Downloads bubble doesn't popup when the download is blocked/dangerous (safe browsing disabled)

[ghost]

Description

@simonhong there is an tiny little bug with the Downloads bubble, where if you disable Safe browsing and a 'dangerous' downloaded is blocked, the bubble doesn't popup, and the only way to download the file is by going to downloads page (ctrl+j) and click keep and then keep it anyway.

The easiest way to reproduce this is by creating a new profile, but I noticed it is also affecting my normal profile where I have never had Safe Browsing enabled.

The bug seems to get resolved in normal windows if you click keep and then keep anyway, in my test, new downloads are working as expected after doing that, even on restart.
Also, it worked fine when I had Safe Browsing on and downloaded a file, and then disabled it.

I guess the problem seems to be bigger for InPrivate windows though, because I noticed that if you download a file and 'fix' the issue by keeping the file, once you close the window and open a new InPrivate window and try to download a 'dangerous' file again, the bubble will not popup until you keep it and keep it anyway again.

Steps to Reproduce

1. Create new profile/User Data.
2. go to brave://settings/security and disable Safe Browsing.
3. Go to https://www.majorgeeks.com/mg/get/fort_firewall,2.html
4. Nothing seems to happen
5. Go to downloads page, and the download should only appear there to discard it or keep it
6. (optional) Discard it and go back to the page and try to download the file again to confirm it still doesn't work.
7. Click keep and then keep anyway
8. Future downloads should show the bubble as expected (until it doesn't)

Actual result:

Brave version (brave://version info)

1.52.36 Chromium: 112.0.5615.49 (Official Build) nightly (64-bit) - Windows 11 Pro 21H2 22000.1696

[simonhong]

@Emi-TheDhamphirInLoveUnderTheFrozenStar Thanks for reporting. I'll take a look.

[simonhong]

According to the comment below, dangerous download is considered as a completed.

  // From the button UI's perspective, whether the download is considered in
  // progress. Consider dangerous downloads as completed, because we don't want
  // to encourage users to interact with them. However, consider downloads
  // pending scanning as in progress, because we do want users to scan potential
  // dangerous downloads.

Below method determines whether toolbar button should be shown(ShowToolbarButton()) or hide(HideToolbarButton()).
When all current active downloadings are dangerous files, info.in_progress_count is zero because of above comment.
So, icon_info_.icon_state = DownloadIconState::kComplete;.
To show download button, ShowToolbarButton(); should be called but it's called
when icon_state is not kComplete and there was no recently completed download.
So, we can repro this easily with fresh profile to not have recent download.

@Emi-TheDhamphirInLoveUnderTheFrozenStar What you're seeing is expected behavior with current implementation.
but we want to show download button even current downloading is only for dangerous file.
I'm not sure this is upstream's intended behavior or not but IMO button should be visible in this situation also.

void DownloadDisplayController::UpdateToolbarButtonState(
    std::vector<std::unique_ptr<DownloadUIModel>>& all_models) {
  if (all_models.empty()) {
    HideToolbarButton();
    return;
  }
  AllDownloadUIModelsInfo info = GetAllModelsInfo(all_models);
  base::Time last_complete_time = GetLastCompleteTime(all_models);

  if (info.in_progress_count > 0) {
    icon_info_.icon_state = DownloadIconState::kProgress;
    icon_info_.is_active = info.paused_count < info.in_progress_count;
  } else {
    icon_info_.icon_state = DownloadIconState::kComplete;
    bool complete_unactioned =
        HasRecentCompleteDownload(kToolbarIconActiveTimeInterval,
                                  last_complete_time) &&
        info.has_unactioned;
    bool exited_fullscreen_owed_details =
        !display_->IsFullscreenWithParentViewHidden() &&
        details_shown_while_fullscreen_;
    if (complete_unactioned || exited_fullscreen_owed_details) {
      icon_info_.is_active = true;
      ScheduleToolbarInactive(kToolbarIconActiveTimeInterval);
    } else {
      icon_info_.is_active = false;
    }
  }

  if (info.has_deep_scanning) {
    icon_info_.icon_state = DownloadIconState::kDeepScanning;
  }

  if (icon_info_.icon_state != DownloadIconState::kComplete ||
      HasRecentCompleteDownload(kToolbarIconVisibilityTimeInterval,
                                last_complete_time)) {
    ShowToolbarButton();
  }
  display_->UpdateDownloadIcon(/*show_animation=*/false);
}

[stephendonner]

Verification PASSED using

Brave	1.53.83 Chromium: 114.0.5735.110 (Official Build) beta (x86_64)
Revision	1c828682b85bbc70230a48f5e345489ec447373e-refs/branch-heads/5735_90@{#13}
OS	macOS Version 11.7.7 (Build 20G1345)

