Chrome · FileSystem › FSA
CVE-2026-76028
Policy Bypass in FileSystem (FSA)
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- File System Access API (FSA)
- lets a web origin, after a user picks a directory/file, read and write real files on disk via
showDirectoryPicker/showSaveFilePickerhandles. - Sensitive-path blocklist
ChromeFileSystemAccessPermissionContextkeeps a list ofBlockPathentries (ConfirmSensitiveEntryAccess) that refuse access to security-relevant locations even after the user grants a handle.- `BlockType::kBlockAllChildren`
- blocks the path and everything under it.
Root Cause Analysis
The FSA sensitive-path blocklist was incomplete and platform-inconsistent: ~/.config — which holds configuration for many cross-platform tools — was only blocked on Linux/ChromeOS/Android, so on Windows and macOS a web page holding a granted directory handle could reach and overwrite files under ~/.config (this CVE’s bug, crbug.com/569012015).
The fix moves ~/.config to the cross-platform block list (BlockPath::CreateRelative(base::DIR_HOME, ".config", kBlockAllChildren)) and, in the same change, adds shell startup files, .git/config/.git/modules, /dev on macOS, ~/.local/share, ~/.pki, and the fontconfig files. This is an access-control/policy gap, not a memory-safety defect: nothing in the patch frees or corrupts memory — it only extends the blocklist, with tests asserting the new paths abort writes while reads stay allowed. (The advisory’s “use after free” wording does not match the fix; the mapped commit — which cites bug 569012015 in its Bug: list — is purely a blocklist addition. Reclassified to PolicyBypass. The commit lists 8 bug IDs; attributing crbug.com/569012015 specifically to this CVE is inferred from the per-path comments and reporters, not bound by the diff.)
Key insight
A security-relevant directory (
~/.config) was omitted from the FSA blocklist on Windows/macOS, letting a granted web origin write files outside the intended policy; the fix adds it on all platforms.Attack Path
- ENTRY A malicious or compromised web page prompts the user to grant a File System Access directory handle at or above their home directory.
- CONTROLLED INPUT
The page navigates the handle to
~/.config/<tool>/...on Windows or macOS, where the blocklist did not apply. - MISSING CHECK
ConfirmSensitiveEntryAccesshad no~/.configentry on those platforms, so the write was allowed. - IMPACT
The page overwrites configuration of cross-platform tools under
~/.config, which can lead to code execution or security-setting tampering when the user next runs the affected tool (specific escalation depends on the targeted tool; inferred).
Impact Assessment
This is a File System Access policy bypass: a web origin with a user-granted handle can write to sensitive configuration under
~/.config on platforms where it was not blocked, outside the protection the blocklist is meant to enforce. It requires the user to grant a broad directory handle (the standard FSA precondition); no memory-safety primitive is involved. Advisory severity high; no in-the-wild exploitation stated.Files Changed
chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.ccchrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
Audit Directions
- Blocklist parity across platformsAudit every
BlockPathentry for#if BUILDFLAGguards that omit a platform; sensitive paths should generally be blocked everywhere. - Config/dotfile coverageEnumerate tool config dirs and dotfiles a write could weaponize (shells, git, package managers) and confirm each is on the FSA blocklist.
Patch
From d6f2c70dbb4cd97f6eaf62aed88c8f2e57ef3fce Mon Sep 17 00:00:00 2001
From: Mingyu Lei <leimy@chromium.org>
Date: Wed, 21 Oct 2026 23:00:11 -0700
Subject: [PATCH] FSA: Add missing sensitive paths to the blocklist
Several sensitive locations are still reachable through File System
Access because they are missing from the sensitive-path blocklist, or
are only blocked on some platforms. Add them:
- Block write access to */.git/config and */.git/modules on all
platforms, alongside */.git/hooks. Reads stay allowed, so web Git
clients can still read repository configuration.
- Block ~/.config on all platforms. It was only blocked on Linux,
ChromeOS and Android.
- Block shell startup files in the home directory on all platforms,
including the ones Git Bash reads on Windows.
- Block /dev on macOS, matching Linux.
- Block ~/.local/share, the legacy fontconfig files ~/.fonts.conf and
~/.fonts.conf.d, and the NSS database directory ~/.pki on Linux and
ChromeOS.
Bug: 572269631, 571913154, 569012015, 558362029
Bug: 569012543, 561996724, 559780982, 557367241
Test: unit_tests --gtest_filter=ChromeFileSystemAccessPermissionContextTest.*ConfirmSensitiveEntryAccess*
Change-Id: Ia6fe9e51807e8106fbc6ac69e28d550660e49b38
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8619619
Reviewed-by: Fergal Daly <fergal@chromium.org>
Commit-Queue: Mingyu Lei <leimy@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1724465}
---
diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
index 112be22..be365904 100644
--- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
+++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
@@ -441,10 +441,41 @@
// And limit access to ~/.gnupg as well.
BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
BlockType::kBlockAllChildren),
+ // ~/.config holds configuration for many cross-platform tools, so block
+ // it on all platforms, see crbug.com/569012015.
+ BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".config"),
+ BlockType::kBlockAllChildren),
+ // Shell startup files in the home directory, including the ones read by
+ // Git Bash on Windows, see crbug.com/558362029.
+ BlockPath::CreateRelative(base::DIR_HOME,
+ FILE_PATH_LITERAL(".bash_profile"),
+ BlockType::kBlockAllChildren),
+ BlockPath::CreateRelative(base::DIR_HOME,
+ FILE_PATH_LITERAL(".bash_login"),
+ BlockType::kBlockAllChildren),
+ BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".bashrc"),
+ BlockType::kBlockAllChildren),
+ BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".profile"),
+ BlockType::kBlockAllChildren),
+ BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".zshenv"),
+ BlockType::kBlockAllChildren),
+ BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".zprofile"),
+ BlockType::kBlockAllChildren),
+ BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".zshrc"),
+ BlockType::kBlockAllChildren),
+ BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".zlogin"),
+ BlockType::kBlockAllChildren),
// Block write access to */.git/hooks, see crbug.com/465668234 and
// crbug.com/553115714.
BlockPath::CreateSuffix(FILE_PATH_LITERAL(".git/hooks"),
BlockType::kBlockWrite),
+ // Block write access to the repository config and to submodule git
+ // directories, which have their own hooks and config, see
+ // crbug.com/572269631 and crbug.com/571913154.
+ BlockPath::CreateSuffix(FILE_PATH_LITERAL(".git/config"),
+ BlockType::kBlockWrite),
+ BlockPath::CreateSuffix(FILE_PATH_LITERAL(".git/modules"),
+ BlockType::kBlockWrite),
#if BUILDFLAG(IS_WIN)
// Some Windows specific directories to block, basically all apps, the
// operating system itself, as well as configuration data for apps.
@@ -475,6 +506,10 @@
// volumes).
BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/System/Volumes"),
BlockType::kBlockAllChildren),
+ // Block access to devices via /dev, matching Linux, see
+ // crbug.com/569012543.
+ BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/dev"),
+ BlockType::kBlockAllChildren),
BlockPath::CreateRelative(base::DIR_APP_DATA,
BlockType::kBlockAllChildren),
// Block access to the current bundle directory.
@@ -525,14 +560,25 @@
BlockType::kBlockAllChildren),
BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/etc"),
BlockType::kBlockAllChildren),
- // And block all of ~/.config, matching the similar restrictions on mac
- // and windows.
- BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".config"),
- BlockType::kBlockAllChildren),
// Block ~/.dbus as well, just in case, although there probably isn't much
// a website can do with access to that directory and its contents.
BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
BlockType::kBlockAllChildren),
+ // Block per-user application data, see crbug.com/561996724.
+ BlockPath::CreateRelative(base::DIR_HOME,
+ FILE_PATH_LITERAL(".local/share"),
+ BlockType::kBlockAllChildren),
+ // Block the legacy per-user fontconfig configuration, see
+ // crbug.com/559780982. The current location is under ~/.config.
+ BlockPath::CreateRelative(base::DIR_HOME,
+ FILE_PATH_LITERAL(".fonts.conf"),
+ BlockType::kBlockAllChildren),
+ BlockPath::CreateRelative(base::DIR_HOME,
+ FILE_PATH_LITERAL(".fonts.conf.d"),
+ BlockType::kBlockAllChildren),
+ // Block the per-user NSS database, see crbug.com/557367241.
+ BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".pki"),
+ BlockType::kBlockAllChildren),
// And block all of ~/.cache, matching the similar restrictions on mac
// and windows.
BlockPath::CreateRelative(base::DIR_CACHE, BlockType::kBlockAllChildren),
diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc
index 1bd9323..d500135 100644
--- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc
+++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc
@@ -862,9 +862,8 @@
TEST_F(ChromeFileSystemAccessPermissionContextTest,
ConfirmSensitiveEntryAccess_ExplicitPathBlock) {
-// Linux is the only OS where we have some blocked directories with explicit
-// paths (as opposed to PathService provided paths).
-#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
+#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID) || \
+ BUILDFLAG(IS_MAC)
// /dev should be blocked.
EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
permission_context(), PathInfo(FILE_PATH_LITERAL("/dev")),
@@ -1604,6 +1603,101 @@
SensitiveDirectoryResult::kAllowed);
}
+// Testing that writes to */.git/config and */.git/modules are blocked, while
+// reads stay allowed.
