[M120 Migration][VD] Modify samesite default value

M94 modified the default value of samesite to Lax,
some applications not follow the latest samesite spec.
Revert the upstream patches for modify samesite default
value firstly, then request applications to modify it.

Revert upstream patches:
https://chromium-review.googlesource.com/c/chromium/src/+/3059260
https://chromium-review.googlesource.com/c/chromium/src/+/3046782

References:
  - https://review.tizen.org/gerrit/293942/

Change-Id: Ief0323f22b9034cafd5ae7ad23ab12d8487e4a12
Signed-off-by: jiangyuwei <yuwei.jiang@samsung.com>

diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
index 8021bd8..acfd6a3 100644 (file)
--- a/components/content_settings/core/browser/content_settings_registry.cc
+++ b/components/content_settings/core/browser/content_settings_registry.cc
@@ -15,6 +15,9 @@
 #include "components/content_settings/core/browser/website_settings_registry.h"
 #include "components/content_settings/core/common/content_settings.h"
 #include "components/content_settings/core/common/features.h"
+#if BUILDFLAG(IS_TIZEN_TV)
+#include "net/cookies/cookie_util.h"
+#endif
 
 namespace content_settings {
 
@@ -88,7 +91,12 @@ void ContentSettingsRegistry::Init() {
       WebsiteSettingsRegistry::ALL_PLATFORMS,
       ContentSettingsInfo::INHERIT_IN_INCOGNITO,
       ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
-
+#if BUILDFLAG(IS_TIZEN_TV)
+  ContentSetting legacy_cookie_access_initial_default =
+      net::cookie_util::IsSameSiteByDefaultCookiesEnabled()
+          ? CONTENT_SETTING_BLOCK
+          : CONTENT_SETTING_ALLOW;
+#endif
   Register(ContentSettingsType::IMAGES, "images", CONTENT_SETTING_ALLOW,
            WebsiteSettingsInfo::SYNCABLE,
            /*allowlisted_schemes=*/
@@ -274,8 +282,12 @@ void ContentSettingsRegistry::Init() {
            ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
 
   Register(ContentSettingsType::LEGACY_COOKIE_ACCESS, "legacy-cookie-access",
-           CONTENT_SETTING_BLOCK, WebsiteSettingsInfo::UNSYNCABLE,
-           /*allowlisted_schemes=*/{},
+#if BUILDFLAG(IS_TIZEN_TV)
+           legacy_cookie_access_initial_default,
+#else
+           CONTENT_SETTING_BLOCK,
+#endif
+           WebsiteSettingsInfo::UNSYNCABLE, /*allowlisted_schemes=*/{},
            /*valid_settings=*/{CONTENT_SETTING_ALLOW, CONTENT_SETTING_BLOCK},
            WebsiteSettingsInfo::REQUESTING_ORIGIN_ONLY_SCOPE,
            WebsiteSettingsRegistry::ALL_PLATFORMS,

diff --git a/content/public/common/content_switch_dependent_feature_overrides.cc b/content/public/common/content_switch_dependent_feature_overrides.cc
index 7a36706..2b0a97d 100644 (file)
--- a/content/public/common/content_switch_dependent_feature_overrides.cc
+++ b/content/public/common/content_switch_dependent_feature_overrides.cc
@@ -33,6 +33,14 @@ GetSwitchDependentFeatureOverrides(const base::CommandLine& command_line) {
     {switches::kEnableExperimentalWebPlatformFeatures,
      std::cref(net::features::kCookieSameSiteConsidersRedirectChain),
      base::FeatureList::OVERRIDE_ENABLE_FEATURE},
+#if BUILDFLAG(IS_TIZEN_TV)
+    {switches::kEnableExperimentalCookieFeatures,
+     std::cref(net::features::kCookiesWithoutSameSiteMustBeSecure),
+     base::FeatureList::OVERRIDE_ENABLE_FEATURE},
+    {switches::kEnableExperimentalCookieFeatures,
+     std::cref(net::features::kSameSiteByDefaultCookies),
+     base::FeatureList::OVERRIDE_ENABLE_FEATURE},
+#endif
     {switches::kEnableExperimentalWebPlatformFeatures,
      std::cref(features::kDocumentPolicyNegotiation),
      base::FeatureList::OVERRIDE_ENABLE_FEATURE},

diff --git a/net/base/features.cc b/net/base/features.cc
index 3053df9..0dd5586 100644 (file)
--- a/net/base/features.cc
+++ b/net/base/features.cc
@@ -162,6 +162,27 @@ BASE_FEATURE(kNetUnusedIdleSocketTimeout,
              "NetUnusedIdleSocketTimeout",
              base::FEATURE_DISABLED_BY_DEFAULT);
 
