From e0cd2f8abf21f75be7d17a81c87c9c4d69c0fb44 Mon Sep 17 00:00:00 2001
From: Dan Murphy <dmurph@chromium.org>
Date: Thu, 25 Jun 2026 11:33:45 -0700
Subject: [PATCH] [PWA] Use length-prefixed encoding in WebappAuthenticator MAC

WebappAuthenticator.getMacForUrlAndIcon computed HMAC over sequentially
concatenated URL and icon strings without delimiters. A malicious local
app could shift data between URL and icon fields while maintaining a
valid MAC, forcing the unsandboxed browser process to decode untrusted
image payloads.

We replace ad-hoc concatenation with standard Java DataOutputStream
length-prefixed binary serialization (writeInt + write). This ensures
field boundaries are mathematically unambiguous without imposing 64KB
UTF-8 limits.

Existing shortcuts created prior to this change fall back to URL-only
verification (MAC_LEGACY), maintaining homescreen navigation while
marking icons as untrusted.

TAG=agy
CONV=9d6b609e-3656-4e36-bdd7-50a54fb71f56

Fixed: b:521963740
Test: run_chrome_junit_tests --gtest_filter=*WebappAuthenticatorTest*
Change-Id: I8842b5ec53a86a98e16af0953358dec1823f45c3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7997269
Reviewed-by: Glenn Hartmann <hartmanng@chromium.org>
Commit-Queue: Daniel Murphy <dmurph@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1652579}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappAuthenticator.java b/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappAuthenticator.java
index d463359..a4cc4a03 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappAuthenticator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappAuthenticator.java
@@ -12,6 +12,8 @@
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.build.annotations.Nullable;
 
+import java.io.ByteArrayOutputStream;
+import java.io.DataOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
@@ -86,11 +88,26 @@
         if (mac == null) {
             return null;
         }
-        mac.update(ApiCompatibilityUtils.getBytesUtf8(url));
-        if (encodedIcon != null) {
-            mac.update(ApiCompatibilityUtils.getBytesUtf8(encodedIcon));
+        if (encodedIcon == null) {
+            mac.update(ApiCompatibilityUtils.getBytesUtf8(url));
+            return mac.doFinal();
         }
-        return mac.doFinal();
+        try {
+            ByteArrayOutputStream byteStream = new ByteArrayOutputStream();
+            DataOutputStream dataStream = new DataOutputStream(byteStream);
+            byte[] urlBytes = ApiCompatibilityUtils.getBytesUtf8(url);
+            dataStream.writeInt(urlBytes.length);
+            dataStream.write(urlBytes);
+            byte[] iconBytes = ApiCompatibilityUtils.getBytesUtf8(encodedIcon);
+            dataStream.writeInt(iconBytes.length);
+            dataStream.write(iconBytes);
+            dataStream.flush();
+            mac.update(byteStream.toByteArray());
+            return mac.doFinal();
+        } catch (IOException e) {
+            Log.w(TAG, "Error serializing MAC data", e);
+            return null;
+        }
     }
 
     /**
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/webapps/WebappAuthenticatorTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/webapps/WebappAuthenticatorTest.java
index 7525c30..8861d22 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/webapps/WebappAuthenticatorTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/webapps/WebappAuthenticatorTest.java
@@ -73,4 +73,21 @@
                 WebappAuthenticator.MAC_INVALID,
                 WebappAuthenticator.verifyMac(url, null, macWithIcon));
     }
+
+    @Test
+    @SmallTest
+    @Feature({"Webapps"})
+    public void testAuthenticationFieldBoundaries() {
+        String url = "https://attacker.example/app/";
+        String icon = "PAYLOAD_LEGIT_ICON";
+        byte[] mac = WebappAuthenticator.getMacForUrlAndIcon(url, icon);
+        Assert.assertNotNull(mac);
+
+        // Shift boundary between url and icon
+        String shiftedUrl = "https://attacker.example/app/PAYLOAD_";
+        String shiftedIcon = "LEGIT_ICON";
+        Assert.assertEquals(
+                WebappAuthenticator.MAC_INVALID,
+                WebappAuthenticator.verifyMac(shiftedUrl, shiftedIcon, mac));
+    }
 }