Chrome · FileSystem › FSA
CVE-2026-76028
Policy Bypass in FileSystem (FSA)
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- File System Access API (FSA)
- lets a web origin, after a user picks a directory/file, read and write real files on disk via
showDirectoryPicker/showSaveFilePickerhandles. - Sensitive-path blocklist
ChromeFileSystemAccessPermissionContextkeeps a list ofBlockPathentries (ConfirmSensitiveEntryAccess) that refuse access to security-relevant locations even after the user grants a handle.- `BlockType::kBlockAllChildren`
- blocks the path and everything under it.
Root Cause Analysis
The FSA sensitive-path blocklist was incomplete and platform-inconsistent: ~/.config — which holds configuration for many cross-platform tools — was only blocked on Linux/ChromeOS/Android, so on Windows and macOS a web page holding a granted directory handle could reach and overwrite files under ~/.config (this CVE’s bug, crbug.com/569012015).
The fix moves ~/.config to the cross-platform block list (BlockPath::CreateRelative(base::DIR_HOME, ".config", kBlockAllChildren)) and, in the same change, adds shell startup files, .git/config/.git/modules, /dev on macOS, ~/.local/share, ~/.pki, and the fontconfig files. This is an access-control/policy gap, not a memory-safety defect: nothing in the patch frees or corrupts memory — it only extends the blocklist, with tests asserting the new paths abort writes while reads stay allowed. (The advisory’s “use after free” wording does not match the fix; the mapped commit — which cites bug 569012015 in its Bug: list — is purely a blocklist addition. Reclassified to PolicyBypass. The commit lists 8 bug IDs; attributing crbug.com/569012015 specifically to this CVE is inferred from the per-path comments and reporters, not bound by the diff.)
Key insight
A security-relevant directory (
~/.config) was omitted from the FSA blocklist on Windows/macOS, letting a granted web origin write files outside the intended policy; the fix adds it on all platforms.Attack Path
- ENTRY A malicious or compromised web page prompts the user to grant a File System Access directory handle at or above their home directory.
- CONTROLLED INPUT
The page navigates the handle to
~/.config/<tool>/...on Windows or macOS, where the blocklist did not apply. - MISSING CHECK
ConfirmSensitiveEntryAccesshad no~/.configentry on those platforms, so the write was allowed. - IMPACT
The page overwrites configuration of cross-platform tools under
~/.config, which can lead to code execution or security-setting tampering when the user next runs the affected tool (specific escalation depends on the targeted tool; inferred).
Impact Assessment
This is a File System Access policy bypass: a web origin with a user-granted handle can write to sensitive configuration under
~/.config on platforms where it was not blocked, outside the protection the blocklist is meant to enforce. It requires the user to grant a broad directory handle (the standard FSA precondition); no memory-safety primitive is involved. Advisory severity high; no in-the-wild exploitation stated.Files Changed
chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.ccchrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
Audit Directions
- Blocklist parity across platformsAudit every
BlockPathentry for#if BUILDFLAGguards that omit a platform; sensitive paths should generally be blocked everywhere. - Config/dotfile coverageEnumerate tool config dirs and dotfiles a write could weaponize (shells, git, package managers) and confirm each is on the FSA blocklist.
