| // Copyright 2017 The Chromium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "chrome/browser/safe_browsing/notification_image_reporter.h" |
| |
| #include <cmath> |
| #include <vector> |
| |
| #include "base/bind.h" |
| #include "base/feature_list.h" |
| #include "base/logging.h" |
| #include "base/memory/ref_counted_memory.h" |
| #include "base/metrics/histogram_functions.h" |
| #include "base/rand_util.h" |
| #include "base/task_scheduler/post_task.h" |
| #include "chrome/browser/browser_process.h" |
| #include "chrome/browser/net/chrome_report_sender.h" |
| #include "chrome/browser/profiles/profile.h" |
| #include "chrome/browser/safe_browsing/safe_browsing_service.h" |
| #include "components/safe_browsing/common/safe_browsing_prefs.h" |
| #include "components/safe_browsing/db/database_manager.h" |
| #include "components/safe_browsing/db/whitelist_checker_client.h" |
| #include "components/safe_browsing/proto/csd.pb.h" |
| #include "components/variations/variations_associated_data.h" |
| #include "content/public/browser/browser_thread.h" |
| #include "net/base/net_errors.h" |
| #include "net/http/http_status_code.h" |
| #include "net/traffic_annotation/network_traffic_annotation.h" |
| #include "services/network/public/cpp/shared_url_loader_factory.h" |
| #include "skia/ext/image_operations.h" |
| #include "third_party/skia/include/core/SkBitmap.h" |
| #include "ui/gfx/codec/png_codec.h" |
| #include "ui/gfx/geometry/size.h" |
| #include "url/gurl.h" |
| |
| using content::BrowserThread; |
| |
| namespace safe_browsing { |
| |
| namespace { |
| |
| const size_t kMaxReportsPerDay = 5; |
| const base::Feature kNotificationImageReporterFeature{ |
| "NotificationImageReporterFeature", base::FEATURE_ENABLED_BY_DEFAULT}; |
| const char kReportChance[] = "ReportChance"; |
| const char kDefaultMimeType[] = "image/png"; |
| |
| // Passed to ReportSender::Send as an ErrorCallback, so must take a GURL, but it |
| // is unused. |
| void LogReportResult(int net_error, int http_response_code) { |
| base::UmaHistogramSparse("SafeBrowsing.NotificationImageReporter.NetError", |
| net_error); |
| } |
| |
| constexpr net::NetworkTrafficAnnotationTag |
| kNotificationImageReporterTrafficAnnotation = |
| net::DefineNetworkTrafficAnnotation("notification_image_reporter", R"( |
| semantics { |
| sender: "Safe Browsing" |
| description: |
| "When an Image Notification is show on Android, and the user has " |
| "opted into Safe Browsing Extended Reporting, a small fraction of " |
| "images from non-whitelisted domains will be uploaded to Google to " |
| "look for malicious images." |
| trigger: |
| "An image notification is triggered, the user is opted-in to " |
| "extended reporting, and a random dice-roll picks this image to " |
| "report." |
| data: |
| "The actual image and the origin that triggered the notificaton." |
| destination: GOOGLE_OWNED_SERVICE |
| } |
| policy { |
| cookies_allowed: NO |
| setting: |
| "Users can control this feature via the 'Automatically report " |
| "details of possible security incidents to Google' setting under " |
| "'Privacy'. The feature is disabled by default." |
| chrome_policy { |
| SafeBrowsingExtendedReportingOptInAllowed { |
| policy_options {mode: MANDATORY} |
| SafeBrowsingExtendedReportingOptInAllowed: false |
| } |
| } |
| })"); |
| |
| } // namespace |
| |
| const char NotificationImageReporter::kReportingUploadUrl[] = |
| "https://safebrowsing.googleusercontent.com/safebrowsing/clientreport/" |
| "notification-image"; |
| |
| NotificationImageReporter::NotificationImageReporter( |
| scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory) |
| : url_loader_factory_(url_loader_factory), weak_factory_(this) {} |
| |
| NotificationImageReporter::~NotificationImageReporter() { |
| } |
| |
| void NotificationImageReporter::ReportNotificationImage( |
| Profile* profile, |
| const scoped_refptr<SafeBrowsingDatabaseManager>& database_manager, |
| const GURL& origin, |
| const SkBitmap& image) { |
| DCHECK_CURRENTLY_ON(BrowserThread::UI); |
| DCHECK(profile); |
| DCHECK_EQ(origin, origin.GetOrigin()); |
| DCHECK(origin.is_valid()); |
| |
| // Skip whitelisted origins to cut down on report volume. |
| if (!database_manager) { |
| SkippedReporting(); |
| return; |
| } |
| |
| // Query the CSD Whitelist asynchronously on the IO thread. |
| base::Callback<void(bool)> result_callback = |
| base::Bind(&NotificationImageReporter::OnWhitelistCheckDoneOnIO, |
| weak_factory_.GetWeakPtr(), profile, origin, image); |
| BrowserThread::PostTask( |
| BrowserThread::IO, FROM_HERE, |
| base::BindOnce(WhitelistCheckerClient::StartCheckCsdWhitelist, |
| database_manager, origin, result_callback)); |
| } |
| |
| void NotificationImageReporter::OnWhitelistCheckDoneOnIO( |
| base::WeakPtr<NotificationImageReporter> weak_ptr, |
| Profile* profile, |
| const GURL& origin, |
| const SkBitmap& image, |
| bool match_whitelist) { |
| BrowserThread::PostTask( |
| BrowserThread::UI, FROM_HERE, |
| base::BindOnce(&NotificationImageReporter::OnWhitelistCheckDone, weak_ptr, |
