From b97a94025d05bc6af33f57da72d4ec4f963022cc Mon Sep 17 00:00:00 2001
From: Andrew Paseltiner <[email protected]>
Date: Wed, 13 May 2026 13:03:03 -0700
Subject: [PATCH] LNA: Block address space mismatch even when policy is kAllow

Ensure that Local Network Access (LNA) address space mismatch checks are
performed before the early return for Policy::kAllow.

On platforms with a forced kAllow policy (e.g. Chromecast, Android
WebView), an HTTPS origin could use `targetAddressSpace: 'local'` to
bypass Blink mixed content checks and fetch arbitrary public HTTP
resources. Moving the mismatch check before the policy return ensures
this integrity check is always enforced.

Fixed: 511815165
Change-Id: I39cc7992c38c31a0caa1a63d2e661b57c972019f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7837943
Reviewed-by: Mike West <[email protected]>
Reviewed-by: Chris Thompson <[email protected]>
Commit-Queue: Andrew Paseltiner <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1630148}
---

diff --git a/services/network/local_network_access_checker.cc b/services/network/local_network_access_checker.cc
index 5b13c594..b9be33a9 100644
--- a/services/network/local_network_access_checker.cc
+++ b/services/network/local_network_access_checker.cc
@@ -124,6 +124,22 @@
 
   Policy policy = client_security_state_->local_network_access_request_policy;
 
+  // `required_address_space_` is the IP address space the website claimed the
+  // subresource to be. If it doesn't meet the real situation, then we should
+  // fail the request.
+  //
+  // Note: This check must occur before the check for Policy::kAllow below, as
+  // otherwise sites could use targetAddressSpace to bypass mixed content
+  // blocking in embedders with a kAllow policy.
+  //
+  // TODO(crbug.com/395895368): consider collapsing the address spaces for LNA
+  // checks.
+  if (base::FeatureList::IsEnabled(features::kLocalNetworkAccessChecks) &&
+      required_address_space_ != mojom::IPAddressSpace::kUnknown &&
+      resource_address_space != required_address_space_) {
+    return Result::kBlockedByRequiredIpAddressSpaceMismatch;
+  }
+
   if (policy == Policy::kAllow) {
     return Result::kAllowedByPolicyAllow;
   }
@@ -142,18 +158,6 @@
     return Result::kBlockedByInconsistentIpAddressSpace;
   }
 
-  // `required_address_space_` is the IP address space the website claimed the
-  // subresource to be. If it doesn't meet the real situation, then we should
-  // fail the request.
-  //
-  // TODO(crbug.com/395895368): consider collapsing the address spaces for LNA
-  // checks.
-  if (base::FeatureList::IsEnabled(features::kLocalNetworkAccessChecks) &&
-      required_address_space_ != mojom::IPAddressSpace::kUnknown &&
-      resource_address_space != required_address_space_) {
-    return Result::kBlockedByRequiredIpAddressSpaceMismatch;
-  }
-
   // Currently for LNA we are only blocking public -> local/private/loopback
   // requests. Requests from local -> loopback (or private -> local in PNA
   // terminology) are not blocked at present.
diff --git a/services/network/local_network_access_checker_unittest.cc b/services/network/local_network_access_checker_unittest.cc
index 8239046..998fefa 100644
--- a/services/network/local_network_access_checker_unittest.cc
+++ b/services/network/local_network_access_checker_unittest.cc
@@ -525,6 +525,31 @@
                                       Result::kLNAPermissionRequired, 1);
 }
 
+// Regression test for crbug.com/511815165. Ensures that address space
+// mismatches are blocked even when the policy is `kAllow`. This prevents HTTPS
+// origins on certain platforms from using `targetAddressSpace` to bypass mixed
+// content checks and fetch public HTTP resources.
+TEST(LocalNetworkAccessCheckerTest,
+     CheckBlockedByRequiredIpAddressSpaceMismatchWithPolicyAllow) {
+  base::HistogramTester histogram_tester;
+  mojom::ClientSecurityState client_security_state;
+  client_security_state.ip_address_space = mojom::IPAddressSpace::kPublic;
+  client_security_state.local_network_access_request_policy =
+      mojom::LocalNetworkAccessRequestPolicy::kAllow;
+
+  ResourceRequest request;
+  request.required_ip_address_space = mojom::IPAddressSpace::kLocal;
+  LocalNetworkAccessChecker checker(request, &client_security_state,
+                                    mojom::kURLLoadOptionNone);
+
+  // Mismatch should be blocked even if policy is kAllow.
+  EXPECT_EQ(checker.Check(DirectTransport(PublicEndpoint())),
+            Result::kBlockedByRequiredIpAddressSpaceMismatch);
+  histogram_tester.ExpectUniqueSample(
+      kCheckResultHistogramName,
+      Result::kBlockedByRequiredIpAddressSpaceMismatch, 1);
+}
+
 TEST(LocalNetworkAccessCheckerTest, ResponseAddressSpace) {
   LocalNetworkAccessChecker checker(ResourceRequest(), kNullClientSecurityState,
                                     mojom::kURLLoadOptionNone);

diff --git a/services/network/local_network_access_checker_unittest.cc b/services/network/local_network_access_checker_unittest.cc
index 8239046..998fefa 100644
--- a/services/network/local_network_access_checker_unittest.cc
+++ b/services/network/local_network_access_checker_unittest.cc
@@ -525,6 +525,31 @@
                                       Result::kLNAPermissionRequired, 1);
 }
 
+// Regression test for crbug.com/511815165. Ensures that address space
+// mismatches are blocked even when the policy is `kAllow`. This prevents HTTPS
+// origins on certain platforms from using `targetAddressSpace` to bypass mixed
+// content checks and fetch public HTTP resources.
+TEST(LocalNetworkAccessCheckerTest,
+     CheckBlockedByRequiredIpAddressSpaceMismatchWithPolicyAllow) {
+  base::HistogramTester histogram_tester;
+  mojom::ClientSecurityState client_security_state;
+  client_security_state.ip_address_space = mojom::IPAddressSpace::kPublic;
+  client_security_state.local_network_access_request_policy =
+      mojom::LocalNetworkAccessRequestPolicy::kAllow;
+
+  ResourceRequest request;
+  request.required_ip_address_space = mojom::IPAddressSpace::kLocal;
+  LocalNetworkAccessChecker checker(request, &client_security_state,
+                                    mojom::kURLLoadOptionNone);
+
+  // Mismatch should be blocked even if policy is kAllow.
+  EXPECT_EQ(checker.Check(DirectTransport(PublicEndpoint())),
+            Result::kBlockedByRequiredIpAddressSpaceMismatch);
+  histogram_tester.ExpectUniqueSample(
+      kCheckResultHistogramName,
+      Result::kBlockedByRequiredIpAddressSpaceMismatch, 1);
+}
+
 TEST(LocalNetworkAccessCheckerTest, ResponseAddressSpace) {
   LocalNetworkAccessChecker checker(ResourceRequest(), kNullClientSecurityState,
                                     mojom::kURLLoadOptionNone);