For Uphold wallet integration, we should protect against malicious extensions

[jsecretan]

Description

To prevent attacks by malicious extensions in our new sign in process for the integrated Uphold wallet, we should block access to our specific integrated wallet sign in URL to extensions. This URL from Uphold is going to be specifically dedicated to the purpose of our wallet integration, so blocking that URL should have no effect on legitimate extensions. This will include access through the WebRequest API and to sign in page generally (this includes scripting access to the page).

Misuse of the WebRequest API is something Chrome itself has to contend with - there are already blocks in place for the chrome web store. We should be able to look to https://cs.chromium.org/chromium/src/extensions/browser/api/web_request/web_request_permissions.cc?rcl=a367b3f7bd249d6e3feb13ee250b83baf821f3f3&l=238 as a way to implement blacklisting of the particular linking / redirect URL.

For blocking page level / scripting access we may be able to make use of the “withheld” permissions functionality that already exists for user granted host permissions for extensions. Currently you can set an extension to be granted permission to a particular site upon a user clicking the icon in the toolbar. It would be ideal if we can set an override so that all* extensions require on-click permissions for the uphold authorization pages, no matter their global permission setting.

This on-click permission facility seems like it would strike a good balance between us protecting the user and them being able to override for legitimate extensions. Since there is no associated request notification (the extension icon in the toolbar is simply shown within a differently colored circle) a user is unlikely to grant permissions by clicking the icon unless they have a legitimate need for that extension on this page.

*: A small whitelist for known password managers would likely be desirable

cc: @evq

[kjozwiak]

Labelling as QA/Yes as there's STR/Test Cases in brave/brave-core#2946.

[LaurenWags]

Verified passed with

Brave	0.69.116 Chromium: 76.0.3809.100 (Official Build) beta (64-bit)
Revision	ed9d447d30203dc5069e540f05079e493fc1c132-refs/branch-heads/3809@{#990}
OS	Mac OS X

• Verified test plan from Extensions protected urls with patch 4928 brave-core#2946
• I logged in and connected a verified, KYC'd sandbox account to test both scenarios from the test plan.
  WebRequest Step 2:
  

WebRequest Step 3:

WebRequest Step 4:

ContentScript Step 2 (sandbox):

ContentScript Step 3 (sandbox):

ContentScript Step 4 (sandbox):

ContentScript Step 2 (prod):

ContentScript Step 3 (prod):

WebRequest Step 2:

WebRequest Step 3:

WebRequest Step 4:

ContenScript performed for production and sandbox
ContentScript Step 2 :

ContentScript Step 3 :

ContentScript Step 4 :

Verification passed on

Brave	0.69.129 Chromium: 77.0.3865.90 (Official Build) (64-bit)
Revision	58c425ba843df2918d9d4b409331972646c393dd-refs/branch-heads/3865@{#830}
OS	Windows 10 OS Version 1803 (Build 17134.1006)

• Verified test plan from Extensions protected urls with patch 4928 brave-core#2946
  WebRequest Step 2:
  

WebRequest Step 3:

WebRequest Step 4:

ContentScript Step 2 (sandbox):

ContentScript Step 3 (sandbox):

ContentScript Step 4 (sandbox):

ContentScript Step 2 (prod):

ContentScript Step 3 (prod):

[GeetaSarvadnya]

@fmarier step 2 from the test plan brave/brave-core#2946 is redirecting to the page below In Windows 0.69.128 Chromium: 77.0.3865.75

[fmarier]

I updated the test plan at brave/brave-core#2946. The expected landing page is now fmarier.org due to a recent change I made to my testing extension.

[kyeotic]

@jsecretan This is really frustrating as it disables password managers. There is no indication in the UI that the disabling is intentional, and I just spent 20 minutes trying to figure out why Bitwarden wouldnt work on the uphold.com account creation page. Clicking the extensions and then clicking reload page to use extensions doesn't work, making it feel like a bug.

A way to re-enable extensions would be nice. In lieu of the ability to control what my browser does, an explanation about why would be appreciated.

[evq]

@kyeotic if clicking the extension and the reload page to use this extension prompt doesn't work then that is a bug. we explicitly hooked into the extension permission system to enable such a use case

@fmarier should we create a new issue or track here?

[kyeotic]

@evq Ah, good to know its a bug. I will open an issue for it.

Scratch that: someone beat me to it