Package: chromium
Followup-For: Bug #1129590

Dear Maintainer,

I experienced the same issue of the "Enter" key behavior on "Save File" 
dialogs. Downgrading the chromium to version 144.0.7559.109-2 reverts the 
behavior. The "Tab" key has no function on "Save File" dialogs in version 
144.0.7559.109-2, so maybe its behavior is long existed and not caused by 
recent upgrade.

Running bisect-builds.py on the "Enter" key behavior between 
144.0.7559.109(good) and 145.0.7632.75(bad) found the following result:

You are probably looking for a change made after 1564730 (build version: 
145.0.7618.0) (known good), but no later than 1564737 (build version: 
145.0.7618.0) (first known bad).
CHANGELOG URL:
https://chromium.googlesource.com/chromium/src/+log/392842e9bc78b094dbd5afe09c6df0fee200e13f..3165dd86ac4005b1f618d3865312c35934bc4690

The changes between 1564730 and 1564737 have 7 commits, and among them I think 
the commit "[GTK] Don't preselect file dialog accept buttons" caused the 
behavior change of the "Enter" key on "Save File" dialog. This commit is to 
solve a potential vulnerability that a site could steal user files via file 
upload, but it clear all preselect accept buttons for "upload", "save as" and 
"folder selection".

If I understand correctly, a site can not preselect the path where a download 
file will be saved to; it can only prefill a filename for the download file. If 
a file with the same filename existed, chromium will automatically choose a 
different name. Even the user change it to the same filename, GTK will prompt a 
dialog requiring the user to confirm overwriting the existing file. Also 
providing downloading will not leak user files to a site, I think preselect 
accept button for "Save File" dialog has no vulnerability, or the vulnerability 
is marginal. So I think the behavior should be restored for "Save File" dialog.

The following patch against version 149.0.7827.155-1 should be able to restore 
the behavior for "Save File" dialog only, although I am still building the 
chromium package with this patch and can not test it currently.

--- a/ui/gtk/select_file_dialog_linux_gtk.cc
+++ b/ui/gtk/select_file_dialog_linux_gtk.cc
@@ -523,7 +523,7 @@
   GtkWidget* dialog = GtkFileChooserDialogNew(
       title_string.c_str(), nullptr, GTK_FILE_CHOOSER_ACTION_SAVE,
       GetCancelLabel(), GTK_RESPONSE_CANCEL, GetSaveLabel(),
-      kResponseTypeAccept);
+      GTK_RESPONSE_ACCEPT);
   SetGtkTransientForAura(dialog, parent, platform_);

   AddFilters(GTK_FILE_CHOOSER(dialog));


-- System Information:
Debian Release: forky/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.18.12+deb14-amd64 (SMP w/2 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: runit (via /run/runit.stopit)
LSM: AppArmor: enabled

Versions of packages chromium depends on:
ii  chromium-common        144.0.7559.109-2
ii  libasound2t64          1.2.16-1
ii  libatk-bridge2.0-0t64  2.60.4-1
ii  libatk1.0-0t64         2.60.4-1
ii  libatspi2.0-0t64       2.60.4-1
ii  libc6                  2.42-16
ii  libcairo2              1.18.4-3+b1
ii  libcups2t64            2.4.18-1
ii  libdav1d7              1.5.3-1+b2
ii  libdbus-1-3            1.16.2-5+b1
ii  libdouble-conversion3  3.4.0-1+b1
ii  libeudev1 [libudev1]   3.2.14-2local2
ii  libexpat1              2.8.1-1
ii  libflac14              1.5.0+ds-5+b1
ii  libfontconfig1         2.17.1-5
ii  libfreetype6           2.14.3+dfsg-1
ii  libgbm1                26.0.8-1
ii  libgcc-s1              16.1.0-2
ii  libglib2.0-0t64        2.88.1-2
ii  libgtk-3-0t64          3.24.52-1
ii  libharfbuzz-subset0    12.3.2-2+b2
ii  libharfbuzz0b          12.3.2-2+b2
ii  libjpeg62-turbo        1:3.1.3-4
ii  liblcms2-2             2.19.1-1
ii  libminizip1t64         1:1.3.dfsg+really1.3.2-3
ii  libnspr4               2:4.38.2-1+b1
ii  libnss3                2:3.124-1
ii  libopenh264-8          2.6.0+dfsg-2+b2
ii  libopenjp2-7           2.5.4-1.1
ii  libopus0               1.6.1-1+b1
ii  libpango-1.0-0         1.57.1-2
ii  libpulse0              17.0+dfsg1-2.1+b1
ii  libx11-6               2:1.8.13-1
ii  libxcb1                1.17.0-2+b2
ii  libxcomposite1         1:0.4.6-1+b2
ii  libxdamage1            1:1.1.7-1+b1
ii  libxext6               2:1.3.4-1+b4
ii  libxfixes3             1:6.0.0-2+b5
ii  libxkbcommon0          1.13.1-1
ii  libxnvctrl0            535.171.04-1+b3
ii  libxrandr2             2:1.5.4-1+b4
ii  libxslt1.1             1.1.45-0.1
ii  libzstd1               1.5.7+dfsg-3+b2
ii  zlib1g                 1:1.3.dfsg+really1.3.2-3

Versions of packages chromium recommends:
ii  chromium-sandbox  144.0.7559.109-2

Versions of packages chromium suggests:
pn  chromium-driver  <none>
pn  chromium-l10n    <none>
pn  chromium-shell   <none>

Versions of packages chromium-common depends on:
ii  libc6        2.42-16
ii  libgcc-s1    16.1.0-2
ii  libx11-6     2:1.8.13-1
ii  libxcb1      1.17.0-2+b2
ii  libxnvctrl0  535.171.04-1+b3
ii  x11-utils    7.7+7
ii  xdg-utils    1.2.1-2
ii  zlib1g       1:1.3.dfsg+really1.3.2-3

Versions of packages chromium-common recommends:
ii  chromium-sandbox                     144.0.7559.109-2
ii  eudev [udev]                         3.2.14-2local2
ii  fonts-liberation                     1:2.1.5-3
ii  libgl1-mesa-dri                      26.0.8-1
pn  system-config-printer                <none>
ii  upower                               1.91.2-1
ii  xfce4-notifyd [notification-daemon]  0.9.7-2

Versions of packages chromium-sandbox depends on:
ii  libc6  2.42-16

-- no debconf information

Reply via email to