From ef2211f692fd57fe787e646e4357cbcb5e99742d Mon Sep 17 00:00:00 2001
From: Danil Somsikov <dsv@chromium.org>
Date: Mon, 18 May 2026 12:48:35 -0700
Subject: [PATCH] Disable DOM.getFileInfo when file access not allowed.

Add the implementation to the browser-side and check there.

Bug: 513030698
Change-Id: Ia72198f6de63a3b9abf9e667ea191c96b5e3d42e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7854924
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Auto-Submit: Danil Somsikov <dsv@chromium.org>
Reviewed-by: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1632349}
---

diff --git a/content/browser/devtools/protocol/devtools_protocol_browsertest.cc b/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
index d912305..5fe832e 100644
--- a/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
+++ b/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
@@ -1874,6 +1874,32 @@
 #endif
 
 IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest,
+                       DOMGetFileInfoRequiresFileAccess) {
+  NavigateToURLBlockUntilNavigationsComplete(shell(), GURL("about:blank"), 1);
+  Attach();
+
+  base::DictValue params;
+  params.Set("objectId", "dummy-object-id");
+
+  // Should succeed in browser-side check and fall through to renderer,
+  // which will return an error about invalid objectId.
+  ASSERT_FALSE(SendCommandSync("DOM.getFileInfo", params.Clone()));
+  EXPECT_NE(*error()->FindString("message"), "Not allowed");
+
+  Detach();
+  SetMayReadLocalFiles(false);
+
+  Attach();
+
+  // It should fail now in the browser-side check.
+  ASSERT_FALSE(SendCommandSync("DOM.getFileInfo", std::move(params)));
+  EXPECT_THAT(
+      error()->FindInt("code"),
+      testing::Optional(static_cast<int>(crdtp::DispatchCode::SERVER_ERROR)));
+  EXPECT_EQ(*error()->FindString("message"), "Not allowed");
+}
+
+IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest,
                        DispatchDragEventWithFileUrlRequiresFileAccess) {
   ASSERT_TRUE(embedded_test_server()->Start());
   GURL test_url = embedded_test_server()->GetURL("/devtools/navigation.html");
diff --git a/content/browser/devtools/protocol/dom_handler.cc b/content/browser/devtools/protocol/dom_handler.cc
index efed9a9..62225f5 100644
--- a/content/browser/devtools/protocol/dom_handler.cc
+++ b/content/browser/devtools/protocol/dom_handler.cc
@@ -32,6 +32,13 @@
   return Response::Success();
 }
 
+Response DOMHandler::GetFileInfo(const std::string& object_id,
+                                 std::string* path) {
+  if (!allow_file_access_)
+    return Response::ServerError("Not allowed");
+  return Response::FallThrough();
+}
+
 Response DOMHandler::SetFileInputFiles(
     std::unique_ptr<protocol::Array<std::string>> files,
     std::optional<DOM::NodeId> node_id,
diff --git a/content/browser/devtools/protocol/dom_handler.h b/content/browser/devtools/protocol/dom_handler.h
index fbd7d43..837913fb 100644
--- a/content/browser/devtools/protocol/dom_handler.h
+++ b/content/browser/devtools/protocol/dom_handler.h
@@ -36,6 +36,9 @@
       std::optional<DOM::BackendNodeId> backend_node_id,
       std::optional<String> in_object_id) override;
 
+  Response GetFileInfo(const std::string& object_id,
+                       std::string* path) override;
+
  private:
   raw_ptr<RenderFrameHostImpl> host_;
   bool allow_file_access_;
diff --git a/content/browser/devtools/protocol_config.json b/content/browser/devtools/protocol_config.json
index bd0f75de..30b60b4 100644
--- a/content/browser/devtools/protocol_config.json
+++ b/content/browser/devtools/protocol_config.json
@@ -25,7 +25,7 @@
             },
             {
                 "domain": "DOM",
-                "include": ["setFileInputFiles"],
+                "include": ["setFileInputFiles", "getFileInfo"],
                 "include_events": []
             },
             {

diff --git a/content/browser/devtools/protocol/devtools_protocol_browsertest.cc b/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
index d912305..5fe832e 100644
--- a/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
+++ b/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
@@ -1874,6 +1874,32 @@
 #endif
 
 IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest,
+                       DOMGetFileInfoRequiresFileAccess) {
+  NavigateToURLBlockUntilNavigationsComplete(shell(), GURL("about:blank"), 1);
+  Attach();
+
+  base::DictValue params;
+  params.Set("objectId", "dummy-object-id");
+
+  // Should succeed in browser-side check and fall through to renderer,
+  // which will return an error about invalid objectId.
+  ASSERT_FALSE(SendCommandSync("DOM.getFileInfo", params.Clone()));
+  EXPECT_NE(*error()->FindString("message"), "Not allowed");
+
+  Detach();
+  SetMayReadLocalFiles(false);
+
+  Attach();
+
+  // It should fail now in the browser-side check.
+  ASSERT_FALSE(SendCommandSync("DOM.getFileInfo", std::move(params)));
+  EXPECT_THAT(
+      error()->FindInt("code"),
+      testing::Optional(static_cast<int>(crdtp::DispatchCode::SERVER_ERROR)));
+  EXPECT_EQ(*error()->FindString("message"), "Not allowed");
+}
+
+IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest,
                        DispatchDragEventWithFileUrlRequiresFileAccess) {
   ASSERT_TRUE(embedded_test_server()->Start());
   GURL test_url = embedded_test_server()->GetURL("/devtools/navigation.html");