| profile, origin, image, match_whitelist)); |
| } |
| |
| void NotificationImageReporter::OnWhitelistCheckDone(Profile* profile, |
| const GURL& origin, |
| const SkBitmap& image, |
| bool match_whitelist) { |
| if (match_whitelist) { |
| SkippedReporting(); |
| return; |
| } |
| |
| // Sample a Finch-controlled fraction only. |
| double report_chance = GetReportChance(); |
| if (base::RandDouble() >= report_chance) { |
| SkippedReporting(); |
| return; |
| } |
| |
| // Avoid exceeding kMaxReportsPerDay. |
| base::Time a_day_ago = base::Time::Now() - base::TimeDelta::FromDays(1); |
| while (!report_times_.empty() && |
| report_times_.front() < /* older than */ a_day_ago) { |
| report_times_.pop(); |
| } |
| if (report_times_.size() >= kMaxReportsPerDay) { |
| SkippedReporting(); |
| return; |
| } |
| // n.b. we write to report_times_ here even if we'll later end up skipping |
| // reporting because GetExtendedReportingLevel was not SBER_LEVEL_SCOUT. That |
| // saves us two thread hops, with the downside that we may underreport |
| // notifications on the first day that a user opts in to SBER_LEVEL_SCOUT. |
| report_times_.push(base::Time::Now()); |
| |
| // Skip reporting unless SBER2 Scout is enabled. |
| if (GetExtendedReportingLevel(*profile->GetPrefs()) != SBER_LEVEL_SCOUT) { |
| SkippedReporting(); |
| return; |
| } |
| base::PostTaskWithTraits( |
| FROM_HERE, {base::MayBlock(), base::TaskPriority::BACKGROUND}, |
| base::BindOnce( |
| &NotificationImageReporter::DownscaleNotificationImageOnBlockingPool, |
| weak_factory_.GetWeakPtr(), origin, image)); |
| } |
| |
| double NotificationImageReporter::GetReportChance() const { |
| // Get the report_chance from the Finch experiment. If there is no active |
| // experiment, it will be set to the default of 0. |
| double report_chance = variations::GetVariationParamByFeatureAsDouble( |
| kNotificationImageReporterFeature, kReportChance, 0.0); |
| |
| if (report_chance < 0.0 || report_chance > 1.0) { |
| DLOG(WARNING) << "Illegal value " << report_chance << " for the parameter " |
| << kReportChance << ". The value should be between 0 and 1."; |
| report_chance = 0.0; |
| } |
| |
| return report_chance; |
| } |
| |
| void NotificationImageReporter::SkippedReporting() {} |
| |
| // static |
| void NotificationImageReporter::DownscaleNotificationImageOnBlockingPool( |
| const base::WeakPtr<NotificationImageReporter>& weak_ptr, |
| const GURL& origin, |
| const SkBitmap& image) { |
| // Downscale to fit within 512x512. TODO(johnme): Get this from Finch. |
| const double MAX_SIZE = 512; |
| SkBitmap downscaled_image = image; |
| if ((image.width() > MAX_SIZE || image.height() > MAX_SIZE) && |
| image.width() > 0 && image.height() > 0) { |
| double scale = |
| std::min(MAX_SIZE / image.width(), MAX_SIZE / image.height()); |
| downscaled_image = |
| skia::ImageOperations::Resize(image, skia::ImageOperations::RESIZE_GOOD, |
| std::lround(scale * image.width()), |
| std::lround(scale * image.height())); |
| } |
| |
| // Encode as PNG. |
| std::vector<unsigned char> png_bytes; |
| if (!gfx::PNGCodec::EncodeBGRASkBitmap(downscaled_image, false, &png_bytes)) { |
| NOTREACHED(); |
| return; |
| } |
| |
| BrowserThread::PostTask( |
| BrowserThread::UI, FROM_HERE, |
| base::BindOnce( |
| &NotificationImageReporter::SendReport, weak_ptr, origin, |
| base::RefCountedBytes::TakeVector(&png_bytes), |
| gfx::Size(downscaled_image.width(), downscaled_image.height()), |
| gfx::Size(image.width(), image.height()))); |
| } |
| |
| void NotificationImageReporter::SendReport( |
| const GURL& origin, |
| scoped_refptr<base::RefCountedMemory> data, |
| const gfx::Size& dimensions, |
| const gfx::Size& original_dimensions) { |
| DCHECK_CURRENTLY_ON(BrowserThread::UI); |
| |
| NotificationImageReportRequest report; |
| report.set_notification_origin(origin.spec()); |
| report.mutable_image()->set_data(data->front(), data->size()); |
| report.mutable_image()->set_mime_type(kDefaultMimeType); |
| report.mutable_image()->mutable_dimensions()->set_width(dimensions.width()); |
| report.mutable_image()->mutable_dimensions()->set_height(dimensions.height()); |
| if (dimensions != original_dimensions) { |
| report.mutable_image()->mutable_original_dimensions()->set_width( |
| original_dimensions.width()); |
| report.mutable_image()->mutable_original_dimensions()->set_height( |
| original_dimensions.height()); |
| } |
| |
| std::string serialized_report; |
| report.SerializeToString(&serialized_report); |
| |
| SendReportInternal(GURL(kReportingUploadUrl), "application/octet-stream", |
| serialized_report); |
| } |
| |
| void NotificationImageReporter::SendReportInternal( |
| const GURL& url, |
| const std::string& content_type, |
| const std::string& report) { |
| ::SendReport(url_loader_factory_, kNotificationImageReporterTrafficAnnotation, |
| url, content_type, report, |
| base::Bind(&LogReportResult, net::OK, net::HTTP_OK), |
| base::Bind(&LogReportResult)); |
| // TODO(johnme): Consider logging bandwidth and/or duration to UMA. |
| } |
| |
| } // namespace safe_browsing |
