Cache Storage: restrict access to secure origins (Chromium-side)

content/browser/cache_storage/cache_storage_dispatcher_host.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/cache_storage/cache_storage_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/trace_event/trace_event.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/cache_storage/cache_storage_cache.h"
 #include "content/browser/cache_storage/cache_storage_context_impl.h"
 #include "content/browser/cache_storage/cache_storage_manager.h"
 #include "content/common/cache_storage/cache_storage_messages.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/origin_util.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "third_party/WebKit/public/platform/WebServiceWorkerCacheError.h"
 
 namespace content {
 
 namespace {
 
 const uint32 kFilteredMessageClasses[] = {CacheStorageMsgStart};
 
 blink::WebServiceWorkerCacheError ToWebServiceWorkerCacheError(
     CacheStorageError err) {
   switch (err) {
     case CACHE_STORAGE_OK:
       NOTREACHED();
       return blink::WebServiceWorkerCacheErrorNotImplemented;
     case CACHE_STORAGE_ERROR_EXISTS:
       return blink::WebServiceWorkerCacheErrorExists;
     case CACHE_STORAGE_ERROR_STORAGE:
       // TODO(nhiroki): Add WebServiceWorkerCacheError equivalent to
       // CACHE_STORAGE_ERROR_STORAGE.
       return blink::WebServiceWorkerCacheErrorNotFound;
     case CACHE_STORAGE_ERROR_NOT_FOUND:
       return blink::WebServiceWorkerCacheErrorNotFound;
   }
   NOTREACHED();
   return blink::WebServiceWorkerCacheErrorNotImplemented;
 }
 
+bool OriginCanAccessCacheStorage(const GURL& url) {
+  // TODO(jsbell): Further restrict to HTTPS, like Service Workers?

[Mike West, 2015/06/18 19:57:14]

Aren't service workers available to any "secure context"? localhost, 127.0.0.1,
whatever's been whitelisted via command-line flag, etc?

[jsbell, 2015/06/18 20:00:04]

Whoops, the TODO is incorrect. I mean to refer to this line:

https://code.google.com/p/chromium/codesearch#chromium/src/content/browser/se...

... which additionally checks SchemeIsHTTPOrHTTPS(). That's an added restriction
by SWs on top of the usual "secure features" check. ISTM that we don't want that
here, i.e. just remove the TODO, but wanted to raise the issue for comment.

+  return IsOriginSecure(url);
+}
+
 }  // namespace
 
 CacheStorageDispatcherHost::CacheStorageDispatcherHost()
     : BrowserMessageFilter(kFilteredMessageClasses,
                            arraysize(kFilteredMessageClasses)) {
 }
 
 CacheStorageDispatcherHost::~CacheStorageDispatcherHost() {
 }
 
@@ skipping 41 matching lines @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   context_ = context;
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageHas(
     int thread_id,
     int request_id,
     const GURL& origin,
     const base::string16& cache_name) {
   TRACE_EVENT0("CacheStorage", "CacheStorageDispatcherHost::OnCacheStorageHas");
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   context_->cache_manager()->HasCache(
       origin, base::UTF16ToUTF8(cache_name),
       base::Bind(&CacheStorageDispatcherHost::OnCacheStorageHasCallback, this,
                  thread_id, request_id));
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageOpen(
     int thread_id,
     int request_id,
     const GURL& origin,
     const base::string16& cache_name) {
   TRACE_EVENT0("CacheStorage",
                "CacheStorageDispatcherHost::OnCacheStorageOpen");
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   context_->cache_manager()->OpenCache(
       origin, base::UTF16ToUTF8(cache_name),
       base::Bind(&CacheStorageDispatcherHost::OnCacheStorageOpenCallback, this,
                  thread_id, request_id));
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageDelete(
     int thread_id,
     int request_id,
     const GURL& origin,
     const base::string16& cache_name) {
   TRACE_EVENT0("CacheStorage",
                "CacheStorageDispatcherHost::OnCacheStorageDelete");
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   context_->cache_manager()->DeleteCache(
       origin, base::UTF16ToUTF8(cache_name),
       base::Bind(&CacheStorageDispatcherHost::OnCacheStorageDeleteCallback,
                  this, thread_id, request_id));
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageKeys(int thread_id,
                                                     int request_id,
                                                     const GURL& origin) {
   TRACE_EVENT0("CacheStorage",
                "CacheStorageDispatcherHost::OnCacheStorageKeys");
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   context_->cache_manager()->EnumerateCaches(
       origin,
       base::Bind(&CacheStorageDispatcherHost::OnCacheStorageKeysCallback, this,
                  thread_id, request_id));
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageMatch(
     int thread_id,
     int request_id,
     const GURL& origin,
     const ServiceWorkerFetchRequest& request,
     const CacheStorageCacheQueryParams& match_params) {
   TRACE_EVENT0("CacheStorage",
                "CacheStorageDispatcherHost::OnCacheStorageMatch");
-
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   scoped_ptr<ServiceWorkerFetchRequest> scoped_request(
       new ServiceWorkerFetchRequest(request.url, request.method,
                                     request.headers, request.referrer,
                                     request.is_reload));
 
   if (match_params.cache_name.empty()) {
     context_->cache_manager()->MatchAllCaches(
         origin, scoped_request.Pass(),
         base::Bind(&CacheStorageDispatcherHost::OnCacheStorageMatchCallback,
                    this, thread_id, request_id));
@@ skipping 256 matching lines @@
   UUIDToBlobDataHandleList::iterator it = blob_handle_store_.find(uuid);
   if (it == blob_handle_store_.end())
     return;
   DCHECK(!it->second.empty());
   it->second.pop_front();
   if (it->second.empty())
     blob_handle_store_.erase(it);
 }
 
 }  // namespace content