Validate referrer and user gesture in DownloadURL IPC [chromium/src : main]

[Zainab Rizvi (Gerrit)]

Attention needed from Bo Liu

Zainab Rizvi voted Commit-Queue+1

Commit-Queue

+1

Open in Gerrit

Related details

Attention is currently required from:

• Bo Liu

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I631b9f68ba560c9492459bcb093e7a0b02b795f4

Gerrit-Change-Number: 8205905

Gerrit-PatchSet: 2

Gerrit-Owner: Zainab Rizvi <riz...@google.com>

Gerrit-Reviewer: Bo Liu <bo...@chromium.org>

Gerrit-Reviewer: Zainab Rizvi <riz...@google.com>

Gerrit-CC: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Bo Liu <bo...@chromium.org>

Gerrit-Comment-Date: Thu, 06 Aug 2026 00:54:51 +0000

Gerrit-HasComments: No

Gerrit-Has-Labels: Yes

[Bo Liu (Gerrit)]

Attention needed from Zainab Rizvi

Bo Liu added 1 comment

File content/browser/renderer_host/render_frame_host_impl.cc

Line 7997, Patchset 2: HasTransientUserActivation());

Bo Liu . unresolved

can you check the case where user clicks on a button on foo.com which navigates to bar.com which then turns into a download from content-disposition

I don't think user activation carries across cross-origin frames, but maybe blink doesn't set user activation bit anyway

Open in Gerrit

Related details

Attention is currently required from:

• Zainab Rizvi

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review

• No-Unresolved-Comments

• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I631b9f68ba560c9492459bcb093e7a0b02b795f4

Gerrit-Change-Number: 8205905

Gerrit-PatchSet: 3

Gerrit-Owner: Zainab Rizvi <riz...@google.com>

Gerrit-Reviewer: Bo Liu <bo...@chromium.org>

Gerrit-Reviewer: Zainab Rizvi <riz...@google.com>

Gerrit-CC: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Zainab Rizvi <riz...@google.com>

Gerrit-Comment-Date: Fri, 07 Aug 2026 03:35:49 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

[Zainab Rizvi (Gerrit)]

Attention needed from Bo Liu

Zainab Rizvi added 1 comment

File content/browser/renderer_host/render_frame_host_impl.cc

Line 7997, Patchset 2: HasTransientUserActivation());

Bo Liu . unresolved

can you check the case where user clicks on a button on foo.com which navigates to bar.com which then turns into a download from content-disposition

I don't think user activation carries across cross-origin frames, but maybe blink doesn't set user activation bit anyway

Zainab Rizvi

That case goes through the navigation path, [FrameLoader](https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/loader/frame_loader.cc;drc=2838c7f0f68ba5b24d3c9658b1866d38dccfa1bf;l=717) sets has_user_gesture and the browser turns it into a download via NavigationRequest via navigation common_params, so this line doesn't affect it.

For the flows that do use this IPC (<a download>) Blink [sets the bit](https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/html/html_anchor_element.cc;drc=b8bd66449acc30b96766f13e4e25c64fc968e287;l=518]) from [local_frame](https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/frame/local_frame.cc;drc=2838c7f0f68ba5b24d3c9658b1866d38dccfa1bf;l=2901) so the renderer's copy of the same per-frame user_activation_state_ the browser reads here. The IPC is per-frame and reads the initiating frame's own activation. Lmk if I misunderstood that!

Also added a test.

Open in Gerrit

Related details

Attention is currently required from:

• Bo Liu

Submit Requirements:

• Code-Coverage
• Code-Owners
• Code-Review
• No-Unresolved-Comments
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I631b9f68ba560c9492459bcb093e7a0b02b795f4

Gerrit-Change-Number: 8205905

Gerrit-PatchSet: 4

Gerrit-Owner: Zainab Rizvi <riz...@google.com>

Gerrit-Reviewer: Bo Liu <bo...@chromium.org>

Gerrit-Reviewer: Zainab Rizvi <riz...@google.com>

Gerrit-CC: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Bo Liu <bo...@chromium.org>

Gerrit-Comment-Date: Fri, 07 Aug 2026 17:59:09 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: No

Comment-In-Reply-To: Bo Liu <bo...@chromium.org>

[Bo Liu (Gerrit)]

Attention needed from Zainab Rizvi

Bo Liu voted and added 1 comment

Votes added by Bo Liu

Code-Review

+1

1 comment

File content/browser/renderer_host/render_frame_host_impl.cc

Line 7997, Patchset 2: HasTransientUserActivation());

Bo Liu . resolved

can you check the case where user clicks on a button on foo.com which navigates to bar.com which then turns into a download from content-disposition

I don't think user activation carries across cross-origin frames, but maybe blink doesn't set user activation bit anyway

Zainab Rizvi

That case goes through the navigation path, [FrameLoader](https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/loader/frame_loader.cc;drc=2838c7f0f68ba5b24d3c9658b1866d38dccfa1bf;l=717) sets has_user_gesture and the browser turns it into a download via NavigationRequest via navigation common_params, so this line doesn't affect it.

For the flows that do use this IPC (<a download>) Blink [sets the bit](https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/html/html_anchor_element.cc;drc=b8bd66449acc30b96766f13e4e25c64fc968e287;l=518]) from [local_frame](https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/core/frame/local_frame.cc;drc=2838c7f0f68ba5b24d3c9658b1866d38dccfa1bf;l=2901) so the renderer's copy of the same per-frame user_activation_state_ the browser reads here. The IPC is per-frame and reads the initiating frame's own activation. Lmk if I misunderstood that!

Also added a test.

Bo Liu

Acknowledged

Open in Gerrit

Related details

Attention is currently required from:

• Zainab Rizvi

Submit Requirements:

• Code-Coverage
• Code-Owners

• Code-Review
• Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

Gerrit-MessageType: comment

Gerrit-Project: chromium/src

Gerrit-Branch: main

Gerrit-Change-Id: I631b9f68ba560c9492459bcb093e7a0b02b795f4

Gerrit-Change-Number: 8205905

Gerrit-PatchSet: 5

Gerrit-Owner: Zainab Rizvi <riz...@google.com>

Gerrit-Reviewer: Bo Liu <bo...@chromium.org>

Gerrit-Reviewer: Zainab Rizvi <riz...@google.com>

Gerrit-CC: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>

Gerrit-CC: Chromium Metrics Reviews <chromium-met...@google.com>

Gerrit-CC: android-bu...@system.gserviceaccount.com <android-bu...@system.gserviceaccount.com>

Gerrit-CC: chromium...@chromium.org

Gerrit-Attention: Zainab Rizvi <riz...@google.com>

Gerrit-Comment-Date: Sun, 09 Aug 2026 22:09:50 +0000

Gerrit-HasComments: Yes

Gerrit-Has-Labels: Yes

Comment-In-Reply-To: Bo Liu <bo...@chromium.org>

Comment-In-Reply-To: Zainab Rizvi <riz...@google.com>