Tracing: Make anonymization filtering during JSON serialization explicit

Moved the option to anonymize the trace data from the TraceConfig struct to
the Mojo Consumer::DisableTracingAndEmitJson API, to allow
filtering/whitelisting of tracing data to be done during JSON
serialization time rather than writing time. This is a step towards
deprecating the support for uploading JSON trace data with specific
fields white-listed, rather than using strongly typed logs protos.

Already LGTM'ed then split out from (and a prerequisite of)
https://chromium-review.googlesource.com/c/chromium/src/+/1817207

TBR=ssid@chromium

Bug: 839086
Change-Id: I50eb874252d201da5dc2ccbd878eb449cd0cc80a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1832934Reviewed-by: oysteine <oysteine@chromium.org>
Reviewed-by: Eric Seckler <eseckler@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: oysteine <oysteine@chromium.org>
Cr-Commit-Position: refs/heads/master@{#702079}

components/ui_devtools/tracing_agent.cc

@@ -160,6 +160,7 @@ class TracingAgent::PerfettoTracingSession
         this, std::move(consumer_handle));
     tracing_session_host_->DisableTracingAndEmitJson(
         agent_label_, std::move(producer_handle),
+        /*privacy_filtering_enabled=*/false,
         base::BindOnce(&PerfettoTracingSession::OnReadBuffersComplete,
                        base::Unretained(this)));
   }

content/browser/devtools/protocol/tracing_handler.cc

@@ -344,6 +344,7 @@ class TracingHandler::PerfettoTracingSession
           this, std::move(consumer_handle));
       tracing_session_host_->DisableTracingAndEmitJson(
           agent_label_, std::move(producer_handle),
+          /*privacy_filtering_enabled=*/false,
           base::BindOnce(&PerfettoTracingSession::OnReadBuffersComplete,
                          base::Unretained(this)));
     } else {

services/tracing/perfetto/consumer_host.cc

@@ -343,6 +343,7 @@ void ConsumerHost::TracingSession::RequestBufferUsage(
 void ConsumerHost::TracingSession::DisableTracingAndEmitJson(
     const std::string& agent_label_filter,
     mojo::ScopedDataPipeProducerHandle stream,
+    bool privacy_filtering_enabled,
     DisableTracingAndEmitJsonCallback callback) {
   DCHECK(!read_buffers_stream_writer_);
 
@@ -367,7 +368,11 @@ void ConsumerHost::TracingSession::DisableTracingAndEmitJson(
 
   JSONTraceExporter::ArgumentFilterPredicate arg_filter_predicate;
   JSONTraceExporter::MetadataFilterPredicate metadata_filter_predicate;
-  if (privacy_filtering_enabled_) {
+  if (privacy_filtering_enabled) {
+    // For filtering/whitelisting to be possible at JSON export time,
+    // filtering must not have been enabled during proto emission time
+    // (or there's nothing to pass through the whitelist).
+    DCHECK(!privacy_filtering_enabled_);
     auto* trace_log = base::trace_event::TraceLog::GetInstance();
     arg_filter_predicate = trace_log->GetArgumentFilterPredicate();
     metadata_filter_predicate = trace_log->GetMetadataFilterPredicate();

services/tracing/perfetto/consumer_host.h

@@ -6,6 +6,8 @@
 #define SERVICES_TRACING_PERFETTO_CONSUMER_HOST_H_
 
 #include <memory>
+#include <set>
+#include <string>
 #include <vector>
 
 #include "base/callback.h"
@@ -76,6 +78,7 @@ class ConsumerHost : public perfetto::Consumer, public mojom::ConsumerHost {
     void DisableTracingAndEmitJson(
         const std::string& agent_label_filter,
         mojo::ScopedDataPipeProducerHandle stream,
+        bool privacy_filtering_enabled,
         DisableTracingAndEmitJsonCallback callback) override;
 
    private:

services/tracing/perfetto/consumer_host_unittest.cc

@@ -178,15 +178,16 @@ class ThreadedPerfettoService : public mojom::TracingSessionClient {
 
   void DisableTracingAndEmitJson(
       mojo::ScopedDataPipeProducerHandle stream,
-      ConsumerHost::TracingSession::DisableTracingAndEmitJsonCallback
-          callback) {
+      ConsumerHost::TracingSession::DisableTracingAndEmitJsonCallback callback,
+      bool enable_privacy_filtering) {
     base::RunLoop wait_for_call;
     task_runner_->PostTaskAndReply(
         FROM_HERE,
         base::BindOnce(
             &ConsumerHost::TracingSession::DisableTracingAndEmitJson,
             base::Unretained(consumer_.get()->tracing_session_for_testing()),
-            std::string(), std::move(stream), std::move(callback)),
+            std::string(), std::move(stream), enable_privacy_filtering,
+            std::move(callback)),
         wait_for_call.QuitClosure());
     wait_for_call.Run();
   }
@@ -358,7 +359,8 @@ class TracingConsumerTest : public testing::Test,
     drainer_.reset(new mojo::DataPipeDrainer(this, std::move(consumer)));
   }
 
-  void DisableTracingAndEmitJson(base::OnceClosure write_callback) {
+  void DisableTracingAndEmitJson(base::OnceClosure write_callback,
+                                 bool enable_privacy_filtering = false) {
     expect_json_data_ = true;
     MojoCreateDataPipeOptions options = {sizeof(MojoCreateDataPipeOptions),
                                          MOJO_CREATE_DATA_PIPE_FLAG_NONE, 1, 0};
@@ -367,7 +369,8 @@ class TracingConsumerTest : public testing::Test,
     MojoResult rv = mojo::CreateDataPipe(&options, &producer, &consumer);
     ASSERT_EQ(MOJO_RESULT_OK, rv);
     threaded_service_->DisableTracingAndEmitJson(std::move(producer),
-                                                 std::move(write_callback));
+                                                 std::move(write_callback),
+                                                 enable_privacy_filtering);
     drainer_.reset(new mojo::DataPipeDrainer(this, std::move(consumer)));
   }
 
@@ -634,7 +637,7 @@ TEST_F(TracingConsumerTest, PrivacyFilterConfig) {
 
 TEST_F(TracingConsumerTest, PrivacyFilterConfigInJson) {
   EnableTracingWithDataSourceName(mojom::kTraceEventDataSourceName,
-                                  /* enable_privacy_filtering =*/true);
+                                  /* enable_privacy_filtering =*/false);
 
   base::RunLoop wait_for_tracing_start;
   threaded_perfetto_service()->CreateProducer(
@@ -643,17 +646,18 @@ TEST_F(TracingConsumerTest, PrivacyFilterConfigInJson) {
 
   wait_for_tracing_start.Run();
 
-  EXPECT_TRUE(threaded_perfetto_service()
-                  ->GetProducerClientConfig()
-                  .chrome_config()
-                  .privacy_filtering_enabled());
+  EXPECT_FALSE(threaded_perfetto_service()
+                   ->GetProducerClientConfig()
+                   .chrome_config()
+                   .privacy_filtering_enabled());
 
   base::RunLoop no_more_data;
   ExpectPackets("\"perfetto_trace_stats\":\"__stripped__\"",
                 no_more_data.QuitClosure());
 
   base::RunLoop write_done;
-  DisableTracingAndEmitJson(write_done.QuitClosure());
+  DisableTracingAndEmitJson(write_done.QuitClosure(),
+                            /* enable_privacy_filtering =*/true);
 
   no_more_data.Run();
   write_done.Run();

services/tracing/public/mojom/perfetto_service.mojom

@@ -252,7 +252,8 @@ interface TracingSessionHost {
   // DEPRECATED: Existing usecases only; new use cases of tracing should use the
   // streaming proto format via ReadBuffers.
   DisableTracingAndEmitJson(string agent_label_filter,
-                            handle<data_pipe_producer> stream) => ();
+                            handle<data_pipe_producer> stream,
+                            bool privacy_filtering_enabled) => ();
 };
 
 // Any client connecting to ConsumerHost should implement this interface which