1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
// Copyright 2024 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/digital_credentials/digital_identity_low_risk_origins.h"
#include "base/strings/string_util.h"
#include "chrome/browser/digital_credentials/digital_credentials_keyed_service.h"
#include "chrome/browser/optimization_guide/optimization_guide_keyed_service.h"
#include "chrome/browser/optimization_guide/optimization_guide_keyed_service_factory.h"
#include "chrome/browser/profiles/profile.h"
#include "content/public/browser/render_frame_host.h"
#include "url/gurl.h"
#include "url/origin.h"
namespace digital_credentials {
namespace {
using content::RenderFrameHost;
/*
* Temporary list of origins considered lower-risk to facilitate an experimental
* test of the Digital Credential API while standardized trust signals are being
* developed (such as in
* https://github.com/WICG/digital-credentials/issues/136). This list is used
* only as a heuristic for UI purposes, not to gate any API access. To submit
* proposals for changes to this list, please file an issue at
* https://bit.ly/cr-dc-origin-risk
*/
// TODO(https://crbug.com/350946977): Populate.
constexpr const char* const kKnownLowRiskOrigins[] = {};
// Helper function with the core matching logic. Matches the origin to check
// against the list of known origins. The matching is done by normalizing both
// the origin to check and each origin in the list (stripping "www." prefix, if
// present) and comparing the resulting origins.
bool IsLowRiskOriginMatcher(const url::Origin& to_check,
const std::vector<std::string>& known_origins) {
for (const std::string& low_risk_origin_str : known_origins) {
url::Origin low_risk_origin_url =
url::Origin::Create(GURL(low_risk_origin_str));
// Normalize the host of the current low_risk_origin from the list.
std::string normalized_low_risk_host = low_risk_origin_url.host();
if (base::StartsWith(normalized_low_risk_host, "www.")) {
normalized_low_risk_host = normalized_low_risk_host.substr(4);
}
// Normalize the host of the origin to check.
std::string normalized_to_check_host = to_check.host();
if (base::StartsWith(normalized_to_check_host, "www.")) {
normalized_to_check_host = normalized_to_check_host.substr(4);
}
// Compare schemes, ports, and the normalized hosts.
if (low_risk_origin_url.scheme() == to_check.scheme() &&
low_risk_origin_url.port() == to_check.port() &&
normalized_low_risk_host == normalized_to_check_host) {
return true;
}
}
return false;
}
bool IsLastCommittedURLLowFriction(RenderFrameHost& render_frame_host) {
Profile* profile =
Profile::FromBrowserContext(render_frame_host.GetBrowserContext());
if (!profile) {
return false;
}
DigitalCredentialsKeyedService* service =
DigitalCredentialsKeyedServiceFactory::GetForProfile(profile);
if (!service) {
return false;
}
return service->IsLowFrictionUrl(render_frame_host.GetLastCommittedURL());
}
} // anonymous namespace
bool IsLastCommittedOriginLowRisk(RenderFrameHost& render_frame_host) {
// Convert the array of C strings to a vector of strings. This is fine since
// the list is expected to be small and the strings are all compile-time
// constants.
std::vector<std::string> origins_vector;
for (const char* origin_str : kKnownLowRiskOrigins) {
origins_vector.emplace_back(origin_str);
}
return IsLowRiskOriginMatcher(render_frame_host.GetLastCommittedOrigin(),
origins_vector) ||
IsLastCommittedURLLowFriction(render_frame_host);
}
bool IsLowRiskOriginMatcherForTesting(
const url::Origin& to_check,
const std::vector<std::string>& known_origins) {
return IsLowRiskOriginMatcher(to_check, known_origins);
}
} // namespace digital_credentials
|
