Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable brandcode config fetcher #2266

Closed
pilgrim-brave opened this issue Nov 28, 2018 · 1 comment · Fixed by brave/brave-core#978
Closed

Disable brandcode config fetcher #2266

pilgrim-brave opened this issue Nov 28, 2018 · 1 comment · Fixed by brave/brave-core#978
Assignees
Labels
privacy/connect This requires making a network connection to a third-party service. QA/No release-notes/exclude

Comments

@pilgrim-brave
Copy link

pilgrim-brave commented Nov 28, 2018

When a user resets their profile ("Restore settings to their original defaults" option in settings), Chromium may decide to fetch a set of default settings from a Google-controlled server. This is gated on the "brand code", which is only set during non-organic installs of Google Chrome on desktop Mac and Windows, i.e. installs from a third party that Google has authorized to redistribute Chrome on their behalf (e.g. ISPs, PC manufacturers). Such parties may specify their own default settings, which would take effect when the user "resets" their profile.

I am 95% sure that this code is never executed, but the branding code is extremely complicated and involves looking at flags outside the original installation path (e.g. the Windows registry), so there is a chance that this code could trigger on a system that had a non-organic Chrome install but the user has now chosen to install Brave.

As a defense-in-depth, I recommend disabling the brand code config fetcher altogether.

Note: the BrandcodeConfigFetcher class handles retrieving and modifying the settings, but it also takes a callback which is called once the "proper" default settings are in place. I recommend unconditionally calling this callback, then skipping the network fetch.

@pilgrim-brave pilgrim-brave self-assigned this Nov 28, 2018
@pilgrim-brave pilgrim-brave added the privacy/connect This requires making a network connection to a third-party service. label Nov 28, 2018
pilgrim-brave added a commit to brave/brave-core that referenced this issue Nov 28, 2018
@pilgrim-brave pilgrim-brave added this to the 0.59.x - Nightly milestone Nov 29, 2018
@bbondy
Copy link
Member

bbondy commented Nov 29, 2018

merged label only needed for the PR. Thanks for marking things otherwise though, it's a big help!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
privacy/connect This requires making a network connection to a third-party service. QA/No release-notes/exclude
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants