Merge pull request #27856 from brave/pr27548_tor-leak-background-download_1.77.x

Use browser context specific URLLoaderFactory for InMemoryDownloadService (Cherry-picked) (uplift to 1.77.x)

Author: LaurenWags

chromium_src/check_chromium_src_config.json5

@@ -37,6 +37,7 @@
         "chrome/install_static/brave_restore_google_update_integration.h",
         "chrome/install_static/brave_stash_google_update_integration.h",
         "chrome/install_static/brave_user_data_dir_win_unittest.cc",
+        "components/download/public/background_service/url_loader_factory_getter.h",
         "components/privacy_sandbox/privacy_sandbox_settings_unittest.cc",
         "components/search_engines/brave_template_url_prepopulate_data_unittest.cc",
         "components/search_engines/brave_template_url_service_util_unittest.cc",

chromium_src/chrome/browser/download/background_download_service_factory.cc

@@ -54,17 +54,17 @@ std::unique_ptr<BackgroundDownloadService> BuildInMemoryDownloadServiceOverride(
     const base::FilePath& storage_dir,
     BlobContextGetterFactoryPtr blob_context_getter_factory,
     scoped_refptr<base::SingleThreadTaskRunner> io_task_runner,
-    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory) {
+    URLLoaderFactoryGetterPtr url_loader_factory_getter) {
   clients->insert(std::make_pair(
       download::DownloadClient::CUSTOM_LIST_SUBSCRIPTIONS,
       std::make_unique<download::DeferredClientWrapper>(
           base::BindOnce(&CreateAdBlockSubscriptionDownloadClient),
           simple_factory_key)));
 
-  return BuildInMemoryDownloadService(simple_factory_key, std::move(clients),
-                                      network_connection_tracker, storage_dir,
-                                      std::move(blob_context_getter_factory),
-                                      io_task_runner, url_loader_factory);
+  return BuildInMemoryDownloadService(
+      simple_factory_key, std::move(clients), network_connection_tracker,
+      storage_dir, std::move(blob_context_getter_factory), io_task_runner,
+      std::move(url_loader_factory_getter));
 }
 
 }  // namespace download

chromium_src/components/download/public/background_service/url_loader_factory_getter.h

@@ -0,0 +1,41 @@
+/* Copyright (c) 2025 The Brave Authors. All rights reserved.
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+#ifndef BRAVE_CHROMIUM_SRC_COMPONENTS_DOWNLOAD_PUBLIC_BACKGROUND_SERVICE_URL_LOADER_FACTORY_GETTER_H_
+#define BRAVE_CHROMIUM_SRC_COMPONENTS_DOWNLOAD_PUBLIC_BACKGROUND_SERVICE_URL_LOADER_FACTORY_GETTER_H_
+
+#include "base/component_export.h"
+#include "base/functional/callback.h"
+#include "base/memory/scoped_refptr.h"
+
+namespace network {
+class SharedURLLoaderFactory;
+}  // namespace network
+
+namespace download {
+
+using URLLoaderFactoryGetterCallback =
+    base::OnceCallback<void(scoped_refptr<network::SharedURLLoaderFactory>)>;
+
+class COMPONENT_EXPORT(COMPONENTS_DOWNLOAD_PUBLIC_BACKGROUND_SERVICE)
+    URLLoaderFactoryGetter {
+ public:
+  virtual void RetrieveURLLoaderFactory(
+      URLLoaderFactoryGetterCallback callback) = 0;
+
+  URLLoaderFactoryGetter(const URLLoaderFactoryGetter&) = delete;
+  URLLoaderFactoryGetter& operator=(const URLLoaderFactoryGetter&) = delete;
+
+  virtual ~URLLoaderFactoryGetter() = default;
+
+ protected:
+  URLLoaderFactoryGetter() = default;
+};
+
+using URLLoaderFactoryGetterPtr = std::unique_ptr<URLLoaderFactoryGetter>;
+
+}  // namespace download
+
+#endif  // BRAVE_CHROMIUM_SRC_COMPONENTS_DOWNLOAD_PUBLIC_BACKGROUND_SERVICE_URL_LOADER_FACTORY_GETTER_H_

patches/chrome-browser-download-background_download_service_factory.cc.patch

@@ -0,0 +1,69 @@
+diff --git a/chrome/browser/download/background_download_service_factory.cc b/chrome/browser/download/background_download_service_factory.cc
+index 54fbadcbc0d2779bf2317ac4d4dd7dae3835a10d..c4f2ae62b0679cdf8ed072076f33f49c5a068f25 100644
+--- a/chrome/browser/download/background_download_service_factory.cc
++++ b/chrome/browser/download/background_download_service_factory.cc
+@@ -20,7 +20,6 @@
+ #include "chrome/browser/download/deferred_client_wrapper.h"
+ #include "chrome/browser/download/download_manager_utils.h"
+ #include "chrome/browser/download/simple_download_manager_coordinator_factory.h"
+-#include "chrome/browser/net/system_network_context_manager.h"
+ #include "chrome/browser/optimization_guide/prediction/prediction_model_download_client.h"
+ #include "chrome/browser/profiles/incognito_helpers.h"
+ #include "chrome/browser/profiles/profile.h"
+@@ -35,6 +34,7 @@
+ #include "components/download/public/background_service/blob_context_getter_factory.h"
+ #include "components/download/public/background_service/clients.h"
+ #include "components/download/public/background_service/features.h"
++#include "components/download/public/background_service/url_loader_factory_getter.h"
+ #include "components/download/public/common/simple_download_manager_coordinator.h"
+ #include "components/keyed_service/core/simple_dependency_manager.h"
+ #include "components/leveldb_proto/public/proto_database_provider.h"
+@@ -108,6 +108,33 @@ class DownloadBlobContextGetterFactory
+   raw_ptr<SimpleFactoryKey> key_;
+ };
+ 
++void OnProfileCreated(download::URLLoaderFactoryGetterCallback callback,
++                      Profile* profile) {
++  DCHECK(callback);
++  std::move(callback).Run(profile->GetURLLoaderFactory());
++}
++
++class URLLoaderFactoryGetter : public download::URLLoaderFactoryGetter {
++ public:
++  explicit URLLoaderFactoryGetter(SimpleFactoryKey* key) : key_(key) {
++    DCHECK(key_);
++  }
++
++  URLLoaderFactoryGetter(const URLLoaderFactoryGetter&) = delete;
++  URLLoaderFactoryGetter& operator=(const URLLoaderFactoryGetter&) = delete;
++
++  ~URLLoaderFactoryGetter() override = default;
++
++ private:
++  void RetrieveURLLoaderFactory(
++      download::URLLoaderFactoryGetterCallback callback) override {
++    FullBrowserTransitionManager::Get()->RegisterCallbackOnProfileCreation(
++        key_, base::BindOnce(&OnProfileCreated, std::move(callback)));
++  }
++
++  raw_ptr<SimpleFactoryKey> key_;
++};
++
+ }  // namespace
+ 
+ // static
+@@ -169,13 +196,11 @@ BackgroundDownloadServiceFactory::BuildServiceInstanceFor(
+         std::make_unique<DownloadBlobContextGetterFactory>(key);
+     scoped_refptr<base::SingleThreadTaskRunner> io_task_runner =
+         content::GetIOThreadTaskRunner({});
+-    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory =
+-        SystemNetworkContextManager::GetInstance()->GetSharedURLLoaderFactory();
+ 
+     return download::BuildInMemoryDownloadService(
+         key, std::move(clients), content::GetNetworkConnectionTracker(),
+         base::FilePath(), std::move(blob_context_getter_factory),
+-        io_task_runner, url_loader_factory);
++        io_task_runner, std::make_unique<::URLLoaderFactoryGetter>(key));
+   } else {
+     // Build download service for normal profile.
+     base::FilePath storage_dir;

patches/components-download-content-factory-download_service_factory_helper.cc.patch

@@ -0,0 +1,33 @@
+diff --git a/components/download/content/factory/download_service_factory_helper.cc b/components/download/content/factory/download_service_factory_helper.cc
+index f856fff2897d278d7ef083f996558cc8584f12f3..5e7b25d1928904268d910faa5ce7d4ae7cf8221d 100644
+--- a/components/download/content/factory/download_service_factory_helper.cc
++++ b/components/download/content/factory/download_service_factory_helper.cc
+@@ -111,8 +111,8 @@ std::unique_ptr<BackgroundDownloadService> BuildDownloadService(
+     std::unique_ptr<TaskScheduler> task_scheduler) {
+   auto config = Configuration::CreateFromFinch();
+ 
+-  auto driver = std::make_unique<DownloadDriverImpl>(
+-      download_manager_coordinator);
++  auto driver =
++      std::make_unique<DownloadDriverImpl>(download_manager_coordinator);
+ 
+   auto entry_db_storage_dir = storage_dir.Append(kEntryDBStorageDir);
+ 
+@@ -139,12 +139,13 @@ std::unique_ptr<BackgroundDownloadService> BuildInMemoryDownloadService(
+     const base::FilePath& storage_dir,
+     BlobContextGetterFactoryPtr blob_context_getter_factory,
+     scoped_refptr<base::SingleThreadTaskRunner> io_task_runner,
+-    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory) {
++    URLLoaderFactoryGetterPtr url_loader_factory_getter) {
+   auto config = Configuration::CreateFromFinch();
+-  auto download_factory = std::make_unique<InMemoryDownloadFactory>(
+-      url_loader_factory.get(), io_task_runner);
++  auto download_factory =
++      std::make_unique<InMemoryDownloadFactory>(io_task_runner);
+   auto driver = std::make_unique<InMemoryDownloadDriver>(
+-      std::move(download_factory), std::move(blob_context_getter_factory));
++      std::move(download_factory), std::move(blob_context_getter_factory),
++      std::move(url_loader_factory_getter));
+   auto store = std::make_unique<NoopStore>();
+   auto task_scheduler = std::make_unique<EmptyTaskScheduler>();
+ 

patches/components-download-content-factory-download_service_factory_helper.h.patch

@@ -0,0 +1,27 @@
+diff --git a/components/download/content/factory/download_service_factory_helper.h b/components/download/content/factory/download_service_factory_helper.h
+index d6687f6e03ebaf271b3f250571f263bb968720e8..d85c60ec112e9c420dff3b0d50a9ba882a19e847 100644
+--- a/components/download/content/factory/download_service_factory_helper.h
++++ b/components/download/content/factory/download_service_factory_helper.h
+@@ -13,12 +13,12 @@
+ #include "base/task/single_thread_task_runner.h"
+ #include "components/download/public/background_service/blob_context_getter_factory.h"
+ #include "components/download/public/background_service/clients.h"
++#include "components/download/public/background_service/url_loader_factory_getter.h"
+ 
+ class SimpleFactoryKey;
+ 
+ namespace network {
+ class NetworkConnectionTracker;
+-class SharedURLLoaderFactory;
+ }  // namespace network
+ 
+ namespace leveldb_proto {
+@@ -60,7 +60,7 @@ std::unique_ptr<BackgroundDownloadService> BuildInMemoryDownloadService(
+     const base::FilePath& storage_dir,
+     BlobContextGetterFactoryPtr blob_context_getter_factory,
+     scoped_refptr<base::SingleThreadTaskRunner> io_task_runner,
+-    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory);
++    URLLoaderFactoryGetterPtr url_loader_factory_getter);
+ 
+ }  // namespace download
+ 

patches/components-download-internal-background_service-in_memory_download.cc.patch

@@ -0,0 +1,101 @@
+diff --git a/components/download/internal/background_service/in_memory_download.cc b/components/download/internal/background_service/in_memory_download.cc
+index 4267b39009467edd579ace516b6441999441ff62..b5d7eebe994b0b65d8cc8ea0077b0d69b068edec 100644
+--- a/components/download/internal/background_service/in_memory_download.cc
++++ b/components/download/internal/background_service/in_memory_download.cc
+@@ -14,6 +14,7 @@
+ #include "net/base/load_flags.h"
+ #include "net/traffic_annotation/network_traffic_annotation.h"
+ #include "services/network/public/cpp/resource_request.h"
++#include "services/network/public/cpp/shared_url_loader_factory.h"
+ #include "services/network/public/mojom/url_response_head.mojom.h"
+ #include "storage/browser/blob/blob_data_handle.h"
+ #include "storage/browser/blob/blob_storage_context.h"
+@@ -35,13 +36,11 @@ InMemoryDownloadImpl::InMemoryDownloadImpl(
+     scoped_refptr<network::ResourceRequestBody> request_body,
+     const net::NetworkTrafficAnnotationTag& traffic_annotation,
+     Delegate* delegate,
+-    network::mojom::URLLoaderFactory* url_loader_factory,
+     scoped_refptr<base::SingleThreadTaskRunner> io_task_runner)
+     : InMemoryDownload(guid),
+       request_params_(request_params),
+       request_body_(std::move(request_body)),
+       traffic_annotation_(traffic_annotation),
+-      url_loader_factory_(url_loader_factory),
+       io_task_runner_(io_task_runner),
+       delegate_(delegate),
+       completion_notified_(false),
+@@ -56,7 +55,16 @@ InMemoryDownloadImpl::~InMemoryDownloadImpl() {
+ 
+ void InMemoryDownloadImpl::Start() {
+   DCHECK(state_ == State::INITIAL) << "Only call Start() for new download.";
++  state_ = State::RETRIEVE_URL_LOADER_FACTIORY;
++  delegate_->RetrievedURLLoaderFactory(
++      base::BindOnce(&InMemoryDownloadImpl::OnRetrievedURLLoaderFactory,
++                     weak_ptr_factory_.GetWeakPtr()));
++}
++
++void InMemoryDownloadImpl::OnRetrievedURLLoaderFactory(
++    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory) {
+   state_ = State::RETRIEVE_BLOB_CONTEXT;
++  url_loader_factory_ = url_loader_factory;
+   delegate_->RetrieveBlobContextGetter(
+       base::BindOnce(&InMemoryDownloadImpl::OnRetrievedBlobContextGetter,
+                      weak_ptr_factory_.GetWeakPtr()));
+@@ -72,8 +80,9 @@ void InMemoryDownloadImpl::OnRetrievedBlobContextGetter(
+ }
+ 
+ void InMemoryDownloadImpl::Pause() {
+-  if (state_ == State::IN_PROGRESS)
++  if (state_ == State::IN_PROGRESS) {
+     paused_ = true;
++  }
+ }
+ 
+ void InMemoryDownloadImpl::Resume() {
+@@ -81,12 +90,14 @@ void InMemoryDownloadImpl::Resume() {
+ 
+   switch (state_) {
+     case State::INITIAL:
++    case State::RETRIEVE_URL_LOADER_FACTIORY:
+     case State::RETRIEVE_BLOB_CONTEXT:
+       return;
+     case State::IN_PROGRESS:
+       // Let the network pipe continue to read data.
+-      if (resume_callback_)
++      if (resume_callback_) {
+         std::move(resume_callback_).Run();
++      }
+       return;
+     case State::FAILED:
+       // Restart the download.
+@@ -142,8 +153,9 @@ void InMemoryDownloadImpl::OnComplete(bool success) {
+ 
+   // OnComplete() called without OnResponseStarted(). This will happen when the
+   // request was aborted.
+-  if (!started_)
++  if (!started_) {
+     OnResponseStarted(GURL(), network::mojom::URLResponseHead());
++  }
+ 
+   NotifyDelegateDownloadComplete();
+ }
+@@ -189,8 +201,9 @@ void InMemoryDownloadImpl::OnSaveBlobDone(
+ }
+ 
+ void InMemoryDownloadImpl::NotifyDelegateDownloadComplete() {
+-  if (completion_notified_)
++  if (completion_notified_) {
+     return;
++  }
+   completion_notified_ = true;
+ 
+   delegate_->OnDownloadComplete(this);
+@@ -225,7 +238,7 @@ void InMemoryDownloadImpl::SendRequest() {
+ 
+   // TODO(xingliu): Use SimpleURLLoader's retry when it won't hit CHECK in
+   // SharedURLLoaderFactory.
+-  loader_->DownloadAsStream(url_loader_factory_, this);
++  loader_->DownloadAsStream(url_loader_factory_.get(), this);
+ }
+ 
+ void InMemoryDownloadImpl::OnRedirect(

