From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Wed, 27 Mar 2024 10:47:48 +0100
Subject: refactor: expose file system access blocklist

This CL exposes the file system access blocklist publicly so that we can leverage
it in Electron and prevent drift from Chrome's blocklist. We should look for a way
to upstream this change to Chrome.

diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
index 62de0f9e9f74554542d0214d212ef322a3364c8f..00f96d64ef2aa0151356ce1783d146035890db34 100644
--- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
+++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
@@ -82,11 +82,13 @@
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/tabs/public/tab_features.h"
 #include "chrome/browser/ui/views/file_system_access/file_system_access_page_action_controller.h"
+#if 0
 #include "chrome/browser/web_applications/proto/web_app_install_state.pb.h"
 #include "chrome/browser/web_applications/web_app_install_manager.h"
 #include "chrome/browser/web_applications/web_app_install_manager_observer.h"
 #include "chrome/browser/web_applications/web_app_provider.h"
 #include "chrome/browser/web_applications/web_app_registrar.h"
+#endif
 #include "components/tabs/public/tab_interface.h"
 #if BUILDFLAG(ENABLE_PLATFORM_APPS)
 #include "extensions/browser/extension_registry.h"  // nogncheck
@@ -262,190 +264,10 @@ bool MaybeIsLocalUNCPath(const base::FilePath& path) {
 }
 #endif
 
-// Sentinel used to indicate that no PathService key is specified for a path in
-// the struct below.
-constexpr const int kNoBasePathKey = -1;
-
-// A wrapper around `base::NormalizeFilePath` that returns its result instead of
-// using an out parameter.
-base::FilePath NormalizeFilePath(const base::FilePath& path) {
-  base::FilePath absolute_path = path;
-  if (!absolute_path.IsAbsolute()) {
-    absolute_path = base::MakeAbsoluteFilePath(absolute_path);
-  }
-
-  if (absolute_path.empty()) {
-    return absolute_path;
-  }
-
-  // TODO(crbug.com/368130513O): On Windows, this call will fail if the target
-  // file path is greater than MAX_PATH. We should decide how to handle this
-  // scenario.
-  // If the path is invalid, the `base::NormalizeFilePath` will also return
-  // false, so we return the empty path.
-  base::FilePath normalized_path;
-  if (!base::NormalizeFilePath(absolute_path, &normalized_path)) {
-    return absolute_path;
-  }
-  CHECK_EQ(path.empty(), normalized_path.empty());
-  return normalized_path;
-}
-
-using BlockType = ChromeFileSystemAccessPermissionContext::BlockType;
-
-std::unique_ptr<ChromeFileSystemAccessPermissionContext::BlockPathRules>
-GenerateBlockPaths(bool should_normalize_file_path) {
-  static constexpr ChromeFileSystemAccessPermissionContext::BlockPath
-      kBlockPaths[] = {
-          // Don't allow users to share their entire home directory, entire
-          // desktop or entire documents folder, but do allow sharing anything
-          // inside those directories not otherwise blocked.
-          {base::DIR_HOME, nullptr, BlockType::kDontBlockChildren},
-          {base::DIR_USER_DESKTOP, nullptr, BlockType::kDontBlockChildren},
-          {chrome::DIR_USER_DOCUMENTS, nullptr, BlockType::kDontBlockChildren},
-          // Similar restrictions for the downloads directory.
-          {chrome::DIR_DEFAULT_DOWNLOADS, nullptr,
-           BlockType::kDontBlockChildren},
-          {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr,
-           BlockType::kDontBlockChildren},
-          // The Chrome installation itself should not be modified by the web.
-          {base::DIR_EXE, nullptr, BlockType::kBlockAllChildren},
-          {base::DIR_MODULE, nullptr, BlockType::kBlockAllChildren},
-          {base::DIR_ASSETS, nullptr, BlockType::kBlockAllChildren},
-          // And neither should the configuration of at least the currently
-          // running Chrome instance (note that this does not take
-          // --user-data-dir command line overrides into account).
-          {chrome::DIR_USER_DATA, nullptr, BlockType::kBlockAllChildren},
-          // ~/.ssh is pretty sensitive on all platforms, so block access to
-          // that.
-          {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"),
-           BlockType::kBlockAllChildren},
-          // And limit access to ~/.gnupg as well.
-          {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
-           BlockType::kBlockAllChildren},
-#if BUILDFLAG(IS_WIN)
-          // Some Windows specific directories to block, basically all apps, the
-          // operating system itself, as well as configuration data for apps.
-          {base::DIR_PROGRAM_FILES, nullptr, BlockType::kBlockAllChildren},
-          {base::DIR_PROGRAM_FILESX86, nullptr, BlockType::kBlockAllChildren},
-          {base::DIR_PROGRAM_FILES6432, nullptr, BlockType::kBlockAllChildren},
-          {base::DIR_WINDOWS, nullptr, BlockType::kBlockAllChildren},
-          {base::DIR_ROAMING_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-          {base::DIR_LOCAL_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-          {base::DIR_COMMON_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-          // Opening a file from an MTP device, such as a smartphone or a
-          // camera, is
-          // implemented by Windows as opening a file in the temporary internet
-          // files directory. To support that, allow opening files in that
-          // directory, but not whole directories.
-          {base::DIR_IE_INTERNET_CACHE, nullptr,
-           BlockType::kBlockNestedDirectories},
-#endif
-#if BUILDFLAG(IS_MAC)
-          // Similar Mac specific blocks.
-          {base::DIR_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-          // Block access to the current bundle directory.
-          {chrome::DIR_OUTER_BUNDLE, nullptr, BlockType::kBlockAllChildren},
-          // Block access to the user's Applications directory.
-          {base::DIR_HOME, FILE_PATH_LITERAL("Applications"),
-           BlockType::kBlockAllChildren},
-          // Block access to the root Applications directory.
-          {kNoBasePathKey, FILE_PATH_LITERAL("/Applications"),
-           BlockType::kBlockAllChildren},
-          {base::DIR_HOME, FILE_PATH_LITERAL("Library"),
-           BlockType::kBlockAllChildren},
-          // Allow access to other cloud files, such as Google Drive.
-          {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
-           BlockType::kDontBlockChildren},
-          // Allow the site to interact with data from its corresponding
-          // natively
-          // installed (sandboxed) application. It would be nice to limit a site
-          // to
-          // access only _its_ corresponding natively installed application, but
-          // unfortunately there's no straightforward way to do that. See
-          // https://crbug.com/984641#c22.
-          {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
-           BlockType::kDontBlockChildren},
-          // Allow access to iCloud files...
-          {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
-           BlockType::kDontBlockChildren},
-          // ... which may also appear at this directory.
-          {base::DIR_HOME,
-           FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
-           BlockType::kDontBlockChildren},
-#endif
-#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
-          // On Linux also block access to devices via /dev.
-          {kNoBasePathKey, FILE_PATH_LITERAL("/dev"),
-           BlockType::kBlockAllChildren},
-          // And security sensitive data in /proc and /sys.
-          {kNoBasePathKey, FILE_PATH_LITERAL("/proc"),
-           BlockType::kBlockAllChildren},
-          {kNoBasePathKey, FILE_PATH_LITERAL("/sys"),
-           BlockType::kBlockAllChildren},
-          // And system files in /boot and /etc.
-          {kNoBasePathKey, FILE_PATH_LITERAL("/boot"),
-           BlockType::kBlockAllChildren},
-          {kNoBasePathKey, FILE_PATH_LITERAL("/etc"),
-           BlockType::kBlockAllChildren},
-          // And block all of ~/.config, matching the similar restrictions on
-          // mac
-          // and windows.
-          {base::DIR_HOME, FILE_PATH_LITERAL(".config"),
-           BlockType::kBlockAllChildren},
-          // Block ~/.dbus as well, just in case, although there probably isn't
-          // much
-          // a website can do with access to that directory and its contents.
-          {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
-           BlockType::kBlockAllChildren},
-#endif
-#if BUILDFLAG(IS_ANDROID)
-          {base::DIR_ANDROID_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-          {base::DIR_CACHE, nullptr, BlockType::kBlockAllChildren},
-#endif
-          // TODO(crbug.com/40095723): Refine this list, for example add
-          // XDG_CONFIG_HOME when it is not set ~/.config?
-      };
-
-  // ChromeOS supports multi-user sign-in. base::DIR_HOME only returns the
-  // profile path for the primary user, the first user to sign in. We want to
-  // use the `profile_path` instead since that's associated with user that
-  // initiated this blocklist check.
-  //
-  // TODO(crbug.com/375490221): Improve the ChromeOS blocklist logic.
-  constexpr bool kUseProfilePathForDirHome = BUILDFLAG(IS_CHROMEOS);
-  // Populate the hard-coded rules.
-  auto block_path_rules = std::make_unique<
-      ChromeFileSystemAccessPermissionContext::BlockPathRules>();
-
-  for (const auto& blocked_path : kBlockPaths) {
-    base::FilePath path;
-    if (blocked_path.base_path_key != kNoBasePathKey) {
-      if (kUseProfilePathForDirHome &&
-          blocked_path.base_path_key == base::DIR_HOME) {
-        block_path_rules->profile_based_block_path_rules_.emplace_back(
-            blocked_path.path, blocked_path.type);
-        continue;
-      }
-
-      if (!base::PathService::Get(blocked_path.base_path_key, &path)) {
-        continue;
-      }
-
-      if (blocked_path.path) {
-        path = path.Append(blocked_path.path);
-      }
-    } else {
-      DCHECK(blocked_path.path);
-      path = base::FilePath(blocked_path.path);
-    }
-    block_path_rules->block_path_rules_.emplace_back(
-        should_normalize_file_path ? NormalizeFilePath(path) : path,
-        blocked_path.type);
-  }
-
-  return block_path_rules;
-}
+// This patch moves the deleted content from this file over to
+// chrome/browser/file_system_access/chrome_file_system_access_permission_context.h.
+// NOTE IF THERE IS A CONFLICT ABOVE, you will need to copy the changes in the
+// removed block over to chrome_file_system_access_permission_context.h.
 
