From 92b0be09926e592234af2a0062e18c2c4f19b8c9 Mon Sep 17 00:00:00 2001
From: Simeon Anfinrud <[email protected]>
Date: Mon, 22 Jun 2026 13:01:44 -0700
Subject: [PATCH] devtools: Enforce allowlist in CastDevToolsManagerDelegate attach

This CL fixes an authorization bypass where CastDevToolsManagerDelegate
only filtered the discovery endpoint (/json/list) but did not override
AllowInspectingRenderFrameHost. This allowed an attacker to attach to
any non-allowlisted WebContents if they knew or leaked its UUID.
By overriding AllowInspectingRenderFrameHost to check the
enabled_webcontents_ set, the allowlist is correctly enforced during
WebSocket session creation.

Bug: 497277880
Test: CQ
Change-Id: I19d7880597d89b42d3533fcc4777dc7a39407e30
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7856448
Auto-Submit: Simeon Anfinrud <[email protected]>
Reviewed-by: Sandeep Vijayasekar <[email protected]>
Commit-Queue: Simeon Anfinrud <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1650518}
---

diff --git a/chromecast/browser/devtools/cast_devtools_manager_delegate.cc b/chromecast/browser/devtools/cast_devtools_manager_delegate.cc
index ce155e2..750a643 100644
--- a/chromecast/browser/devtools/cast_devtools_manager_delegate.cc
+++ b/chromecast/browser/devtools/cast_devtools_manager_delegate.cc
@@ -7,6 +7,7 @@
 #include "build/build_config.h"
 #include "chromecast/app/grit/shell_resources.h"
 #include "content/public/browser/devtools_agent_host.h"
+#include "content/public/browser/web_contents.h"
 #include "ui/base/resource/resource_bundle.h"
 
 namespace chromecast {
@@ -69,5 +70,11 @@
 #endif
 }
 
+bool CastDevToolsManagerDelegate::AllowInspectingRenderFrameHost(
+    content::RenderFrameHost* rfh) {
+  content::WebContents* wc = content::WebContents::FromRenderFrameHost(rfh);
+  return wc && enabled_webcontents_.count(wc) != 0;
+}
+
 }  // namespace shell
 }  // namespace chromecast
diff --git a/chromecast/browser/devtools/cast_devtools_manager_delegate.h b/chromecast/browser/devtools/cast_devtools_manager_delegate.h
index 42ba9485..f6f218c 100644
--- a/chromecast/browser/devtools/cast_devtools_manager_delegate.h
+++ b/chromecast/browser/devtools/cast_devtools_manager_delegate.h
@@ -11,6 +11,7 @@
 #include "content/public/browser/devtools_manager_delegate.h"
 
 namespace content {
+class RenderFrameHost;
 class WebContents;
 }
 
@@ -39,6 +40,7 @@
   content::DevToolsAgentHost::List RemoteDebuggingTargets(
       TargetType target_type) override;
   std::string GetDiscoveryPageHTML() override;
+  bool AllowInspectingRenderFrameHost(content::RenderFrameHost* rfh) override;
 
  private:
   std::unordered_set<content::WebContents*> enabled_webcontents_;