CVE-2025-3074
Overview
Files Changed
chrome/browser/resources/downloads/item.csschrome/browser/resources/downloads/item.html.ts
Patch
From fdf50ecfb6bcba3e7b19ca8aad93b28e2e37ef65 Mon Sep 17 00:00:00 2001 From: Lily Chen <[email protected]> Date: Thu, 06 Feb 2025 14:51:47 -0800 Subject: [PATCH] [Downloads] Truncate/elide overly long filenames This adjusts the CSS on chrome://downloads to elide the filename if it would otherwise wrap, thereby limiting it to one line. Also adds a title attribute to the filename display, so that hovering over an elided filename will display the full filename. Screenshots: https://drive.google.com/drive/folders/1LrF74w51di8eNfs6bO9DmSGhLy45KdTl Bug: 392818696 Change-Id: I234bf55844396bf29120db034b1128d460f95e06 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6237214 Commit-Queue: Lily Chen <[email protected]> Reviewed-by: John Lee <[email protected]> Cr-Commit-Position: refs/heads/main@{#1417034} --- diff --git a/chrome/browser/resources/downloads/item.css b/chrome/browser/resources/downloads/item.css index f5c2357..b2a70b2e 100644 --- a/chrome/browser/resources/downloads/item.css +++ b/chrome/browser/resources/downloads/item.css @@ -187,16 +187,25 @@ } } +#title-area { + display: flex; + flex-direction: row; +} + #name, #file-link, #url { max-width: 100%; + overflow: hidden; + text-overflow: ellipsis; + white-space: nowrap; } #name, #file-link { font-weight: 500; word-break: break-all; + text-align: start; } @media (prefers-color-scheme: light) { @@ -209,13 +218,10 @@ } } -#name { - margin-inline-end: 12px; /* Only really affects #tag. */ -} - #tag { color: #5a5a5a; font-weight: 500; + margin-inline-start: 12px; } #url { @@ -223,10 +229,7 @@ display: block; margin-top: 6px; min-height: 0; - overflow: hidden; text-decoration: none; - text-overflow: ellipsis; - white-space: nowrap; /* Ellipsize beginning and preserve the end to always display the eTLD+1. */ direction: rtl; text-align: end; @@ -257,6 +260,14 @@ direction: ltr; } +:host-context([dir=rtl]) #name { + direction: ltr; +} + +:host-context([dir=rtl]) #file-link { + direction: ltr; +} + .is-active #url { color: var(--cr-secondary-text-color); } diff --git a/chrome/browser/resources/downloads/item.html.ts b/chrome/browser/resources/downloads/item.html.ts index 1e0f2c8..00e8ed3 100644 --- a/chrome/browser/resources/downloads/item.html.ts +++ b/chrome/browser/resources/downloads/item.html.ts @@ -32,11 +32,13 @@ href="${this.data?.url?.url || ''}" @click="${this.onFileLinkClick_}" focus-row-control focus-type="fileLink" + title="${this.data?.fileName || ''}" ?hidden="${!this.shouldLinkFilename_}"><!-- No line break -->${this.data?.fileName || ''}<!-- No line break --></a><!-- Before #name. --><span id="name" + title="${this.data?.fileName || ''}" ?hidden="${this.shouldLinkFilename_}"><!-- No line break -->${this.data?.fileName || ''}</span> <span id="tag">${this.computeTag_()}</span>
Original Bug Report
Bypass :// Characters in Download Security UI lead to Origin Spoofing
Steps to reproduce the problem
1.Prepare spoof.html 2. Access the spoof.html 3. Download the file 4. You will see that the :// blacklist is getting bypassed and allow attacker to create a fake origin
Problem Description
By default, Chrome’s Security UI blocks :// from appearing as a filename in the Download UI. One reason Chrome may block these characters is to prevent spoofing techniques in the Download UI. However, in this case, I was able to bypass this restriction using ∶⧸⧸ (Ratio U+2236 + Long Division Slash U+29F8, x2). With this bypass method, an attacker can create a fake origin in the filename, such as creating a different origin source like From https://google.com to a malicious file in the Download Origin UI.
Summary
Bypass :// Characters in Download Security UI lead to Origin Spoofing
Additional Data
Category: Security
Chrome Channel: Not sure
Regression: N/A