From 7cceae635cb7841114ce6d19665f58c6103e22c8 Mon Sep 17 00:00:00 2001
From: Dibyajyoti Pal <dibyapal@google.com>
Date: Mon, 29 Jun 2026 10:31:26 -0700
Subject: [PATCH] [PWA] Filter file-handling URIs based on caller permission

The Android Trusted Web Activity (TWA) file-handling path was accepting
arbitrary content URIs from a co-installed app and forwarding them to
the File System Access (FSA) API without checking if the calling app had
permissions on those URIs. If Chrome held a persisted permission for a
URI from a prior user action, an attacker-controlled TWA could read or
write that file promptlessly, leading to a confused deputy
vulnerability.

This CL fixes the issue by filtering the URIs in WebAppLaunchHandler
before they are forwarded to the launch queue or used to launch a new
intent. We verify that the caller has permission to the URIs using
Activity.getCurrentCaller().checkContentUriPermission() on Android 15+
and falling back to checking the session UID/PID via
Context.checkUriPermission() on older Android versions.

Bug: b:520576676
Test: tools/autotest.py -C out/Default WebAppLaunchHandlerTest
Change-Id: Ieaf01803003d7032091c6c3194cb9fc2baf636bc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7910767
Reviewed-by: Peter Conn <peconn@chromium.org>
Commit-Queue: Dibyajyoti Pal <dibyapal@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1654161}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
index 6c89f527..e82fd80 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
@@ -1393,6 +1393,16 @@
         return mClientManager.getClientPackageNameForSession(session);
     }
 
+    /** See {@link ClientManager#getClientUidForSession(SessionHolder)} */
+    public int getClientUidForSession(@Nullable SessionHolder<?> session) {
+        return mClientManager.getClientUidForSession(session);
+    }
+
+    /** See {@link ClientManager#getClientPidForSession(SessionHolder)} */
+    public int getClientPidForSession(@Nullable SessionHolder<?> session) {
+        return mClientManager.getClientPidForSession(session);
+    }
+
     /**
      * Extracts the target network from the intent if the caller has the required permissions.
      * Package-private to be used by {@link CustomTabIntentDataProvider}.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandler.java
index 2c10074..b8de8c9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandler.java
@@ -13,11 +13,14 @@
 import static org.chromium.build.NullUtil.assertNonNull;
 import static org.chromium.build.NullUtil.assumeNonNull;
 
+import android.annotation.SuppressLint;
 import android.app.Activity;
 import android.content.ActivityNotFoundException;
 import android.content.ContentResolver;
 import android.content.Intent;
+import android.content.pm.PackageManager;
 import android.net.Uri;
+import android.os.Build;
 import android.text.TextUtils;
 
 import androidx.browser.trusted.FileHandlingData;
@@ -32,8 +35,10 @@
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.build.annotations.Nullable;
 import org.chromium.chrome.browser.browserservices.intents.BrowserServicesIntentDataProvider;
+import org.chromium.chrome.browser.browserservices.intents.SessionHolder;
 import org.chromium.chrome.browser.browserservices.ui.controller.CurrentPageVerifier;
 import org.chromium.chrome.browser.browserservices.ui.controller.Verifier;
+import org.chromium.chrome.browser.customtabs.CustomTabsConnection;
 import org.chromium.chrome.browser.customtabs.content.WebAppLaunchHandlerHistogram.ClientModeAction;
 import org.chromium.chrome.browser.customtabs.content.WebAppLaunchHandlerHistogram.FailureReasonAction;
 import org.chromium.chrome.browser.customtabs.content.WebAppLaunchHandlerHistogram.FileHandlingAction;
@@ -42,6 +47,7 @@
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.content_public.browser.WebContentsObserver;
 
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Locale;
@@ -195,12 +201,13 @@
     public void handleInitialIntent(BrowserServicesIntentDataProvider intentDataProvider) {
         WebAppLaunchHandlerHistogram.logClientMode(ClientModeAction.INITIAL_INTENT);
 
+        FileHandlingData filteredData = filterFileHandlingData(intentDataProvider);
         WebAppLaunchParams launchParams =
                 getLaunchParams(
                         /* newNavigationStarted= */ true,
                         assertNonNull(intentDataProvider.getUrlToLoad()),
                         assertNonNull(intentDataProvider.getClientPackageName()),
-                        intentDataProvider.getFileHandlingData());
+                        filteredData);
 
         maybeNotifyLaunchQueue(launchParams);
     }
@@ -225,11 +232,13 @@
         assert urlToLoad != null;
         String packageName = intentDataProvider.getClientPackageName();
 
+        FileHandlingData filteredData = filterFileHandlingData(intentDataProvider);
+
         CurrentPageVerifier.VerificationState state = mCurrentPageVerifier.getState();
         if (clientMode == NAVIGATE_NEW
                 || state == null
                 || state.status != CurrentPageVerifier.VerificationStatus.SUCCESS) {
-            launchNewIntent(urlToLoad, packageName, intentDataProvider.getFileHandlingData());
+            launchNewIntent(urlToLoad, packageName, filteredData);
         } else {
             boolean startNavigation =
                     clientMode == NAVIGATE_EXISTING && !TextUtils.isEmpty(urlToLoad);
@@ -242,11 +251,7 @@
 
             assert packageName != null;
             WebAppLaunchParams launchParams =
-                    getLaunchParams(
-                            startNavigation,
-                            urlToLoad,
-                            packageName,
-                            intentDataProvider.getFileHandlingData());
+                    getLaunchParams(startNavigation, urlToLoad, packageName, filteredData);
 
             maybeNotifyLaunchQueue(launchParams);
         }
@@ -371,6 +376,84 @@
     }
 
     /**
+     * Filters incoming file handling data to retain only URIs that the launching client app has
+     * permission to access.
+     *
+     * @param intentDataProvider Provides incoming intent and session customization data.
+     * @return The filtered FileHandlingData object containing authorized URIs, or null if all URIs
+     *     were denied or no file data was provided.
+     */
+    private @Nullable FileHandlingData filterFileHandlingData(
+            BrowserServicesIntentDataProvider intentDataProvider) {
+        FileHandlingData fileHandlingData = intentDataProvider.getFileHandlingData();
+        if (fileHandlingData == null || fileHandlingData.uris.isEmpty()) {
+            return null;
+        }
+
+        List<Uri> filteredUris = new ArrayList<>();
+        for (Uri uri : fileHandlingData.uris) {
+            if (doesCallerHavePermissionForUri(intentDataProvider.getSession(), uri)) {
+                filteredUris.add(uri);
+            } else {
+                Log.w(TAG, "Caller does not have permission for URI: " + uri);
+            }
+        }
+
+        if (filteredUris.isEmpty()) {
+            return null;
+        }
+        if (filteredUris.size() == fileHandlingData.uris.size()) {
+            return fileHandlingData;
+        }
+        return new FileHandlingData(filteredUris);
+    }
+
+    /**
+     * Verifies whether the calling application holds read permission for the specified URI.
+     *
+     * <p>On Android 15+ (API 35+), checks caller identity via {@link Activity#getCurrentCaller()}.
+     * On older Android versions, falls back to verifying URI permissions against the session UID.
+     *
+     * @param session The session holder associated with the launching client app.
+     * @param uri The Content URI to verify.
+     * @return True if the caller has explicit read permission for uri, false otherwise.
+     */
+    @SuppressLint("NewApi")
+    private boolean doesCallerHavePermissionForUri(@Nullable SessionHolder<?> session, Uri uri) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM) {
+            try {
+                var caller = mActivity.getCurrentCaller();
+                if (caller != null) {
+                    return caller.checkContentUriPermission(
+                                    uri, Intent.FLAG_GRANT_READ_URI_PERMISSION)
+                            == PackageManager.PERMISSION_GRANTED;
+                }
+            } catch (Exception e) {
+                Log.w(TAG, "Failed to check caller's permission via getCurrentCaller.", e);
+                return false;
+            }
+        }
+
+        // Fallback for Android versions prior to Android 15 (API < 35) or when getCurrentCaller()
+        // is unavailable. We check URI read permissions against the client UID and PID recorded
+        // when the TWA session was established.
+        if (session != null) {
+            int uid = CustomTabsConnection.getInstance().getClientUidForSession(session);
+            int pid = CustomTabsConnection.getInstance().getClientPidForSession(session);
+            if (uid != -1) {