From a5ee1692c4fca22cd37a7adb0b9c22dd9464ca3b Mon Sep 17 00:00:00 2001
From: Andrew Paseltiner <[email protected]>
Date: Thu, 30 Apr 2026 15:39:06 -0700
Subject: [PATCH] [Web NFC] Fix visibility gate bypass in NfcImpl

This CL fixes a logic error in NfcImpl.java where push and makeReadOnly
operations were allowed to proceed even when NFC operations were
suspended (e.g., when the tab was hidden).

The fix adds missing return statements in push() and makeReadOnly() when
mOperationsSuspended is true, and adds defensive checks in the
processing methods to ensure operations are not executed against a
physical tag if the tab has become hidden.

Updated NFCTest.java to verify that no tag operations occur when
suspended.

Fixed: 500517053
Change-Id: Ia97f2b0e890ac6fc63bebbc024b6c5703177b147
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7807188
Reviewed-by: Reilly Grant <[email protected]>
Commit-Queue: Andrew Paseltiner <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1623538}
---

diff --git a/services/device/nfc/android/java/src/org/chromium/device/nfc/NfcImpl.java b/services/device/nfc/android/java/src/org/chromium/device/nfc/NfcImpl.java
index 143d4f54..bcb1857a 100644
--- a/services/device/nfc/android/java/src/org/chromium/device/nfc/NfcImpl.java
+++ b/services/device/nfc/android/java/src/org/chromium/device/nfc/NfcImpl.java
@@ -210,6 +210,7 @@
                     createError(
                             NdefErrorType.OPERATION_CANCELLED,
                             "Cannot push the message because NFC operations are suspended."));
+            return;
         }
 
         if (!NdefMessageValidator.isValid(message)) {
@@ -259,6 +260,7 @@
                     createError(
                             NdefErrorType.OPERATION_CANCELLED,
                             "Cannot make read-only because NFC operations are suspended."));
+            return;
         }
 
         // If previous pending make read-only operation is not completed, cancel it.
@@ -525,7 +527,7 @@
      * exception calls pendingPushOperationCompleted() with appropriate error object.
      */
     private void processPendingPushOperation() {
-        if (mTagHandler == null || mPendingPushOperation == null) return;
+        if (mTagHandler == null || mPendingPushOperation == null || mOperationsSuspended) return;
 
         if (mTagHandler.isTagOutOfRange()) {
             mTagHandler = null;
@@ -591,7 +593,9 @@
      * of exception calls pendingMakeReadOnlyOperationCompleted() with appropriate error object.
      */
     private void processPendingMakeReadOnlyOperation() {
-        if (mTagHandler == null || mPendingMakeReadOnlyOperation == null) return;
+        if (mTagHandler == null || mPendingMakeReadOnlyOperation == null || mOperationsSuspended) {
+            return;
+        }
 
         if (mTagHandler.isTagOutOfRange()) {
             mTagHandler = null;
diff --git a/services/device/nfc/android/junit/src/org/chromium/device/nfc/NFCTest.java b/services/device/nfc/android/junit/src/org/chromium/device/nfc/NFCTest.java
index afdb012d..4b46ebd 100644
--- a/services/device/nfc/android/junit/src/org/chromium/device/nfc/NFCTest.java
+++ b/services/device/nfc/android/junit/src/org/chromium/device/nfc/NFCTest.java
@@ -17,6 +17,7 @@
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 
@@ -1197,7 +1198,7 @@
     /** Test that Nfc.push() fails if NFC operations are already suspended. */
     @Test
     @Feature({"NFCTest"})
-    public void testPushWhenOperationsAreSuspended() {
+    public void testPushWhenOperationsAreSuspended() throws IOException, FormatException {
         TestNfcImpl nfc = new TestNfcImpl(mContext, mDelegate);
         nfc.suspendNfcOperations();
         mDelegate.invokeCallback();
@@ -1208,6 +1209,10 @@
         verify(mockCallback).call(mErrorCaptor.capture());
         assertNotNull(mErrorCaptor.getValue());
         assertEquals(NdefErrorType.OPERATION_CANCELLED, mErrorCaptor.getValue().errorType);
+
+        // Check that push is not triggered when NFC tag is in proximity.
+        nfc.processPendingOperationsForTesting(mNfcTagHandler);
+        verify(mNfcTagHandler, never()).write(any(android.nfc.NdefMessage.class));
     }
 
     /** Test that Nfc.suspendNfcOperations() cancels pending push operation. */
@@ -1257,7 +1262,7 @@
     /** Test that Nfc.makeReadOnly() fails if NFC operations are already suspended. */
     @Test
     @Feature({"NFCTest"})
-    public void testMakeReadOnlyWhenOperationsAreSuspended() {
+    public void testMakeReadOnlyWhenOperationsAreSuspended() throws IOException {
         TestNfcImpl nfc = new TestNfcImpl(mContext, mDelegate);
         nfc.suspendNfcOperations();
         mDelegate.invokeCallback();
@@ -1268,6 +1273,10 @@
         verify(mockCallback).call(mErrorCaptor.capture());
         assertNotNull(mErrorCaptor.getValue());
         assertEquals(NdefErrorType.OPERATION_CANCELLED, mErrorCaptor.getValue().errorType);
+
+        // Check that makeReadOnly is not triggered when NFC tag is in proximity.
+        nfc.processPendingOperationsForTesting(mNfcTagHandler);
+        verify(mNfcTagHandler, never()).makeReadOnly();
     }
 
     /** Test that Nfc.suspendNfcOperations() cancels pending makeReadOnly operation. */