From e0674d25b198c5240d276c9cb823bad1a67604d0 Mon Sep 17 00:00:00 2001
From: Keren Zhu <kerenzhu@chromium.org>
Date: Fri, 08 Nov 2024 19:22:50 +0000
Subject: [PATCH] Mark some dialogs as security-sensitive for extension

This CL marks the FedCM account selection dialog and the PWAs
installation dialog as security-sensitive for extensions. This
effectively prevents the extension bubble from rendering above these
dialogs, so that a malicious extension cannot trick users into
interacting with them.

Fixed: 376497151, 359949844
Change-Id: I74448a677523da74d83d1c05d5d5da8e0ee3b29c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5995850
Code-Coverage: findit-for-me@appspot.gserviceaccount.com <findit-for-me@appspot.gserviceaccount.com>
Commit-Queue: Keren Zhu <kerenzhu@chromium.org>
Reviewed-by: Allen Bauer <kylixrd@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1380525}
---

diff --git a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
index 0eb1638..04d932b 100644
--- a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
+++ b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
@@ -16,6 +16,7 @@
 #include "chrome/browser/feature_engagement/tracker_factory.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/views/chrome_layout_provider.h"
+#include "chrome/browser/ui/views/extensions/security_dialog_tracker.h"
 #include "chrome/browser/ui/views/page_action/page_action_icon_view.h"
 #include "chrome/browser/ui/views/web_apps/web_app_info_image_source.h"
 #include "chrome/browser/ui/views/web_apps/web_app_views_utils.h"
@@ -188,6 +189,11 @@
     ok_button->SetProperty(views::kElementIdentifierKey,
                            PWAConfirmationBubbleView::kInstallButton);
   }
+
+  // Mark PWA install dialogs as security-sensitive for extension.
+  // This prevents extension bubbles from obsecuring a PWA install dialog.
+  extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(
+      GetWidget());
 }
 
 bool PWAConfirmationBubbleView::OnCloseRequested(
diff --git a/chrome/browser/ui/views/webid/account_selection_bubble_view.cc b/chrome/browser/ui/views/webid/account_selection_bubble_view.cc
index a041be0..20550b2 100644
--- a/chrome/browser/ui/views/webid/account_selection_bubble_view.cc
+++ b/chrome/browser/ui/views/webid/account_selection_bubble_view.cc
@@ -18,6 +18,7 @@
 #include "chrome/browser/ui/monogram_utils.h"
 #include "chrome/browser/ui/passwords/ui_utils.h"
 #include "chrome/browser/ui/views/controls/hover_button.h"
+#include "chrome/browser/ui/views/extensions/security_dialog_tracker.h"
 #include "chrome/browser/ui/views/webid/account_selection_view_base.h"
 #include "chrome/browser/ui/views/webid/fedcm_account_selection_view_desktop.h"
 #include "chrome/browser/ui/views/webid/webid_utils.h"
@@ -230,6 +231,8 @@
     return;
   }
 
+  extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(widget);
+
   // Add the widget observer, if available. It is null in tests.
   if (widget_observer_) {
     widget->AddObserver(widget_observer_);
diff --git a/chrome/browser/ui/views/webid/account_selection_modal_view.cc b/chrome/browser/ui/views/webid/account_selection_modal_view.cc
index 90cc4f9..4e449126 100644
--- a/chrome/browser/ui/views/webid/account_selection_modal_view.cc
+++ b/chrome/browser/ui/views/webid/account_selection_modal_view.cc
@@ -18,6 +18,7 @@
 #include "chrome/browser/net/system_network_context_manager.h"
 #include "chrome/browser/ui/monogram_utils.h"
 #include "chrome/browser/ui/views/controls/hover_button.h"
+#include "chrome/browser/ui/views/extensions/security_dialog_tracker.h"
 #include "chrome/browser/ui/views/webid/account_selection_view_base.h"
 #include "chrome/browser/ui/views/webid/fedcm_account_selection_view_desktop.h"
 #include "chrome/browser/ui/views/webid/webid_utils.h"
@@ -196,6 +197,8 @@
       views::Widget::GetWidgetForNativeWindow(top_level_native_window);
   views::Widget* widget = views::DialogDelegate::CreateDialogWidget(
       this, /*context=*/nullptr, /*parent=*/top_level_widget->GetNativeView());
+  extensions::SecurityDialogTracker::GetInstance()->AddSecurityDialog(widget);
+
   widget->Show();
   UpdateDialogPosition();