# Enterprise policy required to reach the vulnerable path

`FileSelectHelper::PerformContentAnalysisIfNeeded()` only starts the
asynchronous scan when
`enterprise_connectors::ContentAnalysisDelegate::IsEnabled(profile, url, &data,
AnalysisConnector::FILE_ATTACHED)` returns `true`.

That requires the browser to be enrolled with Chrome Enterprise Connectors and
have the **OnFileAttached** analysis connector configured. On macOS this is set
via managed preferences (a configuration profile delivering the
`OnFileAttachedEnterpriseConnector` policy), e.g.:

```json
"OnFileAttachedEnterpriseConnector": [
  {
    "service_provider": "google",
    "enable": [ { "url_list": ["*"], "tags": ["dlp"] } ],
    "block_until_verdict": 1
  }
]
```

With `block_until_verdict: 1` the scan is asynchronous relative to the
`ContentAnalysisCompletionCallback` bound in
`PerformContentAnalysisIfNeeded()`, giving the attacker a window to close the
tab before the callback fires.

For local reproduction without a real DM server, a fake DM server / local
content-analysis agent can be used (see
`chrome/browser/enterprise/connectors/test/`). The key requirement is simply
that `IsEnabled()` returns true and `CreateForWebContents()` defers the
completion callback past the point where the tab is closed.