patches/components-download-internal-background_service-in_memory_download.h.patch

@@ -0,0 +1,60 @@
+diff --git a/components/download/internal/background_service/in_memory_download.h b/components/download/internal/background_service/in_memory_download.h
+index 07f347e0b666219bfbe91f6d891851eebce912fb..d010ebbc5885fd9457b3344e7b5cd02bc17dae21 100644
+--- a/components/download/internal/background_service/in_memory_download.h
++++ b/components/download/internal/background_service/in_memory_download.h
+@@ -19,6 +19,7 @@
+ #include "components/download/internal/background_service/blob_task_proxy.h"
+ #include "components/download/public/background_service/blob_context_getter_factory.h"
+ #include "components/download/public/background_service/download_params.h"
++#include "components/download/public/background_service/url_loader_factory_getter.h"
+ #include "services/network/public/cpp/simple_url_loader.h"
+ #include "services/network/public/cpp/simple_url_loader_stream_consumer.h"
+ #include "services/network/public/mojom/url_loader_factory.mojom.h"
+@@ -58,6 +59,9 @@ class InMemoryDownload {
+     // Retrieves the blob storage context getter.
+     virtual void RetrieveBlobContextGetter(
+         BlobContextGetterCallback callback) = 0;
++    // Retrieves browser context specific URLLoaderFactory
++    virtual void RetrievedURLLoaderFactory(
++        URLLoaderFactoryGetterCallback callback) = 0;
+ 
+    protected:
+     virtual ~Delegate() = default;
+@@ -81,6 +85,9 @@ class InMemoryDownload {
+     // The object is just created.
+     INITIAL,
+ 
++    // Waiting to retrieve URLLoaderFactory.
++    RETRIEVE_URL_LOADER_FACTIORY,
++
+     // Waiting to retrieve BlobStorageContextGetter.
+     RETRIEVE_BLOB_CONTEXT,
+ 
+@@ -172,7 +179,6 @@ class InMemoryDownloadImpl : public network::SimpleURLLoaderStreamConsumer,
+       scoped_refptr<network::ResourceRequestBody> request_body,
+       const net::NetworkTrafficAnnotationTag& traffic_annotation,
+       Delegate* delegate,
+-      network::mojom::URLLoaderFactory* url_loader_factory,
+       scoped_refptr<base::SingleThreadTaskRunner> io_task_runner);
+ 
+   InMemoryDownloadImpl(const InMemoryDownloadImpl&) = delete;
+@@ -186,6 +192,10 @@ class InMemoryDownloadImpl : public network::SimpleURLLoaderStreamConsumer,
+   void Pause() override;
+   void Resume() override;
+ 
++  // Called when browser context specific URLLoaderFactory is ready to use.
++  void OnRetrievedURLLoaderFactory(
++      scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory);
++
+   // Called when the BlobStorageContextGetter is ready to use.
+   void OnRetrievedBlobContextGetter(BlobContextGetter blob_context_getter);
+ 
+@@ -239,7 +249,7 @@ class InMemoryDownloadImpl : public network::SimpleURLLoaderStreamConsumer,
+   std::unique_ptr<network::SimpleURLLoader> loader_;
+ 
+   // Used to handle network response.
+-  raw_ptr<network::mojom::URLLoaderFactory> url_loader_factory_;
++  scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
+ 
+   // Worker that does blob related task on IO thread.
+   std::unique_ptr<BlobTaskProxy> blob_task_proxy_;