Patch
From d6f2c70dbb4cd97f6eaf62aed88c8f2e57ef3fce Mon Sep 17 00:00:00 2001 From: Mingyu Lei <[email protected]> Date: Wed, 21 Oct 2026 23:00:11 -0700 Subject: [PATCH] FSA: Add missing sensitive paths to the blocklist Several sensitive locations are still reachable through File System Access because they are missing from the sensitive-path blocklist, or are only blocked on some platforms. Add them: - Block write access to */.git/config and */.git/modules on all platforms, alongside */.git/hooks. Reads stay allowed, so web Git clients can still read repository configuration. - Block ~/.config on all platforms. It was only blocked on Linux, ChromeOS and Android. - Block shell startup files in the home directory on all platforms, including the ones Git Bash reads on Windows. - Block /dev on macOS, matching Linux. - Block ~/.local/share, the legacy fontconfig files ~/.fonts.conf and ~/.fonts.conf.d, and the NSS database directory ~/.pki on Linux and ChromeOS. Bug: 572269631, 571913154, 569012015, 558362029 Bug: 569012543, 561996724, 559780982, 557367241 Test: unit_tests --gtest_filter=ChromeFileSystemAccessPermissionContextTest.*ConfirmSensitiveEntryAccess* Change-Id: Ia6fe9e51807e8106fbc6ac69e28d550660e49b38 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8619619 Reviewed-by: Fergal Daly <[email protected]> Commit-Queue: Mingyu Lei <[email protected]> Cr-Commit-Position: refs/heads/main@{#1724465} --- diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc index 112be22..be365904 100644 --- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc +++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc @@ -441,10 +441,41 @@ // And limit access to ~/.gnupg as well. BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"), BlockType::kBlockAllChildren), + // ~/.config holds configuration for many cross-platform tools, so block + // it on all platforms, see crbug.com/569012015. + BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".config"), + BlockType::kBlockAllChildren), + // Shell startup files in the home directory, including the ones read by + // Git Bash on Windows, see crbug.com/558362029. + BlockPath::CreateRelative(base::DIR_HOME, + FILE_PATH_LITERAL(".bash_profile"), + BlockType::kBlockAllChildren), + BlockPath::CreateRelative(base::DIR_HOME, + FILE_PATH_LITERAL(".bash_login"), + BlockType::kBlockAllChildren), + BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".bashrc"), + BlockType::kBlockAllChildren), + BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".profile"), + BlockType::kBlockAllChildren), + BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".zshenv"), + BlockType::kBlockAllChildren), + BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".zprofile"), + BlockType::kBlockAllChildren), + BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".zshrc"), + BlockType::kBlockAllChildren), + BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".zlogin"), + BlockType::kBlockAllChildren), // Block write access to */.git/hooks, see crbug.com/465668234 and // crbug.com/553115714. BlockPath::CreateSuffix(FILE_PATH_LITERAL(".git/hooks"), BlockType::kBlockWrite), + // Block write access to the repository config and to submodule git + // directories, which have their own hooks and config, see + // crbug.com/572269631 and crbug.com/571913154. + BlockPath::CreateSuffix(FILE_PATH_LITERAL(".git/config"), + BlockType::kBlockWrite), + BlockPath::CreateSuffix(FILE_PATH_LITERAL(".git/modules"), + BlockType::kBlockWrite), #if BUILDFLAG(IS_WIN) // Some Windows specific directories to block, basically all apps, the // operating system itself, as well as configuration data for apps. @@ -475,6 +506,10 @@ // volumes). BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/System/Volumes"), BlockType::kBlockAllChildren), + // Block access to devices via /dev, matching Linux, see + // crbug.com/569012543. + BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/dev"), + BlockType::kBlockAllChildren), BlockPath::CreateRelative(base::DIR_APP_DATA, BlockType::kBlockAllChildren), // Block access to the current bundle directory. @@ -525,14 +560,25 @@ BlockType::kBlockAllChildren), BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/etc"), BlockType::kBlockAllChildren), - // And block all of ~/.config, matching the similar restrictions on mac - // and windows. - BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".config"), - BlockType::kBlockAllChildren), // Block ~/.dbus as well, just in case, although there probably isn't much // a website can do with access to that directory and its contents. BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".dbus"), BlockType::kBlockAllChildren), + // Block per-user application data, see crbug.com/561996724. + BlockPath::CreateRelative(base::DIR_HOME, + FILE_PATH_LITERAL(".local/share"), + BlockType::kBlockAllChildren), + // Block the legacy per-user fontconfig configuration, see + // crbug.com/559780982. The current location is under ~/.config. + BlockPath::CreateRelative(base::DIR_HOME, + FILE_PATH_LITERAL(".fonts.conf"), + BlockType::kBlockAllChildren), + BlockPath::CreateRelative(base::DIR_HOME, + FILE_PATH_LITERAL(".fonts.conf.d"), + BlockType::kBlockAllChildren), + // Block the per-user NSS database, see crbug.com/557367241. + BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".pki"), + BlockType::kBlockAllChildren), // And block all of ~/.cache, matching the similar restrictions on mac // and windows. BlockPath::CreateRelative(base::DIR_CACHE, BlockType::kBlockAllChildren), diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc index 1bd9323..d500135 100644 --- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc +++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc @@ -862,9 +862,8 @@ TEST_F(ChromeFileSystemAccessPermissionContextTest, ConfirmSensitiveEntryAccess_ExplicitPathBlock) { -// Linux is the only OS where we have some blocked directories with explicit -// paths (as opposed to PathService provided paths). -#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID) +#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID) || \ + BUILDFLAG(IS_MAC) // /dev should be blocked. EXPECT_EQ(ConfirmSensitiveEntryAccessSync( permission_context(), PathInfo(FILE_PATH_LITERAL("/dev")), @@ -1604,6 +1603,101 @@ SensitiveDirectoryResult::kAllowed); } +// Testing that writes to */.git/config and */.git/modules are blocked, while +// reads stay allowed. +TEST_F(ChromeFileSystemAccessPermissionContextTest, + ConfirmSensitiveEntryAccess_GitConfigAndModulesWriteBlock) { +#if defined(FILE_PATH_USES_DRIVE_LETTERS) + base::FilePath root(FILE_PATH_LITERAL("c:\\")); +#else + base::FilePath root(FILE_PATH_LITERAL("/")); +#endif + const base::FilePath git_dir = + root.Append(FILE_PATH_LITERAL("a")).Append(FILE_PATH_LITERAL(".git")); + const base::FilePath git_config = git_dir.Append(FILE_PATH_LITERAL("config")); + const base::FilePath git_modules = + git_dir.Append(FILE_PATH_LITERAL("modules")); + const base::FilePath submodule_dir = + git_modules.Append(FILE_PATH_LITERAL("sub")); + + // .git/config is blocked for save and programmatic write. + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), PathInfo(git_config), HandleType::kFile, + AccessTrigger::kSave), + SensitiveDirectoryResult::kAbort); + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), PathInfo(git_config), HandleType::kFile, + AccessTrigger::kProgrammaticWrite), + SensitiveDirectoryResult::kAbort); + // .git/config is not blocked for read. + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), PathInfo(git_config), HandleType::kFile, + AccessTrigger::kOpen), + SensitiveDirectoryResult::kAllowed); + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), PathInfo(git_config), HandleType::kFile, + AccessTrigger::kProgrammaticRead), + SensitiveDirectoryResult::kAllowed); + // Case variations of .git/config are blocked for programmatic write. + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), + PathInfo(root.Append(FILE_PATH_LITERAL("a")) + .Append(FILE_PATH_LITERAL(".GIT")) + .Append(FILE_PATH_LITERAL("CONFIG"))), + HandleType::kFile, AccessTrigger::kProgrammaticWrite), + SensitiveDirectoryResult::kAbort); + // Other files under .git, and files named config outside of .git, are + // allowed. + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), + PathInfo(git_dir.Append(FILE_PATH_LITERAL("config.bak"))), + HandleType::kFile, AccessTrigger::kProgrammaticWrite), + SensitiveDirectoryResult::kAllowed); + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), + PathInfo(root.Append(FILE_PATH_LITERAL("a")) + .Append(FILE_PATH_LITERAL("config"))), + HandleType::kFile, AccessTrigger::kProgrammaticWrite), + SensitiveDirectoryResult::kAllowed); + + // .git/modules and everything inside it is blocked for save and programmatic + // write. + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), PathInfo(git_modules), + HandleType::kDirectory, AccessTrigger::kSave), + SensitiveDirectoryResult::kAbort); + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), PathInfo(git_modules), + HandleType::kDirectory, AccessTrigger::kProgrammaticWrite), + SensitiveDirectoryResult::kAbort); + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), + PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("hooks")) + .Append(FILE_PATH_LITERAL("pre-commit"))), + HandleType::kFile, AccessTrigger::kProgrammaticWrite), + SensitiveDirectoryResult::kAbort); + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), + PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("config"))), + HandleType::kFile, AccessTrigger::kProgrammaticWrite), + SensitiveDirectoryResult::kAbort); + // .git/modules is not blocked for read. + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), PathInfo(git_modules), + HandleType::kDirectory, AccessTrigger::kOpen), + SensitiveDirectoryResult::kAllowed); + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), + PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("config"))), + HandleType::kFile, AccessTrigger::kProgrammaticRead), + SensitiveDirectoryResult::kAllowed); + // The .git directory itself is still allowed for save. + EXPECT_EQ(ConfirmSensitiveEntryAccessSync( + permission_context(), PathInfo(git_dir), HandleType::kDirectory, + AccessTrigger::kSave), + SensitiveDirectoryResult::kAllowed); +} + #if BUILDFLAG(IS_ANDROID) TEST_F(ChromeFileSystemAccessPermissionContextTest, ConfirmSensitiveEntryAccess_ContentUri) { @@ -1867,6 +1961,15 @@ {chrome::DIR_USER_DATA, nullptr, true, false}, {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"), true, false}, {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".config"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".bash_profile"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".bash_login"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".bashrc"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".profile"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".zshenv"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".zprofile"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".zshrc"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".zlogin"), true, false}, #if BUILDFLAG(IS_WIN) {base::DIR_PROGRAM_FILES, nullptr, true, false}, @@ -1880,6 +1983,7 @@ #endif #if BUILDFLAG(IS_MAC) + {kNoBasePathKey, FILE_PATH_LITERAL("/dev"), true, false}, {base::DIR_APP_DATA, nullptr, true, false}, {chrome::DIR_OUTER_BUNDLE, nullptr, true, false}, {base::DIR_HOME, FILE_PATH_LITERAL("Applications"), true, false}, @@ -1900,8 +2004,11 @@ {kNoBasePathKey, FILE_PATH_LITERAL("/sys"), true, false}, {kNoBasePathKey, FILE_PATH_LITERAL("/boot"), true, false}, {kNoBasePathKey, FILE_PATH_LITERAL("/etc"), true, false}, - {base::DIR_HOME, FILE_PATH_LITERAL(".config"), true, false}, {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".local/share"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".fonts.conf"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".fonts.conf.d"), true, false}, + {base::DIR_HOME, FILE_PATH_LITERAL(".pki"), true, false}, #endif #if BUILDFLAG(IS_ANDROID)
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc
index 1bd9323..d500135 100644
--- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc
+++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc
@@ -862,9 +862,8 @@
TEST_F(ChromeFileSystemAccessPermissionContextTest,
ConfirmSensitiveEntryAccess_ExplicitPathBlock) {
-// Linux is the only OS where we have some blocked directories with explicit
-// paths (as opposed to PathService provided paths).
-#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
+#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID) || \
+ BUILDFLAG(IS_MAC)
// /dev should be blocked.
EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
permission_context(), PathInfo(FILE_PATH_LITERAL("/dev")),
@@ -1604,6 +1603,101 @@
SensitiveDirectoryResult::kAllowed);
}
+// Testing that writes to */.git/config and */.git/modules are blocked, while
+// reads stay allowed.
