RDH: Block a compromised renderer from reusing request ids

content/browser/loader/resource_dispatcher_host_impl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This is the browser side of the resource dispatcher, it receives requests
 // from the child process (i.e. [Renderer, Plugin, Worker]ProcessHost), and
 // dispatches them to URLRequests. It then forwards the messages from the
 // URLRequests back to the correct process for handling.
 //
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
@@ skipping 312 matching lines @@
 
   // ResourceLoaderDelegate implementation:
   ResourceDispatcherHostLoginDelegate* CreateLoginDelegate(
       ResourceLoader* loader,
       net::AuthChallengeInfo* auth_info) override;
   bool HandleExternalProtocol(ResourceLoader* loader, const GURL& url) override;
   void DidStartRequest(ResourceLoader* loader) override;
   void DidReceiveRedirect(ResourceLoader* loader, const GURL& new_url) override;
   void DidReceiveResponse(ResourceLoader* loader) override;
   void DidFinishLoading(ResourceLoader* loader) override;
+  void LoaderDestroyed(ResourceLoader* loader) override;
 
   // An init helper that runs on the IO thread.
   void OnInit();
 
   // A shutdown helper that runs on the IO thread.
   void OnShutdown();
 
   // