Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(151)

Side by Side Diff: content/browser/loader/resource_dispatcher_host_impl.cc

Issue 1608573002: RDH: Block a compromised renderer from reusing request ids (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Address comments Created 4 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // See http://dev.chromium.org/developers/design-documents/multi-process-resourc e-loading 5 // See http://dev.chromium.org/developers/design-documents/multi-process-resourc e-loading
6 6
7 #include "content/browser/loader/resource_dispatcher_host_impl.h" 7 #include "content/browser/loader/resource_dispatcher_host_impl.h"
8 8
9 #include <stddef.h> 9 #include <stddef.h>
10 #include <algorithm> 10 #include <algorithm>
(...skipping 1152 matching lines...) Expand 10 before | Expand all | Expand 10 after
1163 // If sync_result is non-null, then a SyncLoad reply will be generated, else 1163 // If sync_result is non-null, then a SyncLoad reply will be generated, else
1164 // a normal asynchronous set of response messages will be generated. 1164 // a normal asynchronous set of response messages will be generated.
1165 void ResourceDispatcherHostImpl::OnSyncLoad( 1165 void ResourceDispatcherHostImpl::OnSyncLoad(
1166 int request_id, 1166 int request_id,
1167 const ResourceHostMsg_Request& request_data, 1167 const ResourceHostMsg_Request& request_data,
1168 IPC::Message* sync_result) { 1168 IPC::Message* sync_result) {
1169 BeginRequest(request_id, request_data, sync_result, 1169 BeginRequest(request_id, request_data, sync_result,
1170 sync_result->routing_id()); 1170 sync_result->routing_id());
1171 } 1171 }
1172 1172
1173 bool ResourceDispatcherHostImpl::IsRequestIDInUse(
1174 const GlobalRequestID& id) const {
1175 if (pending_loaders_.find(id) != pending_loaders_.end())
1176 return true;
1177 for (BlockedLoadersMap::const_iterator iter = blocked_loaders_map_.begin();
Charlie Reis 2016/01/28 22:05:16 nit: Maybe use C++11 range-based for loop here, si
gzobqq 2016/01/30 07:18:57 Done.
1178 iter != blocked_loaders_map_.end(); ++iter) {
1179 BlockedLoadersList* loaders = iter->second;
1180 for (BlockedLoadersList::const_iterator loaders_iter = loaders->begin();
1181 loaders_iter != loaders->end(); ++loaders_iter) {
1182 ResourceRequestInfoImpl* info = (*loaders_iter)->GetRequestInfo();
1183 if (info->GetGlobalRequestID() == id)
1184 return true;
1185 }
1186 }
1187 return false;
1188 }
1189
1173 void ResourceDispatcherHostImpl::UpdateRequestForTransfer( 1190 void ResourceDispatcherHostImpl::UpdateRequestForTransfer(
1174 int child_id, 1191 int child_id,
1175 int route_id, 1192 int route_id,
1176 int request_id, 1193 int request_id,
1177 const ResourceHostMsg_Request& request_data, 1194 const ResourceHostMsg_Request& request_data,
1178 const linked_ptr<ResourceLoader>& loader) { 1195 const linked_ptr<ResourceLoader>& loader) {
1179 ResourceRequestInfoImpl* info = loader->GetRequestInfo(); 1196 ResourceRequestInfoImpl* info = loader->GetRequestInfo();
1180 GlobalRoutingID old_routing_id( 1197 GlobalRoutingID old_routing_id(
1181 request_data.transferred_request_child_id, info->GetRouteID()); 1198 request_data.transferred_request_child_id, info->GetRouteID());
1182 GlobalRequestID old_request_id(request_data.transferred_request_child_id, 1199 GlobalRequestID old_request_id(request_data.transferred_request_child_id,
(...skipping 64 matching lines...) Expand 10 before | Expand all | Expand 10 after
1247 } 1264 }
1248 1265
1249 void ResourceDispatcherHostImpl::BeginRequest( 1266 void ResourceDispatcherHostImpl::BeginRequest(
1250 int request_id, 1267 int request_id,
1251 const ResourceHostMsg_Request& request_data, 1268 const ResourceHostMsg_Request& request_data,
1252 IPC::Message* sync_result, // only valid for sync 1269 IPC::Message* sync_result, // only valid for sync
1253 int route_id) { 1270 int route_id) {
1254 int process_type = filter_->process_type(); 1271 int process_type = filter_->process_type();
1255 int child_id = filter_->child_id(); 1272 int child_id = filter_->child_id();
1256 1273
1274 // Reject request id that's currently in use.
1275 if (IsRequestIDInUse(GlobalRequestID(child_id, request_id))) {
1276 bad_message::ReceivedBadMessage(
1277 filter_,
1278 bad_message::RDH_INVALID_REQUEST_ID);
1279 return;
1280 }
1281
1257 // PlzNavigate: reject invalid renderer main resource request. 1282 // PlzNavigate: reject invalid renderer main resource request.
1258 if (IsBrowserSideNavigationEnabled() && 1283 if (IsBrowserSideNavigationEnabled() &&
1259 IsResourceTypeFrame(request_data.resource_type) && 1284 IsResourceTypeFrame(request_data.resource_type) &&
1260 !request_data.url.SchemeIs(url::kBlobScheme)) { 1285 !request_data.url.SchemeIs(url::kBlobScheme)) {
1261 bad_message::ReceivedBadMessage(filter_, bad_message::RDH_INVALID_URL); 1286 bad_message::ReceivedBadMessage(filter_, bad_message::RDH_INVALID_URL);
1262 return; 1287 return;
1263 } 1288 }
1264 1289
1265 // Reject invalid priority. 1290 // Reject invalid priority.
1266 if (request_data.priority < net::MINIMUM_PRIORITY || 1291 if (request_data.priority < net::MINIMUM_PRIORITY ||
(...skipping 1282 matching lines...) Expand 10 before | Expand all | Expand 10 after
2549 load_flags |= net::LOAD_PREFETCH; 2574 load_flags |= net::LOAD_PREFETCH;
2550 } 2575 }
2551 2576
2552 if (is_sync_load) 2577 if (is_sync_load)
2553 load_flags |= net::LOAD_IGNORE_LIMITS; 2578 load_flags |= net::LOAD_IGNORE_LIMITS;
2554 2579
2555 return load_flags; 2580 return load_flags;
2556 } 2581 }
2557 2582
2558 } // namespace content 2583 } // namespace content
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698