+TEST_F(ChromeFileSystemAccessPermissionContextTest,
+ ConfirmSensitiveEntryAccess_GitConfigAndModulesWriteBlock) {
+#if defined(FILE_PATH_USES_DRIVE_LETTERS)
+ base::FilePath root(FILE_PATH_LITERAL("c:\\"));
+#else
+ base::FilePath root(FILE_PATH_LITERAL("/"));
+#endif
+ const base::FilePath git_dir =
+ root.Append(FILE_PATH_LITERAL("a")).Append(FILE_PATH_LITERAL(".git"));
+ const base::FilePath git_config = git_dir.Append(FILE_PATH_LITERAL("config"));
+ const base::FilePath git_modules =
+ git_dir.Append(FILE_PATH_LITERAL("modules"));
+ const base::FilePath submodule_dir =
+ git_modules.Append(FILE_PATH_LITERAL("sub"));
+
+ // .git/config is blocked for save and programmatic write.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kSave),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ // .git/config is not blocked for read.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kOpen),
+ SensitiveDirectoryResult::kAllowed);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kProgrammaticRead),
+ SensitiveDirectoryResult::kAllowed);
+ // Case variations of .git/config are blocked for programmatic write.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(root.Append(FILE_PATH_LITERAL("a"))
+ .Append(FILE_PATH_LITERAL(".GIT"))
+ .Append(FILE_PATH_LITERAL("CONFIG"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ // Other files under .git, and files named config outside of .git, are
+ // allowed.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(git_dir.Append(FILE_PATH_LITERAL("config.bak"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAllowed);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(root.Append(FILE_PATH_LITERAL("a"))
+ .Append(FILE_PATH_LITERAL("config"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAllowed);
+
+ // .git/modules and everything inside it is blocked for save and programmatic
+ // write.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_modules),
+ HandleType::kDirectory, AccessTrigger::kSave),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_modules),
+ HandleType::kDirectory, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("hooks"))
+ .Append(FILE_PATH_LITERAL("pre-commit"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("config"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ // .git/modules is not blocked for read.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_modules),
+ HandleType::kDirectory, AccessTrigger::kOpen),
+ SensitiveDirectoryResult::kAllowed);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("config"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticRead),
+ SensitiveDirectoryResult::kAllowed);
+ // The .git directory itself is still allowed for save.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_dir), HandleType::kDirectory,
+ AccessTrigger::kSave),
+ SensitiveDirectoryResult::kAllowed);
+}
+
#if BUILDFLAG(IS_ANDROID)
TEST_F(ChromeFileSystemAccessPermissionContextTest,
ConfirmSensitiveEntryAccess_ContentUri) {
@@ -1867,6 +1961,15 @@
{chrome::DIR_USER_DATA, nullptr, true, false},
{base::DIR_HOME, FILE_PATH_LITERAL(".ssh"), true, false},
{base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".config"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".bash_profile"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".bash_login"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".bashrc"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".profile"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zshenv"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zprofile"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zshrc"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zlogin"), true, false},
#if BUILDFLAG(IS_WIN)
{base::DIR_PROGRAM_FILES, nullptr, true, false},
@@ -1880,6 +1983,7 @@
#endif
#if BUILDFLAG(IS_MAC)
+ {kNoBasePathKey, FILE_PATH_LITERAL("/dev"), true, false},
{base::DIR_APP_DATA, nullptr, true, false},
{chrome::DIR_OUTER_BUNDLE, nullptr, true, false},
{base::DIR_HOME, FILE_PATH_LITERAL("Applications"), true, false},
@@ -1900,8 +2004,11 @@
{kNoBasePathKey, FILE_PATH_LITERAL("/sys"), true, false},
{kNoBasePathKey, FILE_PATH_LITERAL("/boot"), true, false},
{kNoBasePathKey, FILE_PATH_LITERAL("/etc"), true, false},
- {base::DIR_HOME, FILE_PATH_LITERAL(".config"), true, false},
{base::DIR_HOME, FILE_PATH_LITERAL(".dbus"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".local/share"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".fonts.conf"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".fonts.conf.d"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".pki"), true, false},
#endif
#if BUILDFLAG(IS_ANDROID)
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc
index 1bd9323..d500135 100644
--- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc
+++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context_unittest.cc
@@ -862,9 +862,8 @@
TEST_F(ChromeFileSystemAccessPermissionContextTest,
ConfirmSensitiveEntryAccess_ExplicitPathBlock) {
-// Linux is the only OS where we have some blocked directories with explicit
-// paths (as opposed to PathService provided paths).
-#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
+#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID) || \
+ BUILDFLAG(IS_MAC)
// /dev should be blocked.
EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
permission_context(), PathInfo(FILE_PATH_LITERAL("/dev")),
@@ -1604,6 +1603,101 @@
SensitiveDirectoryResult::kAllowed);
}
+// Testing that writes to */.git/config and */.git/modules are blocked, while
+// reads stay allowed.