Safe Browsing disabled - PASSED

Steps:

1. installed 1.53.83
2. launched Brave
3. toggled Safe Browsing to No Protection in brave://settings/security
4. confirmed warning about disabling Safe Browsing
5. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
6. confirmed auto-download save-as-file location-picker dialog (!) came up
7. clicked Save
8. confirmed file downloaded without additional warnings
9. cleared file
10. repeated steps 5-8

example	example	example	example	example	example

Safe Browsing enabled (Standard protection; default) - PASSED

Steps:

1. installed 1.53.83
2. launched Brave
3. confirmed Safe Browsing was set to Standard Protection in brave://settings/security
4. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
5. confirmed auto-download save-as-file location-picker dialog (!) came up
6. clicked Save
7. confirmed file downloaded without additional warnings
8. cleared file
9. repeated steps 4-7

Also tried with https://www.audacityteam.org/download/mac/ and https://mac.softpedia.com/get/System-Utilities/AppCleaner.shtml (and others, not pictured)

example	example	example	example	example	example	example	example

Blocked downloads

Blocked, Insecure - PASSED

Steps:

1. installed 1.53.84
2. launched Brave
3. loaded https://testsafebrowsing.appspot.com/
4. clicked on and saved https://testsafebrowsing.appspot.com/s/content.exe

Blocked, Dangerous - PASSED

Steps:

1. installed 1.53.84
2. launched Brave
3. loaded https://testsafebrowsing.appspot.com
4. clicked on and saved https://testsafebrowsing.appspot.com/s/badrep.exe

Blocked, Uncommon file - PASSED

Steps:

1. installed 1.53.84
2. launched Brave
3. opened https://testsafebrowsing.appspot.com
4. clicked on and saved https://testsafebrowsing.appspot.com/s/unknown.exe

Keep flow - PASSED

Keep dangerous file	Keep anyway	Downloaded file

Encountered:

• Download bubble doesn't open up when a file download is completed #30882

NOTE: I will retest the above scenarios in #30882 once it lands 👍

[stephendonner]

@simonhong mind reviewing my steps and results, from above, before I mark it as QA Pass-macOS? Maybe macOS and Windows have different ideas of what "dangerous files" are? I checked with 1.52.116 on macOS, and it behaves the same as above, in both cases, also 🤷

[simonhong]

@simonhong mind reviewing my steps and results, from above, before I mark it as QA Pass-macOS? Maybe macOS and Windows have different ideas of what "dangerous files" are? I checked with 1.52.116 on macOS, and it behaves the same as above, in both cases, also 🤷

Hmm, I also can't repro anymore. it's always treated as normal download file..
Not sure but could it be possible that this file link was danger but changed to safe now? :)
don't know much about how safe browsing works.

[stephendonner]

@simonhong mind reviewing my steps and results, from above, before I mark it as QA Pass-macOS? Maybe macOS and Windows have different ideas of what "dangerous files" are? I checked with 1.52.116 on macOS, and it behaves the same as above, in both cases, also 🤷

Hmm, I also can't repro anymore. it's always treated as normal download file.. Not sure but could it be possible that this file link was danger but changed to safe now? :) don't know much about how safe browsing works.

OK, I'll redo the Safe Browsing Enabled case using https://www.leaseweb.com/platform/network, then, as that triggers the dialog, I now recall:

EDIT: No, the above is for scheme-mismatch (i.e. HTTP vs. HTTPS-originated downloads) only, sorry.

So there are at least INSECURE and DANGEROUS-file-statuses.

[stephendonner]

@simonhong @rebron can you/the team take a look at #30626 when you get a chance? I keep running into it on both nightly and beta, when trying to test this issue and around the area, too. Thanks!

[simonhong]

@simonhong @rebron can you/the team take a look at #30626 when you get a chance? I keep running into it on both nightly and beta, when trying to test this issue and around the area, too. Thanks!

