From 9491c00b2c1910c2cafbbc25733ddbbc6507f62d Mon Sep 17 00:00:00 2001
From: Alvin Ji <alvinji@chromium.org>
Date: Wed, 10 Jun 2026 11:44:07 -0700
Subject: [PATCH] nfc: Fix Web NFC Blocklist bypass for NFC-B tags

Consult getHiLayerResponse() if getHistoricalBytes() returns null or
empty, which is the case for NFC-B tags.

BUG=497337759

Change-Id: I1aa00301707679f1cf401ecd3b9568c5ab858ab9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7913540
Reviewed-by: Fr <beaufort.francois@gmail.com>
Commit-Queue: Alvin Ji <alvinji@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1644747}
---

diff --git a/services/device/nfc/android/java/src/org/chromium/device/nfc/NfcBlocklist.java b/services/device/nfc/android/java/src/org/chromium/device/nfc/NfcBlocklist.java
index 165b21dc..f13e54ff 100644
--- a/services/device/nfc/android/java/src/org/chromium/device/nfc/NfcBlocklist.java
+++ b/services/device/nfc/android/java/src/org/chromium/device/nfc/NfcBlocklist.java
@@ -130,8 +130,11 @@
 
         IsoDep iso = IsoDep.get(tag);
         if (iso != null) {
-            byte[] historicalBytes = iso.getHistoricalBytes();
-            if (areHistoricalBytesBlocked(historicalBytes)) {
+            byte[] identifierBytes = iso.getHistoricalBytes();
+            if (identifierBytes == null || identifierBytes.length == 0) {
+                identifierBytes = iso.getHiLayerResponse();
+            }
+            if (areHistoricalBytesBlocked(identifierBytes)) {
                 Log.w(TAG, "Access to NFC tag is blocked.");
                 return true;
             }
diff --git a/services/device/nfc/android/junit/src/org/chromium/device/nfc/NfcBlocklistTest.java b/services/device/nfc/android/junit/src/org/chromium/device/nfc/NfcBlocklistTest.java
index 181f614..aeb7bb2 100644
--- a/services/device/nfc/android/junit/src/org/chromium/device/nfc/NfcBlocklistTest.java
+++ b/services/device/nfc/android/junit/src/org/chromium/device/nfc/NfcBlocklistTest.java
@@ -101,4 +101,20 @@
         assertFalse(areHistoricalBytesBlocked(new byte[] {}));
         assertFalse(areHistoricalBytesBlocked(new byte[] {0x01, 0x02, 0x03}));
     }
+
+    /**
+     * Verifies that null historical bytes are not blocked.
+     *
+     * <p>null is returned by IsoDep.getHistoricalBytes() for NFC-B tags, which are instead
+     * identified by their hi-layer response in NfcBlocklist.isTagBlocked().
+     */
+    @Test
+    @Feature({"NfcBlocklistTest"})
+    public void testNullHistoricalBytesAreNotBlocked() {
+        // Even with a server-pushed entry, null (the value every NFC-B ISO-DEP
+        // tag yields from getHistoricalBytes()) is never blocked.
+        NfcBlocklist.overrideNfcBlocklistForTests("8073c021c057597562694b6579");
+        assertFalse(areHistoricalBytesBlocked(null));
+        assertTrue(areHistoricalBytesBlocked(YUBIKEY_5_SERIES_HISTORICAL_BYTES));
+    }
 }