From 794a6f40769d20eaa92b6674c9dff3e28f802440 Mon Sep 17 00:00:00 2001
From: Alex Rudenko <alexrudenko@chromium.org>
Date: Tue, 11 Jun 2024 13:44:12 +0200
Subject: [PATCH] fix: configure sandbox permissions for Chrome on Windows

---
 packages/browsers/src/install.ts | 35 +++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/packages/browsers/src/install.ts b/packages/browsers/src/install.ts
index f585021df2f..a2a307b75b5 100644
--- a/packages/browsers/src/install.ts
+++ b/packages/browsers/src/install.ts
@@ -5,6 +5,7 @@
  */
 
 import assert from 'assert';
+import {spawnSync} from 'child_process';
 import {existsSync} from 'fs';
 import {mkdir, unlink} from 'fs/promises';
 import os from 'os';
@@ -187,7 +188,8 @@ async function installUrl(
   url: URL,
   options: InstallOptions
 ): Promise<InstalledBrowser | string> {
-  options.platform ??= detectBrowserPlatform();
+  const detectedPlatform = detectBrowserPlatform();
+  options.platform ??= detectedPlatform;
   if (!options.platform) {
     throw new Error(
       `Cannot download a binary for the provided platform: ${os.platform()} (${os.arch()})`
@@ -249,6 +251,22 @@ async function installUrl(
     } finally {
       debugTimeEnd('extract');
     }
+
+    // On Windows for Chrome invoke setup.exe to configure sandboxes.
+    if (
+      (detectedPlatform === BrowserPlatform.WIN32 ||
+        detectedPlatform === BrowserPlatform.WIN64) &&
+      options.platform === detectedPlatform &&
+      options.browser === Browser.CHROME
+    ) {
+      try {
+        debugTime('permissions');
+        await runSetup(outputPath);
+      } finally {
+        debugTimeEnd('permissions');
+      }
+    }
+
     const installedBrowser = new InstalledBrowser(
       cache,
       options.browser,
@@ -268,6 +286,21 @@ async function installUrl(
   }
 }
 
+async function runSetup(outputPath: string) {
+  const result = spawnSync(
+    path.join(outputPath, 'setup.exe'),
+    ['--configure-browser-in-directory', outputPath],
+    {
+      shell: true,
+    }
+  );
+  if (result.status !== 0) {
+    throw new Error(
+      `Failed to set permissions for ${outputPath}: ${result.stderr.toString('utf8')}`
+    );
+  }
+}
+
 /**
  * @public
  */