Cache Storage: restrict access to secure origins (Chromium-side)

content/browser/cache_storage/cache_storage_dispatcher_host.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/cache_storage/cache_storage_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/trace_event/trace_event.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/cache_storage/cache_storage_cache.h"
 #include "content/browser/cache_storage/cache_storage_context_impl.h"
 #include "content/browser/cache_storage/cache_storage_manager.h"
 #include "content/common/cache_storage/cache_storage_messages.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/origin_util.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "third_party/WebKit/public/platform/WebServiceWorkerCacheError.h"
 
 namespace content {
 
 namespace {
 
 const uint32 kFilteredMessageClasses[] = {CacheStorageMsgStart};
 
 blink::WebServiceWorkerCacheError ToWebServiceWorkerCacheError(
     CacheStorageError err) {
   switch (err) {
     case CACHE_STORAGE_OK:
       NOTREACHED();
       return blink::WebServiceWorkerCacheErrorNotImplemented;
     case CACHE_STORAGE_ERROR_EXISTS:
       return blink::WebServiceWorkerCacheErrorExists;
     case CACHE_STORAGE_ERROR_STORAGE:
       // TODO(nhiroki): Add WebServiceWorkerCacheError equivalent to
       // CACHE_STORAGE_ERROR_STORAGE.
       return blink::WebServiceWorkerCacheErrorNotFound;
     case CACHE_STORAGE_ERROR_NOT_FOUND:
       return blink::WebServiceWorkerCacheErrorNotFound;
   }
   NOTREACHED();
   return blink::WebServiceWorkerCacheErrorNotImplemented;
 }
 
+bool OriginCanAccessCacheStorage(const GURL& url) {
+  return IsOriginSecure(url);
+}
+
 }  // namespace
 
 CacheStorageDispatcherHost::CacheStorageDispatcherHost()
     : BrowserMessageFilter(kFilteredMessageClasses,
                            arraysize(kFilteredMessageClasses)) {
 }
 
 CacheStorageDispatcherHost::~CacheStorageDispatcherHost() {
 }
 
@@ skipping 41 matching lines @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   context_ = context;
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageHas(
     int thread_id,
     int request_id,
     const GURL& origin,
     const base::string16& cache_name) {
   TRACE_EVENT0("CacheStorage", "CacheStorageDispatcherHost::OnCacheStorageHas");
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   context_->cache_manager()->HasCache(
       origin, base::UTF16ToUTF8(cache_name),
       base::Bind(&CacheStorageDispatcherHost::OnCacheStorageHasCallback, this,
                  thread_id, request_id));
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageOpen(
     int thread_id,
     int request_id,
     const GURL& origin,
     const base::string16& cache_name) {
   TRACE_EVENT0("CacheStorage",
                "CacheStorageDispatcherHost::OnCacheStorageOpen");
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   context_->cache_manager()->OpenCache(
       origin, base::UTF16ToUTF8(cache_name),
       base::Bind(&CacheStorageDispatcherHost::OnCacheStorageOpenCallback, this,
                  thread_id, request_id));
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageDelete(
     int thread_id,
     int request_id,
     const GURL& origin,
     const base::string16& cache_name) {
   TRACE_EVENT0("CacheStorage",
                "CacheStorageDispatcherHost::OnCacheStorageDelete");
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   context_->cache_manager()->DeleteCache(
       origin, base::UTF16ToUTF8(cache_name),
       base::Bind(&CacheStorageDispatcherHost::OnCacheStorageDeleteCallback,
                  this, thread_id, request_id));
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageKeys(int thread_id,
                                                     int request_id,
                                                     const GURL& origin) {
   TRACE_EVENT0("CacheStorage",
                "CacheStorageDispatcherHost::OnCacheStorageKeys");
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   context_->cache_manager()->EnumerateCaches(
       origin,
       base::Bind(&CacheStorageDispatcherHost::OnCacheStorageKeysCallback, this,
                  thread_id, request_id));
 }
 
 void CacheStorageDispatcherHost::OnCacheStorageMatch(
     int thread_id,
     int request_id,
     const GURL& origin,
     const ServiceWorkerFetchRequest& request,
     const CacheStorageCacheQueryParams& match_params) {
   TRACE_EVENT0("CacheStorage",
                "CacheStorageDispatcherHost::OnCacheStorageMatch");
-
+  if (!OriginCanAccessCacheStorage(origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::CSDH_INVALID_ORIGIN);
+    return;
+  }
   scoped_ptr<ServiceWorkerFetchRequest> scoped_request(
       new ServiceWorkerFetchRequest(request.url, request.method,
                                     request.headers, request.referrer,
                                     request.is_reload));
 
   if (match_params.cache_name.empty()) {
     context_->cache_manager()->MatchAllCaches(
         origin, scoped_request.Pass(),
         base::Bind(&CacheStorageDispatcherHost::OnCacheStorageMatchCallback,
                    this, thread_id, request_id));
@@ skipping 249 matching lines @@
   UUIDToBlobDataHandleList::iterator it = blob_handle_store_.find(uuid);
   if (it == blob_handle_store_.end())
     return;
   DCHECK(!it->second.empty());
   it->second.pop_front();
   if (it->second.empty())
     blob_handle_store_.erase(it);
 }
 
 }  // namespace content