I'll take a look

[MadhaviSeelam]

Verification PASSED using

Brave | 1.53.82 Chromium: 114.0.5735.90 (Official Build) beta (64-bit)
-- | --
Revision | 386bc09e8f4f2e025eddae123f36f6263096ae49-refs/branch-heads/5735@{#1052}
OS | Windows 11 Version 22H2 (Build 22621.1702)

Case 1: Safe Browsing disabled - PASSED

1. installed 1.53.74
2. launched Brave
3. selected No Protection radio button for Safe Browsing in brave://settings/security
4. confirmed warning about Turn off Safe Browsing?
5. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
6. clicked Save in the Save-as Downloads dialog
7. confirmed download button is shown in the toolbar
8. clicked on download button
9. clicked Keep

• Confirmed download button shown for blocked/dangerous downloads
• Confirmed when clicked Keep button, warning message shown

step 4	step 4a	step 6	step 7	step 8	step 9	ex	ex

Continue from Case 1:

1. clicked x previous download in brave://downloads
2. repeated steps 5-8
3. clicked Discard /Delete
4. reload the https://www.majorgeeks.com/mg/get/fort_firewall,2.html
5. clicked Save

Confirmed download button is shown with warning bubble when clicked the button

ex	ex	ex

Safe Browsing enabled (Standard protection; default) - PASSED

Steps:

1. new profile
2. launched Brave
3. confirmed Safe Browsing was set to Standard Protection in brave://settings/security
4. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
5. clicked Save in the Save-as Downloads dialog
6. clicked Save
7. clicked on download button

Confirmed no additional warnings shown in the bubble and the file downloaded

ex	ex	ex

[stephendonner]

Verification PASSED using

Brave 1.53.87 Chromium: 114.0.5735.110 (Official Build) beta (64-bit) 
Revision 1c828682b85bbc70230a48f5e345489ec447373e-refs/branch-heads/5735_90@{#13}
OS Linux

Case 1: Safe Browsing disabled - PASSED

Steps:

1. installed 1.53.87
2. launched Brave
3. opened brave://settings/security
4. toggled Safe Browsing to No protection (not recommended)
5. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
6. waited for auto-download file-picker Save file as... dialog to appear
7. clicked on Save
8. confirmed file saved without warning dialogs

Step 4a	Step 4b	Step 5	Step 6	Step 7	Step 8

Case 2: Safe Browsing enabled - PASSED

Steps:

1. installed 1.53.87
2. launched Brave
3. confirmed default Safe Browsing pref is set to Standard protection
4. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
5. waited for auto-download file-picker Save file as... dialog to appear
6. clicked on Save
7. confirmed file saved without warning dialogs

Step 3	Step 4	Step 5	Step 6	Step 7

Case 3: Uncommon/malicious file - PASSED

Steps:

1. installed 1.53.87
2. launched Brave
3. loaded https://testsafebrowsing.appspot.com/
4. context-clicked on https://testsafebrowsing.appspot.com/s/bad_app_file_on_scan.exe
5. clicked Save
6. confirmed file-download animation, highlighting the Downloads bubble/button, which has now changed to a down arrow with blue highlight
7. clicked on the above
8. confirmed file-download status is Blocked - uncommon file
9. clicked on Continue download
10. waited for download to finish, and examined its state

Confirmed I got the auto-download popup, the bubble opened when clicked on, showed successful "blocked" state, and I was able to Continue download to completion

Step 3	Step 5	Step 6	Step 7	Steps 8-9	Step 10

---

Note: Comparison to 1.51.114

1.53.87	1.51.114

Encountered:

• Download bubble doesn't open up when a file download is completed #30882

[kjozwiak]

The above requires 1.52.130 or higher for 1.52.x verification 👍 Removing the QA Pass labels as the above will need to be rechecked with 1.52.x.

[LaurenWags]

Verified with

Brave | 1.52.130 Chromium: 114.0.5735.198 (Official Build) (x86_64)
-- | --
Revision | c3029382d11c5f499e4fc317353a43d411a5ce1c-refs/branch-heads/5735@{#1394}
OS | macOS Version 13.4.1 (Build 22F82)

Safe Browsing disabled - PASSED

Steps:

1. installed 1.52.130
2. launched Brave
3. toggled Safe Browsing to No Protection in brave://settings/security
4. confirmed warning about disabling Safe Browsing
5. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
6. confirmed auto-download save-as-file location-picker dialog (!) came up
7. clicked Save
8. confirmed file downloaded without additional warnings
9. cleared file
10. repeated steps 5-8

example	example	example	example

Safe Browsing enabled (Standard protection; default) - PASSED

Steps:

1. installed 1.52.130
2. launched Brave, waited ~8 minutes and confirmed Safe Browsing was downloaded before proceeding with the rest of the steps
3. confirmed Safe Browsing was set to Standard Protection in brave://settings/security
4. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
5. confirmed auto-download save-as-file location-picker dialog (!) came up
6. clicked Save
7. confirmed file downloaded without additional warnings
8. cleared file
9. repeated steps 4-7

Also tried with https://www.audacityteam.org/download/mac/

example	example	example	example

Blocked downloads

Blocked, Dangerous - PASSED

Steps:

