[hackerone] always show both file dialogs on windows

see https://bravesoftware.slack.com/archives/C7VLGSR55/p1674762134098869?thread_ts=1674760928.540849&cid=C7VLGSR55 for details

original hackerone issue: https://hackerone.com/reports/1848062 (credit ameenbasha)

upstream issue: https://bugs.chromium.org/p/chromium/issues/detail?id=1410578. i'm asking if they would fix it.

QA Steps:

Download the file attached to the above mentioned Slack thread.
Open the file in Brave
Once the file is loaded you will be prompted to pick download saving location. Click Save.
Download shelf will appear with the download progress.

Expected result:
Once the file finished downloading you should see a warning in the download shelf informing you that the file may be dangerous. You should see 2 buttons: Keep and Discard.

Click on the Discard button.
Verify that the file has not been saved in the location selected in step 3.
Click on Reload tab button.
Repeat steps 3 and 4.
This time click on Keep button. Verify that the file has been saved in the location selected in step 3.
Navigate to brave://settings/downloads and toggle the "Ask where to save..." to off
Repeat steps 2-4 and verify the expected result.
Navigate to brave://settings/downloads and toggle the "Ask where to save..." back to on

Test that extensions can be manually installed without a warning.

Obtain a packed extension file (.crx). For example, in a different instance of Brave or in Chrome install an extension, then navigate to chrome://extensions. Turn on developer mode and then select pack extension. In the presented dialog specify the extension path (e.g. on Windows c:\Users<yourusername>\AppData\Local\Google\Chrome\User Data\Default\Extensions\<extension_id>\<extension_version>), leave Private Key blank. The packed extension will be saved in the extension path (minus the version) that you specified.
Open Brave and navigate to brave://extensions
Turn on developer mode
Drag the .crx file from step 1 onto the page

Expected result:
There is no download shelf showing a warning about the file being dangerous.

@brave/qa-team can find examples/template that can be used via brave/brave-core#16969 (comment).

The above requires 1.48.164 or higher for 1.48.x verification 👍

@brave/qa-team per discussion via https://bravesoftware.slack.com/archives/C7VLGSR55/p1674760928540849, the plan is to test the OSes as follows:

Windows: use examples/template as per [hackerone] always show both file dialogs on windows #28079 (comment) and the test plan from [hackerone] always show both file dialogs on windows #28079 (comment)
macOS: spot check that Safe Browsing is working as expected (can use https://testsafebrowsing.appspot.com/ for this)
Linux: spot check that Safe Browsing is working as expected (can use https://testsafebrowsing.appspot.com/ for this)

Verification PASSED using

Brave | 1.48.165 Chromium: 110.0.5481.100 (Official Build) (64-bit)
-- | --
Revision | 4be7a36f7cb943af6118e449bbab494b43dcaddd-refs/branch-heads/5481_77@{#14}
OS | Windows 11 Version 21H2 (Build 22000.1574)

Test Case #1 - Brave Default (Ask where to save each file before downloading enabled)

Details

ensured that Ask where to save each file before downloading was enabled via brave://settings/downloads
ensured that the Windows Save As prompt/modal appeared when opening/loading scfExtension.html
ensured that the This type of file can harm your computer. Do you want to keep .... error appeared at the bottom of the window
- ensured that selecting Keep saved the @aexample.scf into the correct location
- ensured that selecting Discard removes the file and doesn't save it (removes entry from brave://downloads as well)
- ensured that clicking on Show all opens brave://downloads and lists the current entry with the warning

step 1	step 2	step 3	step 3a	step 3b

Test Case #2 - Brave Custom (Ask where to save each file before downloading disabled)

Details

disable Ask where to save each file before downloading via brave://settings/downloads
ensured that the This type of file can harm your computer. Do you want to keep .... error appeared at the bottom of the window
- ensured that selecting Keep saved the @aexample.scf into the correct location
- ensured that selecting Discard removes the file and doesn't save it (removes entry from brave://downloads as well)
- ensured that clicking on Show all opens brave://downloads and lists the current entry with the warning
ensured the entry within brave://downloads has the option to Discard or Keep the file
- ensured that selecting Discard removes the file and doesn't save it (removes entry from brave://downloads as well)
- ensured that selecting Keep displayed a modal confirmation about saving the file locally
  - ensured that selecting Cancel returns the user back to brave://downloads but doesn't remove the file/decision
  - ensured that selecting Keep downloads the @aexample.scf file locally without any issues
- ensured that the @aexample.scf entry appears within brave://downloads if Keep was selected

step 1	step 2	step 2a	step 2b	brave://dowloads	step 2c

step 3	step 3a	step 3b	cancel	step 3c

Test Case #3 - Installing Packed Extension

Details

Using the STR/Cases outlined via #28079 (comment), packed the 1Password extension and ensured that it installed without any warnings re: the files not being safe as per the following:

launch Chrome browser
visit chrome://extensions and install 1 Password extension
turn on developer mode and click Pack Extension
specified the path in dialog C:\Users\mseel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aeblfdkhhhdcdjpifhhbdiojplfjncoa\2.7.0_0
leave `Private Key Blank
click Pack Extension button
return to the File explorer and copy and paste the path C:\Users\mseel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aeblfdkhhhdcdjpifhhbdiojplfjncoa\2.7.0_0
confirmed 2.7.0_0.crx CRX file is created
launch Brave and navigate to brave://extensions
enable Developer mode
drag 2.7.0_0.crx into brave://extensions page in the download shelf.
click Add Extension

Confirmed no warning This type of file can harm your computer. Do you want to keep .... is shown.

(Note: This extension may have been corrupted` message is expected)

step 3	step 4	step 8	step 10	step 11	step 11a

Verified with

Brave | 1.48.165 Chromium: 110.0.5481.100 (Official Build) (x86_64)
-- | --
Revision | 4be7a36f7cb943af6118e449bbab494b43dcaddd-refs/branch-heads/5481_77@{#14}
OS | macOS Version 12.6.3 (Build 21G419)

Generally did the following:

Using 1.48.165, confirmed Safe Browsing had downloaded (can watch network calls using Fiddler or check profile folder as I did below)
Navigate to https://testsafebrowsing.appspot.com/
Spot check various links under "Webpage Warnings", "Desktop Download Warnings", and "IOS/OSX Warnings"

Example	Example	Example	Example	Example	Example

Verification passed on

Brave	1.48.166 Chromium: 110.0.5481.100 (Official Build) (64-bit)
Revision	4be7a36f7cb943af6118e449bbab494b43dcaddd-refs/branch-heads/5481_77@{#14}
OS	Ubuntu 18.04 LTS

Generally did the following:

Using 1.48.16,6 confirmed Safe Browsing had downloaded (can watch network calls using Fiddler or check profile folder as I did below)
Navigate to https://testsafebrowsing.appspot.com/
Spot check various links under "Webpage Warnings", "Desktop Download Warnings"

Navigation Menu

Repository navigation

[hackerone] always show both file dialogs on windows #28079

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[hackerone] always show both file dialogs on windows #28079

Description

Activity

diracdeltas commented on Jan 26, 2023

mkarolin commented on Feb 1, 2023

kjozwiak commented on Feb 16, 2023

kjozwiak commented on Feb 16, 2023

LaurenWags commented on Feb 16, 2023

MadhaviSeelam commented on Feb 16, 2023

LaurenWags commented on Feb 16, 2023

btlechowski commented on Feb 17, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions