Add Clipboard DLP controller

Added Clipboard data leak prevention controller
to be used on Chrome OS on every clipboard read
to validate whether it's allowed.

Bug: 1096458
Change-Id: Ibf5441dc80ecc82e46fc20b68053b697a1920d39
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2275445
Commit-Queue: Aya Elsayed <ayaelattar@google.com>
Reviewed-by: Scott Violet <sky@chromium.org>
Reviewed-by: Nikita Podguzov <nikitapodguzov@chromium.org>
Reviewed-by: Darwin Huang <huangdarwin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#788550}

headless/lib/browser/headless_clipboard.cc

@@ -24,6 +24,11 @@ uint64_t HeadlessClipboard::GetSequenceNumber(
   return GetStore(buffer).sequence_number;
 }
 
+void HeadlessClipboard::SetClipboardDlpController(
+    std::unique_ptr<ui::ClipboardDlpController> dlp_controller) {
+  NOTIMPLEMENTED();
+}
+
 // |data_dst| is not used. It's only passed to be consistent with other
 // platforms.
 bool HeadlessClipboard::IsFormatAvailable(

headless/lib/browser/headless_clipboard.h

@@ -26,6 +26,8 @@ class HeadlessClipboard : public ui::Clipboard {
   // Clipboard overrides.
   void OnPreShutdown() override;
   uint64_t GetSequenceNumber(ui::ClipboardBuffer buffer) const override;
+  void SetClipboardDlpController(
+      std::unique_ptr<ui::ClipboardDlpController> dlp_controller) override;
   bool IsFormatAvailable(
       const ui::ClipboardFormatType& format,
       ui::ClipboardBuffer buffer,

ui/base/clipboard/BUILD.gn

@@ -67,6 +67,7 @@ jumbo_component("clipboard") {
     "clipboard.h",
     "clipboard_data_endpoint.cc",
     "clipboard_data_endpoint.h",
+    "clipboard_dlp_controller.h",
     "clipboard_metrics.cc",
     "clipboard_metrics.h",
     "clipboard_monitor.cc",

ui/base/clipboard/clipboard.h

@@ -27,6 +27,7 @@
 #include "build/build_config.h"
 #include "mojo/public/cpp/base/big_buffer.h"
 #include "ui/base/clipboard/clipboard_buffer.h"
+#include "ui/base/clipboard/clipboard_dlp_controller.h"
 #include "ui/base/clipboard/clipboard_format_type.h"
 
 class SkBitmap;
@@ -107,6 +108,11 @@ class COMPONENT_EXPORT(UI_BASE_CLIPBOARD) Clipboard
   // whether it has changed.
   virtual uint64_t GetSequenceNumber(ClipboardBuffer buffer) const = 0;
 
+  // Sets the data leak prevention controller for the clipboard. This function
+  // will be used only on Chrome OS.
+  virtual void SetClipboardDlpController(
+      std::unique_ptr<ClipboardDlpController> dlp_controller) = 0;
+
   // Tests whether the clipboard contains a certain format.
   // TODO(crbug.com/1103614): Update |data_dst| in all references to its
   // appropriate ClipboardDataEndpoint for web-originates uses.

ui/base/clipboard/clipboard_android.cc

@@ -366,6 +366,11 @@ uint64_t ClipboardAndroid::GetSequenceNumber(
   return g_map.Get().GetSequenceNumber();
 }
 
+void ClipboardAndroid::SetClipboardDlpController(
+    std::unique_ptr<ClipboardDlpController> dlp_controller) {
+  NOTIMPLEMENTED();
+}
+
 // |data_dst| is not used. It's only passed to be consistent with other
 // platforms.
 bool ClipboardAndroid::IsFormatAvailable(

ui/base/clipboard/clipboard_android.h

@@ -59,6 +59,8 @@ class ClipboardAndroid : public Clipboard {
   // Clipboard overrides:
   void OnPreShutdown() override;
   uint64_t GetSequenceNumber(ClipboardBuffer buffer) const override;
+  void SetClipboardDlpController(
+      std::unique_ptr<ClipboardDlpController> dlp_controller) override;
   bool IsFormatAvailable(const ClipboardFormatType& format,
                          ClipboardBuffer buffer,
                          const ClipboardDataEndpoint* data_dst) const override;

ui/base/clipboard/clipboard_dlp_controller.h

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef UI_BASE_CLIPBOARD_CLIPBOARD_DLP_CONTROLLER_H_
+#define UI_BASE_CLIPBOARD_CLIPBOARD_DLP_CONTROLLER_H_
+
+#include "ui/base/clipboard/clipboard_data_endpoint.h"
+
+namespace ui {
+
+// The Clipboard Data Leak Prevention controller is used to control clipboard
+// read operations. It should allow/disallow clipboard data read given the
+// source of the data and the destination trying to access the data and a set of
+// rules controlling these source and destination.
+class ClipboardDlpController {
+ public:
+  ClipboardDlpController() = default;
+  virtual ~ClipboardDlpController() = default;
+
+  virtual bool IsDataReadAllowed(
+      const ClipboardDataEndpoint* const data_src,
+      const ClipboardDataEndpoint* const data_dst) const = 0;
+};
+
+}  // namespace ui
+
+#endif  // UI_BASE_CLIPBOARD_CLIPBOARD_DLP_CONTROLLER_H_

ui/base/clipboard/clipboard_mac.h

@@ -31,6 +31,8 @@ class COMPONENT_EXPORT(UI_BASE_CLIPBOARD) ClipboardMac : public Clipboard {
   // Clipboard overrides:
   void OnPreShutdown() override;
   uint64_t GetSequenceNumber(ClipboardBuffer buffer) const override;
+  void SetClipboardDlpController(
+      std::unique_ptr<ClipboardDlpController> dlp_controller) override;
   bool IsFormatAvailable(const ClipboardFormatType& format,
                          ClipboardBuffer buffer,
                          const ClipboardDataEndpoint* data_dst) const override;

ui/base/clipboard/clipboard_mac.mm

@@ -70,6 +70,11 @@ uint64_t ClipboardMac::GetSequenceNumber(ClipboardBuffer buffer) const {
   return [pb changeCount];
 }
 
+void ClipboardMac::SetClipboardDlpController(
+    std::unique_ptr<ClipboardDlpController> dlp_controller) {
+  NOTIMPLEMENTED();
+}
+
 // |data_dst| is not used. It's only passed to be consistent with other
 // platforms.
 bool ClipboardMac::IsFormatAvailable(

ui/base/clipboard/clipboard_non_backed.cc

@@ -23,6 +23,7 @@
 #include "ui/base/clipboard/clipboard_constants.h"
 #include "ui/base/clipboard/clipboard_data.h"
 #include "ui/base/clipboard/clipboard_data_endpoint.h"
+#include "ui/base/clipboard/clipboard_dlp_controller.h"
 #include "ui/base/clipboard/clipboard_format_type.h"
 #include "ui/base/clipboard/clipboard_metrics.h"
 #include "ui/base/clipboard/clipboard_monitor.h"
@@ -188,6 +189,17 @@ class ClipboardInternal {
     ClipboardMonitor::GetInstance()->NotifyClipboardDataChanged();
   }
 
+  void SetDlpController(
+      std::unique_ptr<ClipboardDlpController> dlp_controller) {
+    dlp_controller_ = std::move(dlp_controller);
+  }
+
+  bool IsReadAllowed(const ClipboardDataEndpoint* data_dst) const {
+    if (!dlp_controller_)
+      return true;
+    return dlp_controller_->IsDataReadAllowed(GetData()->source(), data_dst);
+  }
+
  private:
   // True if the data on top of the clipboard stack has format |format|.
   bool HasFormat(ClipboardInternalFormat format) const {
@@ -213,6 +225,9 @@ class ClipboardInternal {
   // Sequence number uniquely identifying clipboard state.
   uint64_t sequence_number_ = 0;
 
+  // Data-leak prevention controller controlling clipboard read operations.
+  std::unique_ptr<ClipboardDlpController> dlp_controller_ = nullptr;
+
   DISALLOW_COPY_AND_ASSIGN(ClipboardInternal);
 };
 
@@ -314,6 +329,11 @@ ClipboardNonBacked::~ClipboardNonBacked() {
 
 void ClipboardNonBacked::OnPreShutdown() {}
 
+void ClipboardNonBacked::SetClipboardDlpController(
+    std::unique_ptr<ClipboardDlpController> dlp_controller) {
+  clipboard_internal_->SetDlpController(std::move(dlp_controller));
+}
+
 uint64_t ClipboardNonBacked::GetSequenceNumber(ClipboardBuffer buffer) const {
   DCHECK(CalledOnValidThread());
   return clipboard_internal_->sequence_number();
@@ -325,6 +345,10 @@ bool ClipboardNonBacked::IsFormatAvailable(
     const ClipboardDataEndpoint* data_dst) const {
   DCHECK(CalledOnValidThread());
   DCHECK(IsSupportedClipboardBuffer(buffer));
+
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return false;
+
   if (ClipboardFormatType::GetPlainTextType().Equals(format) ||
       ClipboardFormatType::GetUrlType().Equals(format))
     return clipboard_internal_->IsFormatAvailable(
@@ -358,6 +382,9 @@ void ClipboardNonBacked::ReadAvailableTypes(
   DCHECK(CalledOnValidThread());
   DCHECK(types);
 
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return;
+
   types->clear();
   if (IsFormatAvailable(ClipboardFormatType::GetPlainTextType(), buffer,
                         data_dst))
@@ -389,6 +416,9 @@ ClipboardNonBacked::ReadAvailablePlatformSpecificFormatNames(
 
   std::vector<base::string16> types;
 
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return types;
+
   // Includes all non-pickled AvailableTypes.
   if (IsFormatAvailable(ClipboardFormatType::GetPlainTextType(), buffer,
                         data_dst)) {
@@ -415,6 +445,10 @@ void ClipboardNonBacked::ReadText(ClipboardBuffer buffer,
                                   const ClipboardDataEndpoint* data_dst,
                                   base::string16* result) const {
   DCHECK(CalledOnValidThread());
+
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return;
+
   RecordRead(ClipboardFormatMetric::kText);
   clipboard_internal_->ReadText(result);
 }
@@ -423,6 +457,10 @@ void ClipboardNonBacked::ReadAsciiText(ClipboardBuffer buffer,
                                        const ClipboardDataEndpoint* data_dst,
                                        std::string* result) const {
   DCHECK(CalledOnValidThread());
+
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return;
+
   RecordRead(ClipboardFormatMetric::kText);
   clipboard_internal_->ReadAsciiText(result);
 }
@@ -434,6 +472,10 @@ void ClipboardNonBacked::ReadHTML(ClipboardBuffer buffer,
                                   uint32_t* fragment_start,
                                   uint32_t* fragment_end) const {
   DCHECK(CalledOnValidThread());
+
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return;
+
   RecordRead(ClipboardFormatMetric::kHtml);
   clipboard_internal_->ReadHTML(markup, src_url, fragment_start, fragment_end);
 }
@@ -442,6 +484,10 @@ void ClipboardNonBacked::ReadRTF(ClipboardBuffer buffer,
                                  const ClipboardDataEndpoint* data_dst,
                                  std::string* result) const {
   DCHECK(CalledOnValidThread());
+
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return;
+
   RecordRead(ClipboardFormatMetric::kRtf);
   clipboard_internal_->ReadRTF(result);
 }
@@ -450,6 +496,10 @@ void ClipboardNonBacked::ReadImage(ClipboardBuffer buffer,
                                    const ClipboardDataEndpoint* data_dst,
                                    ReadImageCallback callback) const {
   DCHECK(CalledOnValidThread());
+
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return;
+
   RecordRead(ClipboardFormatMetric::kImage);
   std::move(callback).Run(clipboard_internal_->ReadImage());
 }
@@ -459,6 +509,10 @@ void ClipboardNonBacked::ReadCustomData(ClipboardBuffer buffer,
                                         const ClipboardDataEndpoint* data_dst,
                                         base::string16* result) const {
   DCHECK(CalledOnValidThread());
+
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return;
+
   RecordRead(ClipboardFormatMetric::kCustomData);
   clipboard_internal_->ReadCustomData(type, result);
 }
@@ -467,6 +521,10 @@ void ClipboardNonBacked::ReadBookmark(const ClipboardDataEndpoint* data_dst,
                                       base::string16* title,
                                       std::string* url) const {
   DCHECK(CalledOnValidThread());
+
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return;
+
   RecordRead(ClipboardFormatMetric::kBookmark);
   clipboard_internal_->ReadBookmark(title, url);
 }
@@ -475,6 +533,10 @@ void ClipboardNonBacked::ReadData(const ClipboardFormatType& format,
                                   const ClipboardDataEndpoint* data_dst,
                                   std::string* result) const {
   DCHECK(CalledOnValidThread());
+
+  if (!clipboard_internal_->IsReadAllowed(data_dst))
+    return;
+
   RecordRead(ClipboardFormatMetric::kData);
   clipboard_internal_->ReadData(format.GetName(), result);
 }

ui/base/clipboard/clipboard_non_backed.h

@@ -29,6 +29,8 @@ class ClipboardNonBacked : public Clipboard {
 
   // Clipboard overrides:
   void OnPreShutdown() override;
+  void SetClipboardDlpController(
+      std::unique_ptr<ClipboardDlpController> dlp_controller) override;
   uint64_t GetSequenceNumber(ClipboardBuffer buffer) const override;
   bool IsFormatAvailable(const ClipboardFormatType& format,
                          ClipboardBuffer buffer,

ui/base/clipboard/clipboard_ozone.cc

@@ -337,6 +337,12 @@ uint64_t ClipboardOzone::GetSequenceNumber(ClipboardBuffer buffer) const {
   return async_clipboard_ozone_->GetSequenceNumber(buffer);
 }
 
+// TODO(crbug.com/1103194): Setting |dlp_controller| should be supported.
+void ClipboardOzone::SetClipboardDlpController(
+    std::unique_ptr<ClipboardDlpController> dlp_controller) {
+  NOTIMPLEMENTED();
+}
+
 // TODO(crbug.com/1103194): |data_dst| should be supported.
 bool ClipboardOzone::IsFormatAvailable(
     const ClipboardFormatType& format,

ui/base/clipboard/clipboard_ozone.h

@@ -26,6 +26,8 @@ class ClipboardOzone : public Clipboard {
   // Clipboard overrides:
   void OnPreShutdown() override;
   uint64_t GetSequenceNumber(ClipboardBuffer buffer) const override;
+  void SetClipboardDlpController(
+      std::unique_ptr<ClipboardDlpController> dlp_controller) override;
   bool IsFormatAvailable(const ClipboardFormatType& format,
                          ClipboardBuffer buffer,
                          const ClipboardDataEndpoint* data_dst) const override;

ui/base/clipboard/clipboard_win.cc

@@ -246,6 +246,11 @@ uint64_t ClipboardWin::GetSequenceNumber(ClipboardBuffer buffer) const {
   return ::GetClipboardSequenceNumber();
 }
 
+void ClipboardWin::SetClipboardDlpController(
+    std::unique_ptr<ClipboardDlpController> dlp_controller) {
+  NOTIMPLEMENTED();
+}
+
 // |data_dst| is not used. It's only passed to be consistent with other
 // platforms.
 bool ClipboardWin::IsFormatAvailable(

ui/base/clipboard/clipboard_win.h

@@ -36,6 +36,8 @@ class ClipboardWin : public Clipboard {
   // Clipboard overrides:
   void OnPreShutdown() override;
   uint64_t GetSequenceNumber(ClipboardBuffer buffer) const override;
+  void SetClipboardDlpController(
+      std::unique_ptr<ClipboardDlpController> dlp_controller) override;
   bool IsFormatAvailable(const ClipboardFormatType& format,
                          ClipboardBuffer buffer,
                          const ClipboardDataEndpoint* data_dst) const override;

ui/base/clipboard/clipboard_x11.cc

@@ -498,6 +498,11 @@ uint64_t ClipboardX11::GetSequenceNumber(ClipboardBuffer buffer) const {
     return SelectionChangeObserver::GetInstance()->primary_sequence_number();
 }
 
+void ClipboardX11::SetClipboardDlpController(
+    std::unique_ptr<ClipboardDlpController> dlp_controller) {
+  NOTIMPLEMENTED();
+}
+
 // |data_dst| is not used. It's only passed to be consistent with other
 // platforms.
 bool ClipboardX11::IsFormatAvailable(

ui/base/clipboard/clipboard_x11.h

@@ -25,6 +25,8 @@ class ClipboardX11 : public Clipboard {
   // Clipboard overrides:
   void OnPreShutdown() override;
   uint64_t GetSequenceNumber(ClipboardBuffer buffer) const override;
+  void SetClipboardDlpController(
+      std::unique_ptr<ClipboardDlpController> dlp_controller) override;
   bool IsFormatAvailable(const ClipboardFormatType& format,
                          ClipboardBuffer buffer,
                          const ClipboardDataEndpoint* data_dst) const override;

ui/base/clipboard/test/test_clipboard.cc

@@ -39,6 +39,10 @@ uint64_t TestClipboard::GetSequenceNumber(ClipboardBuffer buffer) const {
   return GetStore(buffer).sequence_number;
 }
 
+// TODO(crbug.com/1103215): Setting |dlp_controller| should be supported.
+void TestClipboard::SetClipboardDlpController(
+    std::unique_ptr<ClipboardDlpController> dlp_controller) {}
+
 // TODO(crbug.com/1103215): |data_dst| should be supported.
 bool TestClipboard::IsFormatAvailable(
     const ClipboardFormatType& format,

ui/base/clipboard/test/test_clipboard.h

@@ -35,6 +35,8 @@ class TestClipboard : public Clipboard {
   // Clipboard overrides.
   void OnPreShutdown() override;
   uint64_t GetSequenceNumber(ClipboardBuffer buffer) const override;
+  void SetClipboardDlpController(
+      std::unique_ptr<ClipboardDlpController> dlp_controller) override;
   bool IsFormatAvailable(const ClipboardFormatType& format,
                          ClipboardBuffer buffer,
                          const ClipboardDataEndpoint* data_dst) const override;