ GURL("https://b.com"), base::UnguessableToken::Create())));
+
+ std::unique_ptr<BrowsingDataFilterBuilder> builder(
+ BrowsingDataFilterBuilder::Create(
+ BrowsingDataFilterBuilder::Mode::kDelete));
+ builder->AddRegisterableDomain("a.com");
+ builder->SetPartitionedStateAllowedOnly(true);
+
+ RemoveWithFilterAndWait(BrowsingDataRemover::DATA_TYPE_COOKIES,
+ std::move(builder));
+
+ auto cookies = GetAllCookies();
+ EXPECT_EQ(1u, cookies.size());
+ EXPECT_EQ("A", cookies[0].Name());
+}
+
 namespace {
 // Provide BrowsingDataRemoverImplTrustTokenTest the Trust Tokens
 // feature as a mixin so that it gets set before the superclass initializes

content/browser/browsing_data/clear_site_data_handler.cc

@@ -104,10 +104,12 @@ void ClearSiteDataHandler::HandleHeader(
  int load_flags,
  const absl::optional<net::CookiePartitionKey>& cookie_partition_key,
  const absl::optional<blink::StorageKey>& storage_key,
+ bool partitioned_state_allowed_only,
  base::OnceClosure callback) {
  ClearSiteDataHandler handler(browser_context_getter, web_contents_getter, url,
  header_value, load_flags, cookie_partition_key,
- storage_key, std::move(callback),
+ storage_key, partitioned_state_allowed_only,
+ std::move(callback),
  std::make_unique<ConsoleMessagesDelegate>());
  handler.HandleHeaderAndOutputConsoleMessages();
 }
@@ -134,6 +136,7 @@ ClearSiteDataHandler::ClearSiteDataHandler(
  int load_flags,
  const absl::optional<net::CookiePartitionKey>& cookie_partition_key,
  const absl::optional<blink::StorageKey>& storage_key,
+ bool partitioned_state_allowed_only,
  base::OnceClosure callback,
  std::unique_ptr<ConsoleMessagesDelegate> delegate)
  : browser_context_getter_(browser_context_getter),
@@ -143,6 +146,7 @@ ClearSiteDataHandler::ClearSiteDataHandler(
  load_flags_(load_flags),
  cookie_partition_key_(cookie_partition_key),
  storage_key_(storage_key),
+ partitioned_state_allowed_only_(partitioned_state_allowed_only),
  callback_(std::move(callback)),
  delegate_(std::move(delegate)) {
  DCHECK(browser_context_getter_);
@@ -336,7 +340,8 @@ void ClearSiteDataHandler::ExecuteClearingTask(
  ClearSiteData(browser_context_getter_, origin, clear_cookies, clear_storage,
  clear_cache, storage_buckets_to_remove,
  true /*avoid_closing_connections*/, cookie_partition_key_,
- storage_key_, std::move(callback));
+ storage_key_, partitioned_state_allowed_only_,
+ std::move(callback));
 }
 
 // static

content/browser/browsing_data/clear_site_data_handler.h

@@ -83,6 +83,7 @@ class CONTENT_EXPORT ClearSiteDataHandler {
  int load_flags,
  const absl::optional<net::CookiePartitionKey>& cookie_partition_key,
  const absl::optional<blink::StorageKey>& storage_key,
+ bool partitioned_state_allowed_only,
  base::OnceClosure callback);
 
  // Exposes ParseHeader() publicly for testing.
@@ -104,6 +105,7 @@ class CONTENT_EXPORT ClearSiteDataHandler {
  int load_flags,
  const absl::optional<net::CookiePartitionKey>& cookie_partition_key,
  const absl::optional<blink::StorageKey>& storage_key,
+ bool partitioned_state_allowed_only,
  base::OnceClosure callback,
  std::unique_ptr<ConsoleMessagesDelegate> delegate);
  virtual ~ClearSiteDataHandler();
@@ -163,27 +165,35 @@ class CONTENT_EXPORT ClearSiteDataHandler {
  return storage_key_;
  }
 
+ bool PartitionedStateOnlyForTesting() const {
+ return partitioned_state_allowed_only_;
+ }
+
  private:
  // Required to clear the data.
  base::RepeatingCallback<BrowserContext*()> browser_context_getter_;
  base::RepeatingCallback<WebContents*()> web_contents_getter_;
 
  // Target URL whose data will be cleared.
- GURL url_;
+ const GURL url_;
 
  // Raw string value of the 'Clear-Site-Data' header.
- std::string header_value_;
+ const std::string header_value_;
 
  // Load flags of the current request, used to check cookie policies.
- int load_flags_;
+ const int load_flags_;
 
  // The cookie partition key for which we need to clear partitioned cookies
  // when we receive the Clear-Site-Data header.
- absl::optional<net::CookiePartitionKey> cookie_partition_key_;
+ const absl::optional<net::CookiePartitionKey> cookie_partition_key_;
 
  // The storage key for which we need to clear partitioned storage when we
  // receive the Clear-Site-Data header.
- absl::optional<blink::StorageKey> storage_key_;
+ const absl::optional<blink::StorageKey> storage_key_;
+
+ // If third-party cookie blocking is enabled and applies to the response that
+ // sent Clear-Site-Data.
+ const bool partitioned_state_allowed_only_;
 
  // Used to notify that the clearing has completed. Callers could resuming
  // loading after this point.