+TEST_F(ChromeFileSystemAccessPermissionContextTest,
+ ConfirmSensitiveEntryAccess_GitConfigAndModulesWriteBlock) {
+#if defined(FILE_PATH_USES_DRIVE_LETTERS)
+ base::FilePath root(FILE_PATH_LITERAL("c:\\"));
+#else
+ base::FilePath root(FILE_PATH_LITERAL("/"));
+#endif
+ const base::FilePath git_dir =
+ root.Append(FILE_PATH_LITERAL("a")).Append(FILE_PATH_LITERAL(".git"));
+ const base::FilePath git_config = git_dir.Append(FILE_PATH_LITERAL("config"));
+ const base::FilePath git_modules =
+ git_dir.Append(FILE_PATH_LITERAL("modules"));
+ const base::FilePath submodule_dir =
+ git_modules.Append(FILE_PATH_LITERAL("sub"));
+
+ // .git/config is blocked for save and programmatic write.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kSave),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ // .git/config is not blocked for read.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kOpen),
+ SensitiveDirectoryResult::kAllowed);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kProgrammaticRead),
+ SensitiveDirectoryResult::kAllowed);
+ // Case variations of .git/config are blocked for programmatic write.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(root.Append(FILE_PATH_LITERAL("a"))
+ .Append(FILE_PATH_LITERAL(".GIT"))
+ .Append(FILE_PATH_LITERAL("CONFIG"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ // Other files under .git, and files named config outside of .git, are
+ // allowed.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(git_dir.Append(FILE_PATH_LITERAL("config.bak"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAllowed);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(root.Append(FILE_PATH_LITERAL("a"))
+ .Append(FILE_PATH_LITERAL("config"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAllowed);
+
+ // .git/modules and everything inside it is blocked for save and programmatic
+ // write.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_modules),
+ HandleType::kDirectory, AccessTrigger::kSave),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_modules),
+ HandleType::kDirectory, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("hooks"))
+ .Append(FILE_PATH_LITERAL("pre-commit"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("config"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ // .git/modules is not blocked for read.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_modules),
+ HandleType::kDirectory, AccessTrigger::kOpen),
+ SensitiveDirectoryResult::kAllowed);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("config"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticRead),
+ SensitiveDirectoryResult::kAllowed);
+ // The .git directory itself is still allowed for save.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_dir), HandleType::kDirectory,
+ AccessTrigger::kSave),
+ SensitiveDirectoryResult::kAllowed);
+}
+
#if BUILDFLAG(IS_ANDROID)
TEST_F(ChromeFileSystemAccessPermissionContextTest,
ConfirmSensitiveEntryAccess_ContentUri) {
@@ -1867,6 +1961,15 @@
{chrome::DIR_USER_DATA, nullptr, true, false},
{base::DIR_HOME, FILE_PATH_LITERAL(".ssh"), true, false},
{base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".config"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".bash_profile"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".bash_login"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".bashrc"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".profile"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zshenv"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zprofile"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zshrc"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zlogin"), true, false},
#if BUILDFLAG(IS_WIN)
{base::DIR_PROGRAM_FILES, nullptr, true, false},
@@ -1880,6 +1983,7 @@
#endif
#if BUILDFLAG(IS_MAC)
+ {kNoBasePathKey, FILE_PATH_LITERAL("/dev"), true, false},
{base::DIR_APP_DATA, nullptr, true, false},
{chrome::DIR_OUTER_BUNDLE, nullptr, true, false},
{base::DIR_HOME, FILE_PATH_LITERAL("Applications"), true, false},
@@ -1900,8 +2004,11 @@
{kNoBasePathKey, FILE_PATH_LITERAL("/sys"), true, false},
{kNoBasePathKey, FILE_PATH_LITERAL("/boot"), true, false},
{kNoBasePathKey, FILE_PATH_LITERAL("/etc"), true, false},
- {base::DIR_HOME, FILE_PATH_LITERAL(".config"), true, false},
{base::DIR_HOME, FILE_PATH_LITERAL(".dbus"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".local/share"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".fonts.conf"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".fonts.conf.d"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".pki"), true, false},
#endif
#if BUILDFLAG(IS_ANDROID)
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page