flag-fingerprinting-canvas-image-data-noise.patch 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334
  1. # NOTE: Changes made:
  2. # * Added flag --fingerprinting-canvas-image-data-noise to enable/disable
  3. # Canvas image data fingerprinting deception
  4. # * Removed WebGLDebugRendererInfo disabling in favor of an alternative
  5. # implementation in ungoogled-chromium/disable-webgl-renderer-info.patch
  6. # * Tweak subchannel noise generation to require fewer random number generation
  7. From: csagan5 <32685696+csagan5@users.noreply.github.com>
  8. Date: Sat, 24 Mar 2018 05:18:03 +0100
  9. Subject: Canvas: fingerprinting mitigations for image data and webGL
  10. Disable webGL renderer info and modify the color data returned by ToBlob,
  11. ToDataURL and getImageData so that it will contain randomly manipulated
  12. pixels (maximum 10) that slightly change the color of the R,G,B components
  13. without a visible effect.
  14. Credits to Slaviro (https://github.com/Slaviro) for coming up with a better
  15. approach to change color components.
  16. ---
  17. .../platform/graphics/image_data_buffer.cc | 5 +
  18. .../platform/graphics/static_bitmap_image.cc | 154 +++++++++++++++++++++
  19. .../platform/graphics/static_bitmap_image.h | 2 +
  20. 4 files changed, 163 insertions(+), 2 deletions(-)
  21. --- a/chrome/browser/bromite_flag_entries.h
  22. +++ b/chrome/browser/bromite_flag_entries.h
  23. @@ -16,4 +16,8 @@
  24. flag_descriptions::kMaxConnectionsPerHostName,
  25. flag_descriptions::kMaxConnectionsPerHostDescription,
  26. kOsAll, MULTI_VALUE_TYPE(kMaxConnectionsPerHostChoices)},
  27. + {"fingerprinting-canvas-image-data-noise",
  28. + "Enable Canvas image data fingerprint deception",
  29. + "Slightly modifies at most 10 pixels in Canvas image data extracted via JS APIs. ungoogled-chromium flag, Bromite feature.",
  30. + kOsAll, SINGLE_VALUE_TYPE(switches::kFingerprintingCanvasImageDataNoise)},
  31. #endif // CHROME_BROWSER_BROMITE_FLAG_ENTRIES_H_
  32. --- a/content/browser/renderer_host/render_process_host_impl.cc
  33. +++ b/content/browser/renderer_host/render_process_host_impl.cc
  34. @@ -3341,6 +3341,7 @@ void RenderProcessHostImpl::PropagateBro
  35. switches::kFileUrlPathAlias,
  36. switches::kFingerprintingClientRectsNoise,
  37. switches::kFingerprintingCanvasMeasureTextNoise,
  38. + switches::kFingerprintingCanvasImageDataNoise,
  39. switches::kForceDeviceScaleFactor,
  40. switches::kForceDisplayColorProfile,
  41. switches::kForceGpuMemAvailableMb,
  42. --- a/content/child/runtime_features.cc
  43. +++ b/content/child/runtime_features.cc
  44. @@ -489,6 +489,8 @@ void SetRuntimeFeaturesFromCommandLine(c
  45. switches::kFingerprintingClientRectsNoise, true},
  46. {wrf::EnableFingerprintingCanvasMeasureTextNoise,
  47. switches::kFingerprintingCanvasMeasureTextNoise, true},
  48. + {wrf::EnableFingerprintingCanvasImageDataNoise,
  49. + switches::kFingerprintingCanvasImageDataNoise, true},
  50. };
  51. for (const auto& mapping : switchToFeatureMapping) {
  52. if (command_line.HasSwitch(mapping.switch_name))
  53. --- a/third_party/blink/public/platform/web_runtime_features.h
  54. +++ b/third_party/blink/public/platform/web_runtime_features.h
  55. @@ -223,6 +223,7 @@ class WebRuntimeFeatures {
  56. BLINK_PLATFORM_EXPORT static void EnableAllowSyncXHRInPageDismissal(bool);
  57. BLINK_PLATFORM_EXPORT static void EnableFingerprintingClientRectsNoise(bool);
  58. BLINK_PLATFORM_EXPORT static void EnableFingerprintingCanvasMeasureTextNoise(bool);
  59. + BLINK_PLATFORM_EXPORT static void EnableFingerprintingCanvasImageDataNoise(bool);
  60. BLINK_PLATFORM_EXPORT static void EnableSignedExchangeSubresourcePrefetch(
  61. bool);
  62. BLINK_PLATFORM_EXPORT static void EnableSubresourceWebBundles(bool);
  63. --- a/third_party/blink/renderer/modules/canvas/canvas2d/base_rendering_context_2d.cc
  64. +++ b/third_party/blink/renderer/modules/canvas/canvas2d/base_rendering_context_2d.cc
  65. @@ -30,6 +30,7 @@
  66. #include "third_party/blink/renderer/platform/graphics/bitmap_image.h"
  67. #include "third_party/blink/renderer/platform/graphics/graphics_context.h"
  68. #include "third_party/blink/renderer/platform/graphics/skia/skia_utils.h"
  69. +#include "third_party/blink/renderer/platform/graphics/static_bitmap_image.h"
  70. #include "third_party/blink/renderer/platform/graphics/stroke_data.h"
  71. #include "third_party/blink/renderer/platform/graphics/video_frame_image_util.h"
  72. #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
  73. @@ -2055,6 +2056,9 @@ ImageData* BaseRenderingContext2D::getIm
  74. snapshot->PaintImageForCurrentFrame().GetSkImageInfo().bounds();
  75. DCHECK(!bounds.intersect(SkIRect::MakeXYWH(sx, sy, sw, sh)));
  76. }
  77. + if (read_pixels_successful && RuntimeEnabledFeatures::FingerprintingCanvasImageDataNoiseEnabled()) {
  78. + StaticBitmapImage::ShuffleSubchannelColorData(image_data_pixmap.addr(), image_data_pixmap.info(), sx, sy);
  79. + }
  80. }
  81. return image_data;
  82. --- a/third_party/blink/renderer/platform/BUILD.gn
  83. +++ b/third_party/blink/renderer/platform/BUILD.gn
  84. @@ -1641,7 +1641,9 @@ component("platform") {
  85. "//third_party/blink/renderer:non_test_config",
  86. ]
  87. - include_dirs = []
  88. + include_dirs = [
  89. + "//third_party/skia/include/private", # For shuffler in graphics/static_bitmap_image.cc
  90. + ]
  91. allow_circular_includes_from = [
  92. "//third_party/blink/renderer/platform/blob",
  93. --- a/third_party/blink/renderer/platform/exported/web_runtime_features.cc
  94. +++ b/third_party/blink/renderer/platform/exported/web_runtime_features.cc
  95. @@ -705,4 +705,8 @@ void WebRuntimeFeatures::EnableFingerpri
  96. RuntimeEnabledFeatures::SetFingerprintingCanvasMeasureTextNoiseEnabled(enable);
  97. }
  98. +void WebRuntimeFeatures::EnableFingerprintingCanvasImageDataNoise(bool enable) {
  99. + RuntimeEnabledFeatures::SetFingerprintingCanvasImageDataNoiseEnabled(enable);
  100. +}
  101. +
  102. } // namespace blink
  103. --- a/third_party/blink/renderer/platform/graphics/image_data_buffer.cc
  104. +++ b/third_party/blink/renderer/platform/graphics/image_data_buffer.cc
  105. @@ -36,6 +36,8 @@
  106. #include "base/compiler_specific.h"
  107. #include "base/memory/ptr_util.h"
  108. +#include "base/rand_util.h"
  109. +#include "base/logging.h"
  110. #include "third_party/blink/renderer/platform/graphics/static_bitmap_image.h"
  111. #include "third_party/blink/renderer/platform/image-encoders/image_encoder.h"
  112. #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
  113. @@ -145,6 +147,11 @@ bool ImageDataBuffer::EncodeImageInterna
  114. const SkPixmap& pixmap) const {
  115. DCHECK(is_valid_);
  116. + if (RuntimeEnabledFeatures::FingerprintingCanvasImageDataNoiseEnabled()) {
  117. + // shuffle subchannel color data within the pixmap
  118. + StaticBitmapImage::ShuffleSubchannelColorData(pixmap_.writable_addr(), pixmap_.info(), 0, 0);
  119. + }
  120. +
  121. if (mime_type == kMimeTypeJpeg) {
  122. SkJpegEncoder::Options options;
  123. options.fQuality = ImageEncoder::ComputeJpegQuality(quality);
  124. --- a/third_party/blink/renderer/platform/graphics/static_bitmap_image.cc
  125. +++ b/third_party/blink/renderer/platform/graphics/static_bitmap_image.cc
  126. @@ -4,6 +4,8 @@
  127. #include "third_party/blink/renderer/platform/graphics/static_bitmap_image.h"
  128. +#include "base/rand_util.h"
  129. +#include "base/logging.h"
  130. #include "base/numerics/checked_math.h"
  131. #include "gpu/command_buffer/client/gles2_interface.h"
  132. #include "third_party/blink/renderer/platform/graphics/accelerated_static_bitmap_image.h"
  133. @@ -11,10 +13,12 @@
  134. #include "third_party/blink/renderer/platform/graphics/image_observer.h"
  135. #include "third_party/blink/renderer/platform/graphics/paint/paint_image.h"
  136. #include "third_party/blink/renderer/platform/graphics/unaccelerated_static_bitmap_image.h"
  137. +#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
  138. #include "third_party/skia/include/core/SkCanvas.h"
  139. #include "third_party/skia/include/core/SkImage.h"
  140. #include "third_party/skia/include/core/SkPaint.h"
  141. #include "third_party/skia/include/core/SkSurface.h"
  142. +#include "third_party/skia/include/private/SkColorData.h"
  143. #include "ui/gfx/geometry/skia_conversions.h"
  144. #include "v8/include/v8.h"
  145. @@ -79,4 +83,154 @@ void StaticBitmapImage::DrawHelper(cc::P
  146. WebCoreClampingModeToSkiaRectConstraint(draw_options.clamping_mode));
  147. }
  148. +// set the component to maximum-delta if it is >= maximum, or add to existing color component (color + delta)
  149. +#define shuffleComponent(color, max, delta) ( (color) >= (max) ? ((max)-(delta)) : ((color)+(delta)) )
  150. +
  151. +#define writable_addr(T, p, stride, x, y) (T*)((const char *)p + y * stride + x * sizeof(T))
  152. +
  153. +void StaticBitmapImage::ShuffleSubchannelColorData(const void *addr, const SkImageInfo& info, int srcX, int srcY) {
  154. + auto w = info.width() - srcX, h = info.height() - srcY;
  155. +
  156. + // skip tiny images; info.width()/height() can also be 0
  157. + if ((w < 8) || (h < 8)) {
  158. + return;
  159. + }
  160. +
  161. + // generate the first random number here
  162. + double shuffleX = base::RandDouble();
  163. +
  164. + // cap maximum pixels to change
  165. + auto pixels = (w + h) / 128;
  166. + if (pixels > 10) {
  167. + pixels = 10;
  168. + } else if (pixels < 2) {
  169. + pixels = 2;
  170. + }
  171. +
  172. + auto colorType = info.colorType();
  173. + auto fRowBytes = info.minRowBytes(); // stride
  174. +
  175. + DLOG(INFO) << "BRM: ShuffleSubchannelColorData() w=" << w << " h=" << h << " colorType=" << colorType << " fRowBytes=" << fRowBytes;
  176. +
  177. + // second random number (for y/height)
  178. + double shuffleY = base::RandDouble();
  179. +
  180. + // calculate random coordinates using bisection
  181. + auto currentW = w, currentH = h;
  182. + for(;pixels >= 0; pixels--) {
  183. + int x = currentW * shuffleX, y = currentH * shuffleY;
  184. +
  185. + // calculate randomisation amounts for each RGB component
  186. + uint8_t shuffleR = base::RandInt(0, 4);
  187. + uint8_t shuffleG = (shuffleR + x) % 4;
  188. + uint8_t shuffleB = (shuffleG + y) % 4;
  189. +
  190. + // manipulate pixel data to slightly change the R, G, B components
  191. + switch (colorType) {
  192. + case kAlpha_8_SkColorType:
  193. + {
  194. + auto *pixel = writable_addr(uint8_t, addr, fRowBytes, x, y);
  195. + auto r = SkColorGetR(*pixel), g = SkColorGetG(*pixel), b = SkColorGetB(*pixel), a = SkColorGetA(*pixel);
  196. +
  197. + r = shuffleComponent(r, UINT8_MAX-1, shuffleR);
  198. + g = shuffleComponent(g, UINT8_MAX-1, shuffleG);
  199. + b = shuffleComponent(b, UINT8_MAX-1, shuffleB);
  200. + // alpha is left unchanged
  201. +
  202. + *pixel = SkColorSetARGB(a, r, g, b);
  203. + }
  204. + break;
  205. + case kGray_8_SkColorType:
  206. + {
  207. + auto *pixel = writable_addr(uint8_t, addr, fRowBytes, x, y);
  208. + *pixel = shuffleComponent(*pixel, UINT8_MAX-1, shuffleB);
  209. + }
  210. + break;
  211. + case kRGB_565_SkColorType:
  212. + {
  213. + auto *pixel = writable_addr(uint16_t, addr, fRowBytes, x, y);
  214. + unsigned r = SkPacked16ToR32(*pixel);
  215. + unsigned g = SkPacked16ToG32(*pixel);
  216. + unsigned b = SkPacked16ToB32(*pixel);
  217. +
  218. + r = shuffleComponent(r, 31, shuffleR);
