OpenSearch not properly picking up search suggestion API

[signalno11]

Preliminary checklist

• I have read the README.
• I have searched the existing issues for my problem. This is a new ticket, NOT a duplicate or related to another open issue.
• I have read the FAQs.
• I have updated Cromite to the latest version. The bug is reproducible on this latest version.
• This is a bug report about the Cromite browser; not the website nor F-Droid nor anything else.

Can the bug be reproduced with corresponding Chromium version?

Yes

Cromite version

119.0.6045.160

Device architecture

arm64

Platform version

Android 13

Android Device model

SM-A426UI\DS

Is the device rooted?

No

Changed flags

No flags changed

Is this bug happening in an incognito tab?

Yes

Is this bug caused by the adblocker?

No

Is this bug a crash?

No

Describe the bug

No search suggestions, either using Google or using Brave Search. I tested in Chromium. Google search suggestions worked fine. Brave Search suggestions didn't work.

So one part is that Google search suggestions don't work.

The other part is that Brave's suggestions don't work, here or in Chromium. Firefox has a field where you can add an address to query for search suggestions.

On Firefox, adding either https://google.com/complete/search?client=firefox&q=%s or https://search.brave.com/api/suggest?q=%s proved to be sufficient.

Both of these addresses are provided in the OpenSearch data for each respective page, so it seems Chromite is simply not picking it up correctly.

Steps to reproduce the bug

1. Search for something

Expected behavior

There are search suggestions

Screenshots

Details

[uazo]

https://cdn.search.brave.com/serp/v2/_app/immutable/assets/opensearch.8acac4ab.xml

this is the manifest of brave search:

<OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/">
  <ShortName>Brave</ShortName>
  <Description>Brave Search: private, independent, open</Description>
  <InputEncoding>UTF-8</InputEncoding>
  <Image width="32" height="32" type="image/png">https://cdn.search.brave.com/serp/v1/static/brand/eebf5f2ce06b0b0ee6bbd72d7e18621d4618b9663471d42463c692d019068072-brave-lion-favicon.png</Image>
  <Url type="text/html" method="GET" template="https://search.brave.com/search?q={searchTerms}"/>
  <Url type="application/x-suggestions+json" method="GET" template="https://search.brave.com/api/suggest?q={searchTerms}"/>
</OpenSearchDescription>

this the excerpt from preferences:

   "default_search_provider_data": {
      "template_url_data": {
         "metadata": [ "user_controlled", "user_modifiable" ],
         "value": {
            "alternate_urls": [  ],
            "contextual_search_url": "",
            "created_by_policy": false,
            "created_from_play_api": false,
            "date_created": "13344679958833584",
            "doodle_url": "",
            "enforced_by_policy": false,
            "favicon_url": "https://cdn.search.brave.com/serp/v2/_app/immutable/assets/apple-touch-icon.5a2b672b.png",
            "id": "12",
            "image_search_branding_label": "",
            "image_translate_source_language_param_key": "",
            "image_translate_target_language_param_key": "",
            "image_translate_url": "",
            "image_url": "",
            "image_url_post_params": "",
            "input_encodings": [ "UTF-8" ],
            "is_active": 1,
            "keyword": "search.brave.com",
            "last_modified": "13344679958833596",
            "last_visited": "13344680010716395",
            "logo_url": "",
            "new_tab_url": "",
            "originating_url": "",
            "preconnect_to_search_url": false,
            "prefetch_likely_navigations": false,
            "prepopulate_id": 0,
            "safe_for_autoreplace": true,
            "search_intent_params": [  ],
            "search_url_post_params": "",
            "short_name": "search.brave.com",
            "side_image_search_param": "",
            "side_search_param": "",
            "starter_pack_id": 0,
--->        "suggestions_url": "",                                       
            "suggestions_url_post_params": "",
            "synced_guid": "cb7af569-f47f-47c9-9933-e29bc9041ad0",
            "url": "https://search.brave.com/search?q={searchTerms}&source=web",
            "usage_count": 0
         }
      }
   },

suggestions_url is empty.

[uazo]

I am checking, it seems that the https call to the manifest is being blocked.
from memory it seems like something I have seen before, but I cannot find the corresponding issue, I seem to remember that the response header was not consistent with the resource type.
I will check again as soon as possible.

[uazo]

so, the problem is context.

url = https://cdn.search.brave.com/serp/v2/_app/immutable/assets/opensearch.8acac4ab.xml
initiator = https://search.brave.com

in this case corb (orb in chromium) intervenes to block the request, since the header marks the xml result as nosniff, resulting in one of corb's blocking rules https://github.com/annevk/orb#orbs-algorithm being the initiator of a different origin
brave should move the xml to search.brave.com or check the cdn headers
and I don't think this is a behaviour of cromite alone, but of all Chromium

[uazo]

but in any case the request is not resolved, and would be permanently solved if the user could change those values.
so i'm trying #556 desktop ui activation in android, but it's a mess. I write the results there