 // Checks if `path` should be blocked by the `rules`.
 // The BlockType of the nearest ancestor of a path to check is what
@@ -1271,16 +1093,6 @@ struct ChromeFileSystemAccessPermissionContext::OriginState {
   std::unique_ptr<base::RetainingOneShotTimer> cleanup_timer;
 };
 
-ChromeFileSystemAccessPermissionContext::BlockPathRules::BlockPathRules() =
-    default;
-ChromeFileSystemAccessPermissionContext::BlockPathRules::~BlockPathRules() =
-    default;
-ChromeFileSystemAccessPermissionContext::BlockPathRules::BlockPathRules(
-    const BlockPathRules& other) = default;
-ChromeFileSystemAccessPermissionContext::BlockPathRules&
-ChromeFileSystemAccessPermissionContext::BlockPathRules::operator=(
-    const BlockPathRules& other) = default;
-
 ChromeFileSystemAccessPermissionContext::
     ChromeFileSystemAccessPermissionContext(content::BrowserContext* context,
                                             const base::Clock* clock)
@@ -1299,7 +1111,7 @@ ChromeFileSystemAccessPermissionContext::
 #if BUILDFLAG(IS_ANDROID)
   one_time_permissions_tracker_.Observe(
       OneTimePermissionsTrackerFactory::GetForBrowserContext(context));
-#else
+#elif 0
   auto* provider = web_app::WebAppProvider::GetForWebApps(
       Profile::FromBrowserContext(profile_));
   if (provider) {
@@ -2566,7 +2378,7 @@ void ChromeFileSystemAccessPermissionContext::OnShutdown() {
   one_time_permissions_tracker_.Reset();
 }
 
-#if !BUILDFLAG(IS_ANDROID)
+#if 0
 void ChromeFileSystemAccessPermissionContext::OnWebAppInstalled(
     const webapps::AppId& app_id) {
   if (!base::FeatureList::IsEnabled(
@@ -2901,11 +2713,7 @@ bool ChromeFileSystemAccessPermissionContext::
         HandleType handle_type,
         UserAction user_action,
         GrantType grant_type) {
-#if BUILDFLAG(IS_ANDROID)
-  // TODO(crbug.com/40101963): Enable when android persisted permissions are
-  // implemented.
-  return false;
-#else
+#elif 0
   if (!base::FeatureList::IsEnabled(
           features::kFileSystemAccessPersistentPermissions)) {
     return false;
@@ -2956,6 +2764,7 @@ bool ChromeFileSystemAccessPermissionContext::
 
   return false;
 #endif  // BUILDFLAG(IS_ANDROID)
+  return false;
 }
 
 std::vector<FileRequestData> ChromeFileSystemAccessPermissionContext::
diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
index 51bec8ef2a5212494625898fdeb500344525d8f4..6deb4b86b35c2ba38849e25af7691ac858dfaa3e 100644
--- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
+++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
@@ -9,10 +9,13 @@
 #include <vector>
 
 #include "base/auto_reset.h"
+#include "base/base_paths.h"
 #include "base/callback_list.h"
 #include "base/files/file_path.h"
+#include "base/files/file_util.h"
 #include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
+#include "base/path_service.h"
 #include "base/scoped_observation.h"
 #include "base/sequence_checker.h"
 #include "base/time/clock.h"
@@ -22,6 +25,7 @@
 #include "chrome/browser/file_system_access/file_system_access_permission_request_manager.h"
 #include "chrome/browser/permissions/one_time_permissions_tracker.h"
 #include "chrome/browser/permissions/one_time_permissions_tracker_observer.h"
+#include "chrome/common/chrome_paths.h"
 #include "components/enterprise/buildflags/buildflags.h"
 #include "components/permissions/features.h"
 #include "components/permissions/object_permission_context_base.h"
@@ -403,6 +407,191 @@ class ChromeFileSystemAccessPermissionContext
     return is_block_path_rules_init_complete_;
   }
 
+  // Sentinel used to indicate that no PathService key is specified for a path in
+  // the struct below.
+  static constexpr const int kNoBasePathKey = -1;
+
+  // A wrapper around `base::NormalizeFilePath` that returns its result instead of
+  // using an out parameter.
+  static base::FilePath NormalizeFilePath(const base::FilePath& path) {
+    base::FilePath absolute_path = path;
+    if (!absolute_path.IsAbsolute()) {
+      absolute_path = base::MakeAbsoluteFilePath(absolute_path);
+    }
+
+    if (absolute_path.empty()) {
+      return absolute_path;
+    }
+
+    // TODO(crbug.com/368130513O): On Windows, this call will fail if the target
+    // file path is greater than MAX_PATH. We should decide how to handle this
+    // scenario.
+    // If the path is invalid, the `base::NormalizeFilePath` will also return
+    // false, so we return the empty path.
+    base::FilePath normalized_path;
+    if (!base::NormalizeFilePath(absolute_path, &normalized_path)) {
+      return absolute_path;
+    }
+    CHECK_EQ(path.empty(), normalized_path.empty());
+    return normalized_path;
+  }
+
+  using BlockType = ChromeFileSystemAccessPermissionContext::BlockType;
+
+  static std::unique_ptr<ChromeFileSystemAccessPermissionContext::BlockPathRules>
+  GenerateBlockPaths(bool should_normalize_file_path) {
+    static constexpr ChromeFileSystemAccessPermissionContext::BlockPath
+        kBlockPaths[] = {
+            // Don't allow users to share their entire home directory, entire
+            // desktop or entire documents folder, but do allow sharing anything
+            // inside those directories not otherwise blocked.
+            {base::DIR_HOME, nullptr, BlockType::kDontBlockChildren},
+            {base::DIR_USER_DESKTOP, nullptr, BlockType::kDontBlockChildren},
+            {chrome::DIR_USER_DOCUMENTS, nullptr, BlockType::kDontBlockChildren},
+            // Similar restrictions for the downloads directory.
+            {chrome::DIR_DEFAULT_DOWNLOADS, nullptr,
+            BlockType::kDontBlockChildren},
+            {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr,
+            BlockType::kDontBlockChildren},
+            // The Chrome installation itself should not be modified by the web.
+            {base::DIR_EXE, nullptr, BlockType::kBlockAllChildren},
+            {base::DIR_MODULE, nullptr, BlockType::kBlockAllChildren},
+            {base::DIR_ASSETS, nullptr, BlockType::kBlockAllChildren},
+            // And neither should the configuration of at least the currently
+            // running Chrome instance (note that this does not take
+            // --user-data-dir command line overrides into account).
+            {chrome::DIR_USER_DATA, nullptr, BlockType::kBlockAllChildren},
+            // ~/.ssh is pretty sensitive on all platforms, so block access to
+            // that.
+            {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"),
+            BlockType::kBlockAllChildren},
+            // And limit access to ~/.gnupg as well.
+            {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
+            BlockType::kBlockAllChildren},
+  #if BUILDFLAG(IS_WIN)
+            // Some Windows specific directories to block, basically all apps, the
+            // operating system itself, as well as configuration data for apps.
+            {base::DIR_PROGRAM_FILES, nullptr, BlockType::kBlockAllChildren},
+            {base::DIR_PROGRAM_FILESX86, nullptr, BlockType::kBlockAllChildren},
+            {base::DIR_PROGRAM_FILES6432, nullptr, BlockType::kBlockAllChildren},
+            {base::DIR_WINDOWS, nullptr, BlockType::kBlockAllChildren},
+            {base::DIR_ROAMING_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+            {base::DIR_LOCAL_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+            {base::DIR_COMMON_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+            // Opening a file from an MTP device, such as a smartphone or a
+            // camera, is
+            // implemented by Windows as opening a file in the temporary internet
+            // files directory. To support that, allow opening files in that
+            // directory, but not whole directories.
+            {base::DIR_IE_INTERNET_CACHE, nullptr,
+            BlockType::kBlockNestedDirectories},
+  #endif
+  #if BUILDFLAG(IS_MAC)
+            // Similar Mac specific blocks.
+            {base::DIR_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+            // Block access to the current bundle directory.
+            {chrome::DIR_OUTER_BUNDLE, nullptr, BlockType::kBlockAllChildren},
+            // Block access to the user's Applications directory.
+            {base::DIR_HOME, FILE_PATH_LITERAL("Applications"),
+            BlockType::kBlockAllChildren},
+            // Block access to the root Applications directory.
+            {kNoBasePathKey, FILE_PATH_LITERAL("/Applications"),
+            BlockType::kBlockAllChildren},
+            {base::DIR_HOME, FILE_PATH_LITERAL("Library"),
+            BlockType::kBlockAllChildren},
+            // Allow access to other cloud files, such as Google Drive.
+            {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
+            BlockType::kDontBlockChildren},
+            // Allow the site to interact with data from its corresponding
+            // natively
+            // installed (sandboxed) application. It would be nice to limit a site
+            // to
+            // access only _its_ corresponding natively installed application, but
+            // unfortunately there's no straightforward way to do that. See
+            // https://crbug.com/984641#c22.
+            {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
+            BlockType::kDontBlockChildren},
+            // Allow access to iCloud files...
+            {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
+            BlockType::kDontBlockChildren},
+            // ... which may also appear at this directory.
+            {base::DIR_HOME,
+            FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
+            BlockType::kDontBlockChildren},
+  #endif
+  #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
+            // On Linux also block access to devices via /dev.
+            {kNoBasePathKey, FILE_PATH_LITERAL("/dev"),
+            BlockType::kBlockAllChildren},
+            // And security sensitive data in /proc and /sys.
+            {kNoBasePathKey, FILE_PATH_LITERAL("/proc"),
+            BlockType::kBlockAllChildren},
+            {kNoBasePathKey, FILE_PATH_LITERAL("/sys"),
+            BlockType::kBlockAllChildren},
+            // And system files in /boot and /etc.
+            {kNoBasePathKey, FILE_PATH_LITERAL("/boot"),
+            BlockType::kBlockAllChildren},
+            {kNoBasePathKey, FILE_PATH_LITERAL("/etc"),
+            BlockType::kBlockAllChildren},
+            // And block all of ~/.config, matching the similar restrictions on
+            // mac
+            // and windows.
+            {base::DIR_HOME, FILE_PATH_LITERAL(".config"),
+            BlockType::kBlockAllChildren},
+            // Block ~/.dbus as well, just in case, although there probably isn't
+            // much
+            // a website can do with access to that directory and its contents.
+            {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
+            BlockType::kBlockAllChildren},
+  #endif
+  #if BUILDFLAG(IS_ANDROID)
+            {base::DIR_ANDROID_APP_DATA, nullptr, BlockType::kBlockAllChildren},
+            {base::DIR_CACHE, nullptr, BlockType::kBlockAllChildren},
+  #endif
+            // TODO(crbug.com/40095723): Refine this list, for example add
+            // XDG_CONFIG_HOME when it is not set ~/.config?
+        };
+
+    // ChromeOS supports multi-user sign-in. base::DIR_HOME only returns the
+    // profile path for the primary user, the first user to sign in. We want to
+    // use the `profile_path` instead since that's associated with user that
+    // initiated this blocklist check.
+    //
+    // TODO(crbug.com/375490221): Improve the ChromeOS blocklist logic.
+    constexpr bool kUseProfilePathForDirHome = BUILDFLAG(IS_CHROMEOS);
+    // Populate the hard-coded rules.
+    auto block_path_rules = std::make_unique<
+        ChromeFileSystemAccessPermissionContext::BlockPathRules>();
+
+    for (const auto& blocked_path : kBlockPaths) {
+      base::FilePath path;
+      if (blocked_path.base_path_key != kNoBasePathKey) {
+        if (kUseProfilePathForDirHome &&
+            blocked_path.base_path_key == base::DIR_HOME) {
+          block_path_rules->profile_based_block_path_rules_.emplace_back(
+              blocked_path.path, blocked_path.type);
+          continue;
+        }
+
+        if (!base::PathService::Get(blocked_path.base_path_key, &path)) {
+          continue;
+        }
+
+        if (blocked_path.path) {
+          path = path.Append(blocked_path.path);
+        }
+      } else {
+        DCHECK(blocked_path.path);
+        path = base::FilePath(blocked_path.path);
+      }
+      block_path_rules->block_path_rules_.emplace_back(
+          should_normalize_file_path ? NormalizeFilePath(path) : path,
+          blocked_path.type);
+    }
+
+    return block_path_rules;
+  }
+
  protected:
   SEQUENCE_CHECKER(sequence_checker_);
 