1. installed 1.52.130
2. launched Brave, waited ~8 min and confirmed Safe Browsing was downloaded before proceeding
3. loaded https://testsafebrowsing.appspot.com/
4. clicked on and saved https://testsafebrowsing.appspot.com/s/content.exe

Example	Example

Blocked, Uncommon file - PASSED

Steps:

1. installed 1.52.130
2. launched Brave, waited ~8 min and confirmed Safe Browsing was downloaded before proceeding
3. opened https://testsafebrowsing.appspot.com
4. clicked on and saved https://testsafebrowsing.appspot.com/s/unknown.exe

Example	Example

Keep flow - PASSED

Keep dangerous file	Keep anyway	Downloaded file

[MadhaviSeelam]

Verification PASSED using

Brave | 1.52.130 Chromium: 114.0.5735.198 (Official Build) (64-bit)
-- | --
Revision | c3029382d11c5f499e4fc317353a43d411a5ce1c-refs/branch-heads/5735@{#1394}
OS | Linux

Safe Browsing disabled - PASSED

Steps:

1. installed 1.52.130
2. launched Brave
3. toggled Safe Browsing to No Protection in brave://settings/security
4. confirmed warning about disabling Safe Browsing
5. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
6. confirmed auto-download save-as-file location-picker dialog (!) came up
7. clicked Save
8. confirmed file downloaded without additional warnings
9. cleared file
10. repeated steps 5-8

example	example	example	example	example	example

Safe Browsing enabled (Standard protection; default) - PASSED

Steps:

1. installed 1.52.130
2. launched Brave, waited ~8 minutes and confirmed Safe Browsing was downloaded before proceeding with the rest of the steps
3. confirmed Safe Browsing was set to Standard Protection in brave://settings/security
4. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
5. confirmed auto-download save-as-file location-picker dialog (!) came up
6. clicked Save
7. confirmed file downloaded without additional warnings
8. cleared file
9. repeated steps 4-7

example	example	example	example	example

Blocked downloads

Blocked, Dangerous - PASSED

Steps:

1. installed 1.52.130
2. launched Brave, waited ~8 min and confirmed Safe Browsing was downloaded before proceeding
3. loaded https://testsafebrowsing.appspot.com/
4. clicked on and saved https://testsafebrowsing.appspot.com/s/content.exe

Example	Example

Blocked, Uncommon file - PASSED

Steps:

1. installed 1.52.130
2. launched Brave, waited ~8 min and confirmed Safe Browsing was downloaded before proceeding
3. opened https://testsafebrowsing.appspot.com
4. clicked on and saved https://testsafebrowsing.appspot.com/s/unknown.exe

Example	Example

Keep flow - PASSED

Keep dangerous file	Keep anyway	Downloaded file

[stephendonner]

Verification PASSED using

Brave	1.52.130 Chromium: 114.0.5735.198 (Official Build) (64-bit) 
Revision	c3029382d11c5f499e4fc317353a43d411a5ce1c-refs/branch-heads/5735@{#1394}
OS	Windows 10 Version 22H2 (Build 19045.3155)

Safe Browsing disabled - PASSED

Steps:

1. installed 1.52.130
2. launched Brave
3. toggled Safe Browsing to No Protection in brave://settings/security
4. confirmed warning about disabling Safe Browsing
5. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
6. confirmed file picker dialog automatically came up
7. clicked Save
8. confirmed file downloaded without additional warnings
9. cleared file
10. repeated steps 5-8

example	example	example	example

Safe Browsing enabled (Standard protection; default) - PASSED

Steps:

1. installed 1.52.130
2. launched Brave
3. waited ~8 minutes and confirmed Safe Browsing downloaded
4. loaded https://www.majorgeeks.com/mg/get/fort_firewall,2.html
5. confirmed auto-download file-picker dialog came up
6. clicked Save
7. confirmed file download without additional warnings
8. cleared file
9. repeated steps 4-7

example	example	example	example

Blocked downloads

Blocked, dangerous - PASSED

Steps:

1. installed 1.52.130
2. launched Brave, waited ~8 min and confirmed Safe Browsing was downloaded before proceeding
3. loaded https://testsafebrowsing.appspot.com/
4. clicked on and saved https://testsafebrowsing.appspot.com/s/content.exe

example	example

Blocked, Uncommon file - PASSED

Steps:

1. installed 1.52.130
2. launched Brave, waited ~8 min and confirmed Safe Browsing was downloaded before proceeding
3. opened https://testsafebrowsing.appspot.com
4. clicked on and saved https://testsafebrowsing.appspot.com/s/unknown.exe

example	example

Keep flow - PASSED

Blocked - dangerous	Keep dangerous file / Keep anyway	Downloaded file