Add additional granularity to DownloadRestrictions

Change-Id: I3198507a82e15e8c4bcb51a3a3c5966b4184d6f5

Bug: 929943
Change-Id: I3198507a82e15e8c4bcb51a3a3c5966b4184d6f5
Reviewed-on: https://chromium-review.googlesource.com/c/1413396Reviewed-by: Varun Khaneja <vakh@chromium.org>
Reviewed-by: David Trainor <dtrainor@chromium.org>
Commit-Queue: Kyle Spiers <ksspiers@google.com>
Cr-Commit-Position: refs/heads/master@{#631954}

chrome/browser/download/chrome_download_manager_delegate.cc

@@ -1329,6 +1329,12 @@ bool ChromeDownloadManagerDelegate::ShouldBlockFile(
               danger_type == download::DOWNLOAD_DANGER_TYPE_DANGEROUS_URL);
     }
 
+    case (DownloadPrefs::DownloadRestriction::MALICIOUS_FILES): {
+      return (danger_type == download::DOWNLOAD_DANGER_TYPE_DANGEROUS_CONTENT ||
+              danger_type == download::DOWNLOAD_DANGER_TYPE_DANGEROUS_HOST ||
+              danger_type == download::DOWNLOAD_DANGER_TYPE_DANGEROUS_URL);
+    }
+
     case (DownloadPrefs::DownloadRestriction::ALL_FILES):
       return true;
 

chrome/browser/download/chrome_download_manager_delegate_unittest.cc

@@ -936,6 +936,15 @@ const SafeBrowsingTestParameters kSafeBrowsingTestCases[] = {
      download::DOWNLOAD_DANGER_TYPE_DANGEROUS_FILE,
      /*blocked=*/true},
 
+    // UNKNOWN verdict for a potentially dangerous file not blocked by policy.
+    {download::DOWNLOAD_DANGER_TYPE_MAYBE_DANGEROUS_CONTENT,
+     DownloadFileType::ALLOW_ON_USER_GESTURE,
+     safe_browsing::DownloadCheckResult::UNKNOWN,
+     DownloadPrefs::DownloadRestriction::MALICIOUS_FILES,
+
+     download::DOWNLOAD_DANGER_TYPE_DANGEROUS_FILE,
+     /*blocked=*/false},
+
     // DANGEROUS verdict for a potentially dangerous file.
     {download::DOWNLOAD_DANGER_TYPE_MAYBE_DANGEROUS_CONTENT,
      DownloadFileType::ALLOW_ON_USER_GESTURE,
@@ -945,6 +954,33 @@ const SafeBrowsingTestParameters kSafeBrowsingTestCases[] = {
      download::DOWNLOAD_DANGER_TYPE_DANGEROUS_CONTENT,
      /*blocked=*/false},
 
+    // DANGEROUS verdict for a potentially dangerous file block by policy.
+    {download::DOWNLOAD_DANGER_TYPE_MAYBE_DANGEROUS_CONTENT,
+     DownloadFileType::ALLOW_ON_USER_GESTURE,
+     safe_browsing::DownloadCheckResult::DANGEROUS,
+     DownloadPrefs::DownloadRestriction::MALICIOUS_FILES,
+
+     download::DOWNLOAD_DANGER_TYPE_DANGEROUS_CONTENT,
+     /*blocked=*/true},
+
+    // DANGEROUS verdict for a potentially dangerous file block by policy.
+    {download::DOWNLOAD_DANGER_TYPE_MAYBE_DANGEROUS_CONTENT,
+     DownloadFileType::ALLOW_ON_USER_GESTURE,
+     safe_browsing::DownloadCheckResult::DANGEROUS,
+     DownloadPrefs::DownloadRestriction::MALICIOUS_FILES,
+
+     download::DOWNLOAD_DANGER_TYPE_DANGEROUS_HOST,
+     /*blocked=*/true},
+
+    // DANGEROUS verdict for a potentially dangerous file block by policy.
+    {download::DOWNLOAD_DANGER_TYPE_MAYBE_DANGEROUS_CONTENT,
+     DownloadFileType::ALLOW_ON_USER_GESTURE,
+     safe_browsing::DownloadCheckResult::DANGEROUS,
+     DownloadPrefs::DownloadRestriction::MALICIOUS_FILES,
+
+     download::DOWNLOAD_DANGER_TYPE_DANGEROUS_URL,
+     /*blocked=*/true},
+
     // UNCOMMON verdict for a potentially dangerous file.
     {download::DOWNLOAD_DANGER_TYPE_MAYBE_DANGEROUS_CONTENT,
      DownloadFileType::ALLOW_ON_USER_GESTURE,
@@ -983,6 +1019,16 @@ const SafeBrowsingTestParameters kSafeBrowsingTestCases[] = {
      download::DOWNLOAD_DANGER_TYPE_POTENTIALLY_UNWANTED,
      /*blocked=*/false},
 
+    // POTENTIALLY_UNWANTED verdict for a potentially dangerous file, not
+    // blocked by policy.
+    {download::DOWNLOAD_DANGER_TYPE_MAYBE_DANGEROUS_CONTENT,
+     DownloadFileType::ALLOW_ON_USER_GESTURE,
+     safe_browsing::DownloadCheckResult::POTENTIALLY_UNWANTED,
+     DownloadPrefs::DownloadRestriction::MALICIOUS_FILES,
+
+     download::DOWNLOAD_DANGER_TYPE_POTENTIALLY_UNWANTED,
+     /*blocked=*/false},
+
     // SAFE verdict for a dangerous file.
     {download::DOWNLOAD_DANGER_TYPE_MAYBE_DANGEROUS_CONTENT,
      DownloadFileType::DANGEROUS, safe_browsing::DownloadCheckResult::SAFE,

chrome/browser/download/download_prefs.h

@@ -37,6 +37,9 @@ class DownloadPrefs {
     DANGEROUS_FILES = 1,
     POTENTIALLY_DANGEROUS_FILES = 2,
     ALL_FILES = 3,
+    // MALICIOUS_FILES has a stricter definition of harmful file than
+    // DANGEROUS_FILES and does not block based on file extension.
+    MALICIOUS_FILES = 4,
   };
   explicit DownloadPrefs(Profile* profile);
   ~DownloadPrefs();

chrome/common/pref_names.cc

@@ -48,6 +48,7 @@ const char kDisableScreenshots[] = "disable_screenshots";
 // 1 - Block dangerous downloads
 // 2 - Block potentially dangerous downloads
 // 3 - Block all downloads
+// 4 - Block malicious downloads
 const char kDownloadRestrictions[] = "download_restrictions";
 
 // If set to true profiles are created in ephemeral mode and do not store their