+TEST_F(ChromeFileSystemAccessPermissionContextTest,
+ ConfirmSensitiveEntryAccess_GitConfigAndModulesWriteBlock) {
+#if defined(FILE_PATH_USES_DRIVE_LETTERS)
+ base::FilePath root(FILE_PATH_LITERAL("c:\\"));
+#else
+ base::FilePath root(FILE_PATH_LITERAL("/"));
+#endif
+ const base::FilePath git_dir =
+ root.Append(FILE_PATH_LITERAL("a")).Append(FILE_PATH_LITERAL(".git"));
+ const base::FilePath git_config = git_dir.Append(FILE_PATH_LITERAL("config"));
+ const base::FilePath git_modules =
+ git_dir.Append(FILE_PATH_LITERAL("modules"));
+ const base::FilePath submodule_dir =
+ git_modules.Append(FILE_PATH_LITERAL("sub"));
+
+ // .git/config is blocked for save and programmatic write.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kSave),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ // .git/config is not blocked for read.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kOpen),
+ SensitiveDirectoryResult::kAllowed);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_config), HandleType::kFile,
+ AccessTrigger::kProgrammaticRead),
+ SensitiveDirectoryResult::kAllowed);
+ // Case variations of .git/config are blocked for programmatic write.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(root.Append(FILE_PATH_LITERAL("a"))
+ .Append(FILE_PATH_LITERAL(".GIT"))
+ .Append(FILE_PATH_LITERAL("CONFIG"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ // Other files under .git, and files named config outside of .git, are
+ // allowed.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(git_dir.Append(FILE_PATH_LITERAL("config.bak"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAllowed);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(root.Append(FILE_PATH_LITERAL("a"))
+ .Append(FILE_PATH_LITERAL("config"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAllowed);
+
+ // .git/modules and everything inside it is blocked for save and programmatic
+ // write.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_modules),
+ HandleType::kDirectory, AccessTrigger::kSave),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_modules),
+ HandleType::kDirectory, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("hooks"))
+ .Append(FILE_PATH_LITERAL("pre-commit"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("config"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticWrite),
+ SensitiveDirectoryResult::kAbort);
+ // .git/modules is not blocked for read.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_modules),
+ HandleType::kDirectory, AccessTrigger::kOpen),
+ SensitiveDirectoryResult::kAllowed);
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(),
+ PathInfo(submodule_dir.Append(FILE_PATH_LITERAL("config"))),
+ HandleType::kFile, AccessTrigger::kProgrammaticRead),
+ SensitiveDirectoryResult::kAllowed);
+ // The .git directory itself is still allowed for save.
+ EXPECT_EQ(ConfirmSensitiveEntryAccessSync(
+ permission_context(), PathInfo(git_dir), HandleType::kDirectory,
+ AccessTrigger::kSave),
+ SensitiveDirectoryResult::kAllowed);
+}
+
#if BUILDFLAG(IS_ANDROID)
TEST_F(ChromeFileSystemAccessPermissionContextTest,
ConfirmSensitiveEntryAccess_ContentUri) {
@@ -1867,6 +1961,15 @@
{chrome::DIR_USER_DATA, nullptr, true, false},
{base::DIR_HOME, FILE_PATH_LITERAL(".ssh"), true, false},
{base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".config"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".bash_profile"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".bash_login"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".bashrc"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".profile"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zshenv"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zprofile"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zshrc"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".zlogin"), true, false},
#if BUILDFLAG(IS_WIN)
{base::DIR_PROGRAM_FILES, nullptr, true, false},
@@ -1880,6 +1983,7 @@
#endif
#if BUILDFLAG(IS_MAC)
+ {kNoBasePathKey, FILE_PATH_LITERAL("/dev"), true, false},
{base::DIR_APP_DATA, nullptr, true, false},
{chrome::DIR_OUTER_BUNDLE, nullptr, true, false},
{base::DIR_HOME, FILE_PATH_LITERAL("Applications"), true, false},
@@ -1900,8 +2004,11 @@
{kNoBasePathKey, FILE_PATH_LITERAL("/sys"), true, false},
{kNoBasePathKey, FILE_PATH_LITERAL("/boot"), true, false},
{kNoBasePathKey, FILE_PATH_LITERAL("/etc"), true, false},
- {base::DIR_HOME, FILE_PATH_LITERAL(".config"), true, false},
{base::DIR_HOME, FILE_PATH_LITERAL(".dbus"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".local/share"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".fonts.conf"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".fonts.conf.d"), true, false},
+ {base::DIR_HOME, FILE_PATH_LITERAL(".pki"), true, false},
#endif
#if BUILDFLAG(IS_ANDROID)
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page