Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in WebApp Installs
DescriptionInappropriate implementation in WebApp Installs
ComponentWebApp Installs
Bug ClassLogic Error
Tracker351564774
Fix commit83df5710daca (chromium/src) +15/-70
CISA KEVNot listed
CreditedBharat (mrnoob)
Disclosed2025-03-04

Changed Functions

FunctionChangeNotes
TouchRestrictingFrameLayout
components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/TouchRestrictingFrameLayout.java
modified

Files Changed

  • chrome/android/expectations/lint-baseline.xml
  • components/browser_ui/bottomsheet/android/internal/BUILD.gn
  • components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/BottomSheet.java
  • components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/TouchRestrictingFrameLayout.java
  • components/browser_ui/bottomsheet/android/java/res/layout/bottom_sheet.xml
From 83df5710daca3a1fbdde22c0b9e5fde6cf8db81c Mon Sep 17 00:00:00 2001
From: Lijin Shen <lazzzis@google.com>
Date: Thu, 19 Dec 2024 13:16:42 -0800
Subject: [PATCH] [clank-q4-fixit] Disable touch when bottom sheet is animating

Bug: 351564774
Change-Id: I7f7b94f3b82945361bff8703d3e6fc5aa2cf9234
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6102411
Reviewed-by: Matthew Jones <mdjones@chromium.org>
Commit-Queue: Lijin Shen <lazzzis@google.com>
Code-Coverage: findit-for-me@appspot.gserviceaccount.com <findit-for-me@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#1398821}
---

diff --git a/chrome/android/expectations/lint-baseline.xml b/chrome/android/expectations/lint-baseline.xml
index a71f1c6..4c67eb1 100644
--- a/chrome/android/expectations/lint-baseline.xml
+++ b/chrome/android/expectations/lint-baseline.xml
@@ -2499,17 +2499,6 @@
     </issue>
 
     <issue
-        id="ClickableViewAccessibility"
-        message="Custom view `TouchRestrictingFrameLayout` overrides `onTouchEvent` but not `performClick`"
-        errorLine1="    public boolean onTouchEvent(MotionEvent event) {"
-        errorLine2="                   ~~~~~~~~~~~~">
-        <location
-            file="../../components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/TouchRestrictingFrameLayout.java"
-            line="42"
-            column="20"/>
-    </issue>
-
-    <issue
         id="AccessibilityWindowStateChangedEvent"
         message="Manually populating or sending TYPE_WINDOW_STATE_CHANGED events should be avoided. They may be ignored on certain versions of Android. Prefer setting UI metadata using `View.onInitializeAccessibilityNodeInfo`, `Activity.setTitle`, `ViewCompat.setAccessibilityPaneTitle`, etc. to inform users of crucial changes to the UI."
         errorLine1="            mListView.sendAccessibilityEvent(AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED);"
diff --git a/components/browser_ui/bottomsheet/android/internal/BUILD.gn b/components/browser_ui/bottomsheet/android/internal/BUILD.gn
index 0b68022..35122f5 100644
--- a/components/browser_ui/bottomsheet/android/internal/BUILD.gn
+++ b/components/browser_ui/bottomsheet/android/internal/BUILD.gn
@@ -16,7 +16,6 @@
     "java/src/org/chromium/components/browser_ui/bottomsheet/BottomSheetControllerFactory.java",
     "java/src/org/chromium/components/browser_ui/bottomsheet/BottomSheetControllerImpl.java",
     "java/src/org/chromium/components/browser_ui/bottomsheet/BottomSheetSwipeDetector.java",
-    "java/src/org/chromium/components/browser_ui/bottomsheet/TouchRestrictingFrameLayout.java",
   ]
 
   deps = [
diff --git a/components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/BottomSheet.java b/components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/BottomSheet.java
index 1c02a9a..00f5ee7 100644
--- a/components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/BottomSheet.java
+++ b/components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/BottomSheet.java
@@ -130,7 +130,7 @@
     @Nullable protected BottomSheetContent mSheetContent;
 
     /** A handle to the FrameLayout that holds the content of the bottom sheet. */
-    private TouchRestrictingFrameLayout mBottomSheetContentContainer;
+    private FrameLayout mBottomSheetContentContainer;
 
     /**
      * The last offset ratio sent to observers of onSheetOffsetChanged(). This is used to ensure the
@@ -139,7 +139,7 @@
     private float mLastOffsetRatioSent;
 
     /** The FrameLayout used to hold the bottom sheet toolbar. */
-    private TouchRestrictingFrameLayout mToolbarHolder;
+    private FrameLayout mToolbarHolder;
 
     /** Whether the {@link BottomSheet} and its children should react to touch events. */
     private boolean mIsTouchEnabled;
@@ -247,7 +247,9 @@
         mSettleAnimator = null;
     }
 
-    /** @return Whether the sheet is in the process of hiding. */
+    /**
+     * @return Whether the sheet is in the process of hiding.
+     */
     boolean isHiding() {
         return mSettleAnimator != null && mTargetState == SheetState.HIDDEN;
     }
@@ -264,6 +266,9 @@
 
         if (isHiding()) return false;
 
