Cache Storage: restrict access to secure origins (Blink-side)

Source/modules/cachestorage/CacheStorage.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/cachestorage/CacheStorage.h"
 
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "core/dom/DOMException.h"
 #include "core/dom/ExceptionCode.h"
 #include "modules/cachestorage/CacheStorageError.h"
 #include "modules/fetch/Request.h"
 #include "modules/fetch/Response.h"
 #include "public/platform/WebServiceWorkerCacheError.h"
 #include "public/platform/WebServiceWorkerCacheStorage.h"
 
 namespace blink {
 
 namespace {
 
 DOMException* createNoImplementationException()
 {
     return DOMException::create(NotSupportedError, "No CacheStorage implementation provided.");
 }
 
+bool commonChecks(ScriptState* scriptState, ExceptionState& exceptionState)
+{
+    ExecutionContext* executionContext = scriptState->executionContext();
+    // FIXME: May be null due to worker termination: http://crbug.com/413518.
+    if (!executionContext)
+        return false;
+
+    String errorMessage;
+    if (!executionContext->isPrivilegedContext(errorMessage)) {
+        exceptionState.throwSecurityError(errorMessage);
+        return false;
+    }
+    return true;
+}
+
 }
 
 // FIXME: Consider using CallbackPromiseAdapter.
 class CacheStorage::Callbacks final : public WebServiceWorkerCacheStorage::CacheStorageCallbacks {
     WTF_MAKE_NONCOPYABLE(Callbacks);
 public:
     explicit Callbacks(PassRefPtrWillBeRawPtr<ScriptPromiseResolver> resolver)
         : m_resolver(resolver) { }
     ~Callbacks() override { }
 
@@ skipping 139 matching lines @@
     {
         OwnPtr<WebServiceWorkerCacheError> reason = adoptPtr(rawReason);
         m_resolver->reject(CacheStorageError::createException(*reason));
         m_resolver.clear();
     }
 
 private:
     RefPtrWillBePersistent<ScriptPromiseResolver> m_resolver;
 };
 
+// static
+bool CacheStorage::canAccessCacheStorage(ExecutionContext* executionContext, String* errorMessage)
+{
+    String ignored;
+    if (!errorMessage)
+        errorMessage = &ignored;
+    return executionContext->isPrivilegedContext(*errorMessage);
+}
+
+// static
 CacheStorage* CacheStorage::create(WeakPtr<GlobalFetch::ScopedFetcher> fetcher, WebServiceWorkerCacheStorage* webCacheStorage)
 {
     return new CacheStorage(fetcher, adoptPtr(webCacheStorage));
 }
 
-ScriptPromise CacheStorage::open(ScriptState* scriptState, const String& cacheName)
+ScriptPromise CacheStorage::open(ScriptState* scriptState, const String& cacheName, ExceptionState& exceptionState)
 {
+    if (!commonChecks(scriptState, exceptionState))
+        return ScriptPromise();
+
     RefPtrWillBeRawPtr<ScriptPromiseResolver> resolver = ScriptPromiseResolver::create(scriptState);
     const ScriptPromise promise = resolver->promise();
 
     if (m_nameToCacheMap.contains(cacheName)) {
         Cache* cache = m_nameToCacheMap.find(cacheName)->value;
         resolver->resolve(cache);
         return promise;
     }
 
     if (m_webCacheStorage)
         m_webCacheStorage->dispatchOpen(new WithCacheCallbacks(cacheName, this, resolver), cacheName);
     else
         resolver->reject(createNoImplementationException());
 
     return promise;
 }
 
-ScriptPromise CacheStorage::has(ScriptState* scriptState, const String& cacheName)
+ScriptPromise CacheStorage::has(ScriptState* scriptState, const String& cacheName, ExceptionState& exceptionState)
 {
+    if (!commonChecks(scriptState, exceptionState))
+        return ScriptPromise();
+
     RefPtrWillBeRawPtr<ScriptPromiseResolver> resolver = ScriptPromiseResolver::create(scriptState);
     const ScriptPromise promise = resolver->promise();
 
     if (m_nameToCacheMap.contains(cacheName)) {
         resolver->resolve(true);
         return promise;
     }
 
     if (m_webCacheStorage)
         m_webCacheStorage->dispatchHas(new Callbacks(resolver), cacheName);
     else
         resolver->reject(createNoImplementationException());
 
     return promise;
 }
 
-ScriptPromise CacheStorage::deleteFunction(ScriptState* scriptState, const String& cacheName)
+ScriptPromise CacheStorage::deleteFunction(ScriptState* scriptState, const String& cacheName, ExceptionState& exceptionState)
 {
+    if (!commonChecks(scriptState, exceptionState))
+        return ScriptPromise();
+
     RefPtrWillBeRawPtr<ScriptPromiseResolver> resolver = ScriptPromiseResolver::create(scriptState);
     const ScriptPromise promise = resolver->promise();
 
     if (m_webCacheStorage)
         m_webCacheStorage->dispatchDelete(new DeleteCallbacks(cacheName, this, resolver), cacheName);
     else
         resolver->reject(createNoImplementationException());
 
     return promise;
 }
 
-ScriptPromise CacheStorage::keys(ScriptState* scriptState)
+ScriptPromise CacheStorage::keys(ScriptState* scriptState, ExceptionState& exceptionState)
 {
+    if (!commonChecks(scriptState, exceptionState))
+        return ScriptPromise();
+
     RefPtrWillBeRawPtr<ScriptPromiseResolver> resolver = ScriptPromiseResolver::create(scriptState);
     const ScriptPromise promise = resolver->promise();
 
     if (m_webCacheStorage)
         m_webCacheStorage->dispatchKeys(new KeysCallbacks(resolver));
     else
         resolver->reject(createNoImplementationException());
 
     return promise;
 }
 
 ScriptPromise CacheStorage::match(ScriptState* scriptState, const RequestInfo& request, const CacheQueryOptions& options, ExceptionState& exceptionState)
 {
     ASSERT(!request.isNull());
+    if (!commonChecks(scriptState, exceptionState))
+        return ScriptPromise();
 
     if (request.isRequest())
         return matchImpl(scriptState, request.getAsRequest(), options);
     Request* newRequest = Request::create(scriptState, request.getAsUSVString(), exceptionState);
     if (exceptionState.hadException())
         return ScriptPromise();
     return matchImpl(scriptState, newRequest, options);
 }
 
 ScriptPromise CacheStorage::matchImpl(ScriptState* scriptState, const Request* request, const CacheQueryOptions& options)
@@ skipping 26 matching lines @@
 {
     m_webCacheStorage.clear();
 }
 
 DEFINE_TRACE(CacheStorage)
 {
     visitor->trace(m_nameToCacheMap);
 }
 
 } // namespace blink