  219. + g = shuffleComponent(g, 63, shuffleG);
  220. + b = shuffleComponent(b, 31, shuffleB);
  221. +
  222. + unsigned r16 = (r & SK_R16_MASK) << SK_R16_SHIFT;
  223. + unsigned g16 = (g & SK_G16_MASK) << SK_G16_SHIFT;
  224. + unsigned b16 = (b & SK_B16_MASK) << SK_B16_SHIFT;
  225. +
  226. + *pixel = r16 | g16 | b16;
  227. + }
  228. + break;
  229. + case kARGB_4444_SkColorType:
  230. + {
  231. + auto *pixel = writable_addr(uint16_t, addr, fRowBytes, x, y);
  232. + auto a = SkGetPackedA4444(*pixel), r = SkGetPackedR4444(*pixel), g = SkGetPackedG4444(*pixel), b = SkGetPackedB4444(*pixel);
  233. +
  234. + r = shuffleComponent(r, 15, shuffleR);
  235. + g = shuffleComponent(g, 15, shuffleG);
  236. + b = shuffleComponent(b, 15, shuffleB);
  237. + // alpha is left unchanged
  238. +
  239. + unsigned a4 = (a & 0xF) << SK_A4444_SHIFT;
  240. + unsigned r4 = (r & 0xF) << SK_R4444_SHIFT;
  241. + unsigned g4 = (g & 0xF) << SK_G4444_SHIFT;
  242. + unsigned b4 = (b & 0xF) << SK_B4444_SHIFT;
  243. +
  244. + *pixel = r4 | b4 | g4 | a4;
  245. + }
  246. + break;
  247. + case kRGBA_8888_SkColorType:
  248. + {
  249. + auto *pixel = writable_addr(uint32_t, addr, fRowBytes, x, y);
  250. + auto a = SkGetPackedA32(*pixel), r = SkGetPackedR32(*pixel), g = SkGetPackedG32(*pixel), b = SkGetPackedB32(*pixel);
  251. +
  252. + r = shuffleComponent(r, UINT8_MAX-1, shuffleR);
  253. + g = shuffleComponent(g, UINT8_MAX-1, shuffleG);
  254. + b = shuffleComponent(b, UINT8_MAX-1, shuffleB);
  255. + // alpha is left unchanged
  256. +
  257. + *pixel = (a << SK_A32_SHIFT) | (r << SK_R32_SHIFT) |
  258. + (g << SK_G32_SHIFT) | (b << SK_B32_SHIFT);
  259. + }
  260. + break;
  261. + case kBGRA_8888_SkColorType:
  262. + {
  263. + auto *pixel = writable_addr(uint32_t, addr, fRowBytes, x, y);
  264. + auto a = SkGetPackedA32(*pixel), b = SkGetPackedR32(*pixel), g = SkGetPackedG32(*pixel), r = SkGetPackedB32(*pixel);
  265. +
  266. + r = shuffleComponent(r, UINT8_MAX-1, shuffleR);
  267. + g = shuffleComponent(g, UINT8_MAX-1, shuffleG);
  268. + b = shuffleComponent(b, UINT8_MAX-1, shuffleB);
  269. + // alpha is left unchanged
  270. +
  271. + *pixel = (a << SK_BGRA_A32_SHIFT) | (r << SK_BGRA_R32_SHIFT) |
  272. + (g << SK_BGRA_G32_SHIFT) | (b << SK_BGRA_B32_SHIFT);
  273. + }
  274. + break;
  275. + default:
  276. + // the remaining formats are not expected to be used in Chromium
  277. + LOG(WARNING) << "BRM: ShuffleSubchannelColorData(): Ignoring pixel format";
  278. + return;
  279. + }
  280. +
  281. + // keep bisecting or reset current width/height as needed
  282. + if (x == 0) {
  283. + currentW = w;
  284. + } else {
  285. + currentW = x;
  286. + }
  287. + if (y == 0) {
  288. + currentH = h;
  289. + } else {
  290. + currentH = y;
  291. + }
  292. + }
  293. +}
  294. +
  295. +#undef writable_addr
  296. +#undef shuffleComponent
  297. +
  298. } // namespace blink
  299. --- a/third_party/blink/renderer/platform/graphics/static_bitmap_image.h
  300. +++ b/third_party/blink/renderer/platform/graphics/static_bitmap_image.h
  301. @@ -36,6 +36,8 @@ class PLATFORM_EXPORT StaticBitmapImage
  302. StaticBitmapImage(ImageOrientation orientation) : orientation_(orientation) {}
  303. + static void ShuffleSubchannelColorData(const void *addr, const SkImageInfo& info, int srcX, int srcY);
  304. +
  305. bool IsStaticBitmapImage() const override { return true; }
  306. // Methods overridden by all sub-classes
  307. --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
  308. +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
  309. @@ -1108,6 +1108,9 @@
  310. name: "FingerprintingCanvasMeasureTextNoise",
  311. },
  312. {
  313. + name: "FingerprintingCanvasImageDataNoise",
  314. + },
  315. + {
  316. name: "FocuslessSpatialNavigation",
  317. settable_from_internals: true,
  318. },