[ads] RichNTT: Desktop

[tmancey]

Resolves brave/brave-browser#43512

Submitter Checklist:

• I confirm that no security/privacy review is needed and no other type of reviews are needed, or that I have requested them
• There is a ticket for my issue
• Used Github auto-closing keywords in the PR description above
• Wrote a good PR/commit description
• Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
• Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
• Checked the PR locally:
  • npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
  • npm run presubmit wiki, npm run gn_check, npm run tslint
• Ran git rebase master (if needed)

Reviewer Checklist:

• A security review is not needed, or a link to one is included in the PR description
• New files have MPL-2.0 license header
• Adequate test coverage exists to prevent regressions
• Major classes, functions and non-trivial code blocks are well-commented
• Changes in component dependencies are properly reflected in gn
• Code follows the style guide
• Test plan is specified in PR before merging

After-merge Checklist:

• The associated issue milestone is set to the smallest version that the
  changes has landed on
• All relevant documentation has been updated, for instance:
  • https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)
  • https://github.com/brave/brave-browser/wiki/Proxy-redirected-URLs
  • https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections
  • https://github.com/brave/brave-browser/wiki/Brave%E2%80%99s-Use-of-Referral-Codes
  • https://github.com/brave/brave-browser/wiki/Web-Compatibility-Exceptions-in-Brave
  • https://github.com/brave/brave-browser/wiki/QA-Guide
  • https://github.com/brave/brave-browser/wiki/P3A

Test Plan:

[tmancey]

@ShivanKaul @aseren is working on adding the missing tests. Thanks

[zenparsing]

Front-end 👍

[tmancey]

Shivan has closed security/privacy review. cc @ShivanKaul

Agreed in comments this is ok as images are small

[github-actions]

[puLL-Merge] - brave/brave-core@27466

Here's my review of the PR:

Description

This PR adds support for rich media sponsored backgrounds in the New Tab Page (NTP). It allows for more interactive and dynamic sponsored content to be displayed as backgrounds, including HTML/CSS/JS content. The PR includes new handling for rich media ads, content security policy (CSP) enforcement, and proper sandboxing of this content.

Possible Issues

1. Rich media backgrounds could potentially impact performance of the New Tab Page since they require loading and executing additional content
2. Need to ensure proper monitoring and metrics are in place to detect any issues with rich media backgrounds in production

Security Hotspots

1. Resource Loading: The GetContentSecurityPolicy implementation in ntp_sponsored_rich_media_source.cc is critical for preventing unauthorized resource loading. Any changes to this need careful review.
2. Path Traversal: The path sanitization logic in ntp_sponsored_source_util.cc helps prevent directory traversal attacks. The implementation looks solid but this is a key security control.
3. Message Passing: The postMessage communication between rich media content and the browser needs proper origin verification in sponsored_rich_media_background.tsx.

Changes

Changes

By filename:

browser/ntp_background/BUILD.gn:

• Added new test files and dependencies

browser/ntp_background/ntp_sponsored_rich_media_browsertest.cc:

• Added new browser tests for rich media content loading and interaction

browser/ntp_background/ntp_sponsored_rich_media_with_csp_violation_browsertest.cc:

• Added tests to verify CSP blocks unauthorized resource loading

components/brave_new_tab_ui/:

• Added rich media background support to NTP UI
• Added message passing for rich media events
• Updated background types and handling

components/ntp_background_images/browser/:

• Added new rich media source handler
• Added event handling for rich media ads
• Added utilities for path validation
• Updated data structures to support rich media content

sequenceDiagram
    participant NTP as New Tab Page
    participant Handler as RichMediaHandler
    participant Service as BackgroundService
    participant Source as RichMediaSource
    
    NTP->>Service: Request background
    Service->>Source: Load rich media content
    Source->>Source: Validate paths & CSP
    Source->>NTP: Return content
    NTP->>Handler: Initialize rich media
    Note over NTP,Handler: Secure iframe sandbox
    Handler->>Service: Report events
    Service->>Service: Process metrics

Loading