+        // No interaction when sheet is animating.
+        if (getSheetState() == SheetState.SCROLLING) return true;
+
         return mGestureDetector.onInterceptTouchEvent(e);
     }
 
@@ -277,6 +282,9 @@
         // anything with them.
         if (!mIsTouchEnabled) return true;
 
+        // No interaction when sheet is animating.
+        if (getSheetState() == SheetState.SCROLLING) return true;
+
         mGestureDetector.onTouchEvent(e);
 
         return true;
@@ -314,12 +322,9 @@
         onAppHeaderHeightChanged(appHeaderHeight);
         setBottomMargin(bottomMargin);
 
-        mToolbarHolder =
-                (TouchRestrictingFrameLayout) findViewById(R.id.bottom_sheet_toolbar_container);
+        mToolbarHolder = (FrameLayout) findViewById(R.id.bottom_sheet_toolbar_container);
 
-        mBottomSheetContentContainer =
-                (TouchRestrictingFrameLayout) findViewById(R.id.bottom_sheet_content);
-        mBottomSheetContentContainer.setBottomSheet(this);
+        mBottomSheetContentContainer = (FrameLayout) findViewById(R.id.bottom_sheet_content);
 
         mContainerWidth = mSheetContainer.getWidth();
         mContainerHeight = mSheetContainer.getHeight();
diff --git a/components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/TouchRestrictingFrameLayout.java b/components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/TouchRestrictingFrameLayout.java
deleted file mode 100644
index bf114fe9..0000000
--- a/components/browser_ui/bottomsheet/android/internal/java/src/org/chromium/components/browser_ui/bottomsheet/TouchRestrictingFrameLayout.java
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2018 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-package org.chromium.components.browser_ui.bottomsheet;
-
-import android.content.Context;
-import android.util.AttributeSet;
-import android.view.MotionEvent;
-import android.widget.FrameLayout;
-
-/**
- * A specialized FrameLayout that is capable of ignoring all user input based on the state of
- * the bottom sheet.
- */
-class TouchRestrictingFrameLayout extends FrameLayout {
-    /** A handle to the bottom sheet. */
-    private BottomSheet mBottomSheet;
-
-    public TouchRestrictingFrameLayout(Context context, AttributeSet atts) {
-        super(context, atts);
-    }
-
-    /** @param sheet The bottom sheet. */
-    public void setBottomSheet(BottomSheet sheet) {
-        mBottomSheet = sheet;
-    }
-
-    /** @return Whether touch is enabled. */
-    private boolean isTouchDisabled() {
-        return mBottomSheet == null
-                || mBottomSheet.getSheetState() == BottomSheetController.SheetState.SCROLLING;
-    }
-
-    @Override
-    public boolean onInterceptTouchEvent(MotionEvent event) {
-        if (isTouchDisabled()) return false;
-        return super.onInterceptTouchEvent(event);
-    }
-
-    @Override
-    public boolean onTouchEvent(MotionEvent event) {
-        if (isTouchDisabled()) return false;
-        return super.onTouchEvent(event);
-    }
-}
diff --git a/components/browser_ui/bottomsheet/android/java/res/layout/bottom_sheet.xml b/components/browser_ui/bottomsheet/android/java/res/layout/bottom_sheet.xml
index b10b6ce4..04ce93e 100644
--- a/components/browser_ui/bottomsheet/android/java/res/layout/bottom_sheet.xml
+++ b/components/browser_ui/bottomsheet/android/java/res/layout/bottom_sheet.xml
@@ -6,7 +6,6 @@
 -->
 <org.chromium.components.browser_ui.bottomsheet.BottomSheet
     xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
     android:id="@+id/bottom_sheet"
     android:layout_width="wrap_content"
     android:layout_height="match_parent"
@@ -25,7 +24,7 @@
         android:layout_height="match_parent"
         android:background="@drawable/bottom_sheet_background" />
 
-    <org.chromium.components.browser_ui.bottomsheet.TouchRestrictingFrameLayout
+    <FrameLayout
         android:importantForAccessibility="yes"
         android:id="@+id/bottom_sheet_content"
         android:layout_width="match_parent"
@@ -38,8 +37,7 @@
         android:layout_width="match_parent"
         android:layout_height="wrap_content" >
 
-        <view
-            class="org.chromium.components.browser_ui.bottomsheet.TouchRestrictingFrameLayout"
+        <FrameLayout
             android:id="@+id/bottom_sheet_toolbar_container"
             android:layout_width="match_parent"
             android:layout_height="wrap_content" />
Loading diff…

Original Bug Report

reported by bh...@gmail.com

The PWA's installation dialog isn't being dismissed after redirects, which allows an attacker to sho

Steps to reproduce the problem

go to mrnoob790.github.io/index.html click on add homescreen and then fastly click on install app u will installation popup come in screen and website is redirect to google.com

Problem Description

After the PWA’s installation dialog is opened by the user, it is possible to redirect the attacker’s page to another website, and given the dialog isn’t being dismissed, it will show over cross-origin websites

Summary

The PWA’s installation dialog isn’t being dismissed after redirects, which allows an attacker to sho

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A

View on issue tracker