+#if BUILDFLAG(IS_TIZEN_TV)
+// When enabled, makes cookies without a SameSite attribute behave like
+// SameSite=Lax cookies by default, and requires SameSite=None to be specified
+// in order to make cookies available in a third-party context. When disabled,
+// the default behavior for cookies without a SameSite attribute specified is no
+// restriction, i.e., available in a third-party context.
+// The "Lax-allow-unsafe" mitigation allows these cookies to be sent on
+// top-level cross-site requests with an unsafe (e.g. POST) HTTP method, if the
+// cookie is no more than 2 minutes old.
+BASE_FEATURE(kSameSiteByDefaultCookies,
+             "SameSiteByDefaultCookies",
+             base::FEATURE_DISABLED_BY_DEFAULT);
+// When enabled, cookies without SameSite restrictions that don't specify the
+// Secure attribute will be rejected if set from an insecure context, or treated
+// as secure if set from a secure context. This ONLY has an effect if
+// SameSiteByDefaultCookies is also enabled.
+BASE_FEATURE(kCookiesWithoutSameSiteMustBeSecure,
+             "CookiesWithoutSameSiteMustBeSecure",
+             base::FEATURE_DISABLED_BY_DEFAULT);
+#endif
+
 BASE_FEATURE(kShortLaxAllowUnsafeThreshold,
              "ShortLaxAllowUnsafeThreshold",
              base::FEATURE_DISABLED_BY_DEFAULT);

diff --git a/net/base/features.h b/net/base/features.h
index af1b135..52dc211 100644 (file)
--- a/net/base/features.h
+++ b/net/base/features.h
@@ -201,6 +201,23 @@ NET_EXPORT BASE_DECLARE_FEATURE(kPostQuantumKyber);
 // Changes the timeout after which unused sockets idle sockets are cleaned up.
 NET_EXPORT BASE_DECLARE_FEATURE(kNetUnusedIdleSocketTimeout);
 
+#if BUILDFLAG(IS_TIZEN_TV)
+// When enabled, makes cookies without a SameSite attribute behave like
+// SameSite=Lax cookies by default, and requires SameSite=None to be specified
+// in order to make cookies available in a third-party context. When disabled,
+// the default behavior for cookies without a SameSite attribute specified is no
+// restriction, i.e., available in a third-party context.
+// The "Lax-allow-unsafe" mitigation allows these cookies to be sent on
+// top-level cross-site requests with an unsafe (e.g. POST) HTTP method, if the
+// cookie is no more than 2 minutes old.
+NET_EXPORT BASE_DECLARE_FEATURE(kSameSiteByDefaultCookies);
+// When enabled, cookies without SameSite restrictions that don't specify the
+// Secure attribute will be rejected if set from an insecure context, or treated
+// as secure if set from a secure context. This ONLY has an effect if
+// SameSiteByDefaultCookies is also enabled.
+NET_EXPORT BASE_DECLARE_FEATURE(kCookiesWithoutSameSiteMustBeSecure);
+#endif
+
 // When enabled, the time threshold for Lax-allow-unsafe cookies will be lowered
 // from 2 minutes to 10 seconds. This time threshold refers to the age cutoff
 // for which cookies that default into SameSite=Lax, which are newer than the

diff --git a/net/cookies/canonical_cookie.cc b/net/cookies/canonical_cookie.cc
index cc3f6d9..919568d 100644 (file)
--- a/net/cookies/canonical_cookie.cc
+++ b/net/cookies/canonical_cookie.cc
@@ -1329,6 +1329,9 @@ CookieAccessResult CanonicalCookie::IsSetPermittedInContext(
   // Unless legacy access semantics are in effect, SameSite=None cookies without
   // the Secure attribute will be rejected.
   if (params.access_semantics != CookieAccessSemantics::LEGACY &&
+#if BUILDFLAG(IS_TIZEN_TV)
+      cookie_util::IsCookiesWithoutSameSiteMustBeSecureEnabled() &&
+#endif
       SameSite() == CookieSameSite::NO_RESTRICTION && !IsSecure()) {
     DVLOG(net::cookie_util::kVlogSetCookies)
         << "SetCookie() rejecting insecure cookie with SameSite=None.";
@@ -1663,17 +1666,34 @@ CookieEffectiveSameSite CanonicalCookie::GetEffectiveSameSite(
                  features::kShortLaxAllowUnsafeThreshold)
                  ? kShortLaxAllowUnsafeMaxAge
                  : kLaxAllowUnsafeMaxAge);
+#if BUILDFLAG(IS_TIZEN_TV)
+  bool should_apply_same_site_lax_by_default =
+      cookie_util::IsSameSiteByDefaultCookiesEnabled();
+  if (access_semantics == CookieAccessSemantics::LEGACY) {
+    should_apply_same_site_lax_by_default = false;
+  } else if (access_semantics == CookieAccessSemantics::NONLEGACY) {
+    should_apply_same_site_lax_by_default = true;
+  }
+#endif
 
   switch (SameSite()) {
     // If a cookie does not have a SameSite attribute, the effective SameSite
     // mode depends on the access semantics and whether the cookie is
     // recently-created.
     case CookieSameSite::UNSPECIFIED:
+#if BUILDFLAG(IS_TIZEN_TV)
+      return should_apply_same_site_lax_by_default
+                 ? (IsRecentlyCreated(lax_allow_unsafe_threshold_age)
+                        ? CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE
+                        : CookieEffectiveSameSite::LAX_MODE)
+                 : CookieEffectiveSameSite::NO_RESTRICTION;
+#else
       return (access_semantics == CookieAccessSemantics::LEGACY)
                  ? CookieEffectiveSameSite::NO_RESTRICTION
                  : (IsRecentlyCreated(lax_allow_unsafe_threshold_age)
                         ? CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE
                         : CookieEffectiveSameSite::LAX_MODE);
+#endif
     case CookieSameSite::NO_RESTRICTION:
       return CookieEffectiveSameSite::NO_RESTRICTION;
     case CookieSameSite::LAX_MODE:

diff --git a/net/cookies/cookie_util.cc b/net/cookies/cookie_util.cc
index b479ab1..b330ba1 100644 (file)
--- a/net/cookies/cookie_util.cc
+++ b/net/cookies/cookie_util.cc
@@ -882,6 +882,18 @@ CookieOptions::SameSiteCookieContext ComputeSameSiteContextForSubresource(
   return CookieOptions::SameSiteCookieContext::MakeInclusive();
 }
 
+#if BUILDFLAG(IS_TIZEN_TV)
+bool IsSameSiteByDefaultCookiesEnabled() {
+  return base::FeatureList::IsEnabled(features::kSameSiteByDefaultCookies);
+}
+
+bool IsCookiesWithoutSameSiteMustBeSecureEnabled() {
+  return IsSameSiteByDefaultCookiesEnabled() &&
+         base::FeatureList::IsEnabled(
+             features::kCookiesWithoutSameSiteMustBeSecure);
+}
+#endif
+
 bool IsPortBoundCookiesEnabled() {
   return base::FeatureList::IsEnabled(features::kEnablePortBoundCookies);
 }

diff --git a/net/cookies/cookie_util.h b/net/cookies/cookie_util.h
index e2e9ea3..f62032a 100644 (file)
--- a/net/cookies/cookie_util.h
+++ b/net/cookies/cookie_util.h
@@ -286,6 +286,11 @@ NET_EXPORT bool IsSchemeBoundCookiesEnabled();
 // Returns whether the respective feature is enabled.
 NET_EXPORT bool IsSchemefulSameSiteEnabled();
 
+#if BUILDFLAG(IS_TIZEN_TV)
+NET_EXPORT bool IsSameSiteByDefaultCookiesEnabled();
+NET_EXPORT bool IsCookiesWithoutSameSiteMustBeSecureEnabled();
+#endif
+
 // Computes the First-Party Sets metadata and cache match information.
 // `isolation_info` must be fully populated.
 //

diff --git a/services/network/cookie_settings.cc b/services/network/cookie_settings.cc
index c59729f..466eb0d 100644 (file)
--- a/services/network/cookie_settings.cc
+++ b/services/network/cookie_settings.cc
@@ -329,6 +329,15 @@ ContentSetting CookieSettings::GetContentSetting(
     const GURL& secondary_url,
     ContentSettingsType content_type,
     content_settings::SettingInfo* info) const {
+  ContentSetting setting = CONTENT_SETTING_BLOCK;
+#if BUILDFLAG(IS_TIZEN_TV)
+  setting = net::cookie_util::IsSameSiteByDefaultCookiesEnabled()
+                ? CONTENT_SETTING_BLOCK
+                : CONTENT_SETTING_ALLOW;
+#else
+  setting = CONTENT_SETTING_BLOCK;
+#endif
+
   const ContentSettingPatternSource* result = FindMatchingSetting(
       primary_url, secondary_url, GetContentSettings(content_type));
 
@@ -337,7 +346,7 @@ ContentSetting CookieSettings::GetContentSetting(
       info->primary_pattern = ContentSettingsPattern::Wildcard();
       info->secondary_pattern = ContentSettingsPattern::Wildcard();
     }
-    return CONTENT_SETTING_BLOCK;
+    return setting;
   }
 
   if (info) {