Skip to content

Commit

Permalink
Privacy Sandbox: Check HasCommitted in helper
Browse files Browse the repository at this point in the history
When responding to navigations, the Privacy Sandbox Dialog Helper did
not check that the navigation had actually committed. This potentially
results in accessing invalid state from the NavigationHandle.

(cherry picked from commit 5b4c37b)

Bug: 1316457
Change-Id: Ibb9b6736f9054a73178303475debdd5f51037096
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3593193
Reviewed-by: Martin Šrámek <msramek@chromium.org>
Commit-Queue: Theodore Olsauskas-Warren <sauski@google.com>
Cr-Original-Commit-Position: refs/heads/main@{#993642}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3595985
Auto-Submit: Theodore Olsauskas-Warren <sauski@google.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/5005@{#46}
Cr-Branched-From: 5b4d945-refs/heads/main@{#992738}
  • Loading branch information
sauski-alternative authored and Chromium LUCI CQ committed Apr 20, 2022
1 parent dd500c1 commit c5a32d9
Showing 1 changed file with 3 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,10 @@ void PrivacySandboxDialogHelper::DidFinishNavigation(
return;

// Only valid top frame navigations are considered.
if (!navigation_handle || !navigation_handle->IsInPrimaryMainFrame())
if (!navigation_handle || !navigation_handle->HasCommitted() ||
!navigation_handle->IsInPrimaryMainFrame()) {
return;
}

// Check whether the navigation target is a suitable dialog location. The
// navigation URL, rather than the visible or committed URL, is required to
Expand Down

0 comments on commit c5a32d9

Please sign in to comment.