GSB stores showing unavailable although they are locally available

[Shibani Das]

Hello everyone,

I am trying to get the function CheckCSDAllowlistURL running in my system which tries to get the stores available locally. I have tried to check if it the Allowlists (Stores) working in Chromium version and unfortunately, it is showing not available. I have attached a screenshot of the point where I am facing the issue at (https://source.chromium.org/chromium/chromium/src/+/main:components/safe_browsing/core/browser/db/v4_local_database_manager.cc;l=518;bpv=0;bpt=0). I am confused at this because I have all the Stores available in my system and I have attached the screenshot of that also. So, could you point me to some references how to resolve this issue or explain why is it not able to access although it is present locally? Any help is greatly appreciated.

Thank you so much for your attention. 

Sincerely,

Shibani Das.

[Daniel Rubery]

Hello,

Two immediate questions:

1. You've added some reasonable logging statements. What do they actually output? I can't tell from photos of source code which of those logging statements actually run.

2. I suspect your second screenshot is looking at the wrong data directory. In your local build, what's the "Profile path"? Without special build configuration, it will look in .config/chromium, not .config/google-chrome.

[Daniel Rubery]

Sorry that second question should be: what's the "Profile path" on chrome://version?

[Shibani Das]

Dear Daniel,

Thank you so much for responding. Here are the answers to your questions.

1. As you can see in the code of CheckCsdAllowlistUrl function pasted below, I have given three log statements each for three if conditions. It outputs - "AreAllStoresAvailable failed" and "artificial prefix empty". However, it doesn't print "Cannot check url". A screenshot of the output has been attached below.

2. The Profile Path is - /home/student/.config/chromium/Default. I attached the screenshot of the added log statement for the profile path in the file profile_impl.cc. Can you refer to the instructions for the special build configuration which will trigger it to look into the .config/google-chrome directory?

Code of the CheckCsdAllowlistUrl function:

//start of the code

AsyncMatch V4LocalDatabaseManager::CheckCsdAllowlistUrl(const GURL& url,
                                                        Client* client) {

  DCHECK(ui_task_runner()->RunsTasksInCurrentSequence());

  StoresToCheck stores_to_check({GetUrlCsdAllowlistId()});

  // If any artificial matches are present, consider the allowlist as ready.
 
  bool is_artificial_prefix_empty =
      artificially_marked_store_and_hash_prefixes_.empty();

  if(!AreAllStoresAvailableNow(stores_to_check))
    LOG(ERROR)<<"AreAllStoresAvailableNow failed";
  if(is_artificial_prefix_empty)
    LOG(ERROR)<<"artificial prefix empty";
  if(!CanCheckUrl(url))
    LOG(ERROR)<<"Cannot check url";
 
  if ((!AreAllStoresAvailableNow(stores_to_check) &&
       is_artificial_prefix_empty) ||
      !CanCheckUrl(url)) {
    // Fail open: Allowlist everything. Otherwise we may run the
    // CSD phishing/malware detector on popular domains and generate
    // undue load on the client and server, or send Password Reputation
    // requests on popular sites. This has the effect of disabling
    // CSD phishing/malware detection and password reputation service
    // until the store is first synced and/or loaded from disk.
    return AsyncMatch::MATCH;
  }
  LOG(ERROR)<<"After the if condition AreAllStoresAvailableNow";

  std::unique_ptr<PendingCheck> check = std::make_unique<PendingCheck>(
      client, ClientCallbackType::CHECK_CSD_ALLOWLIST, stores_to_check,
      std::vector<GURL>(1, url));

  HandleAllowlistCheck(std::move(check),
                       /*allow_async_full_hash_check=*/true,
                       base::OnceCallback<void(bool)>());
  return AsyncMatch::ASYNC;
}

//end of the code

Thanks once again for your time and support.

Sincerely,

Shibani Das.

[Shibani Das]

Thank you so much, Daniel. Let me try this out.

On Tue, Jul 1, 2025 at 3:45 PM Daniel Rubery <dru...@google.com> wrote:

Ah, sorry I missed this the first time around. The CsdAllowlist is only synced for Chrome branded builds, not for Chromium branded builds. It also requires an API key. You can follow the steps here to get one. I don't think you need any special permissions on the API key to get the CSD allowlist, but you might want to confirm that your API key allows you to sync something like UrlSoceng.store. 

To get the CSD allowlist syncing, change kSyncOnChromeDesktopBuilds to kSyncAlways here and then start Chromium and wait. Note that you may need a few minutes after startup before syncing occurs. You can see that status at chrome://safe-browsing/#tab-db-manager.

[Daniel Rubery]

Ah, sorry I missed this the first time around. The CsdAllowlist is only synced for Chrome branded builds, not for Chromium branded builds. It also requires an API key. You can follow the steps here to get one. I don't think you need any special permissions on the API key to get the CSD allowlist, but you might want to confirm that your API key allows you to sync something like UrlSoceng.store. 

To get the CSD allowlist syncing, change kSyncOnChromeDesktopBuilds to kSyncAlways here and then start Chromium and wait. Note that you may need a few minutes after startup before syncing occurs. You can see that status at chrome://safe-browsing/#tab-db-manager.

[Shibani Das]

Dear Daniel,

I did the steps as you suggested and it worked. Thank you so much for your help and support. Really appreciate it.

Sincerely,

Shibani Das.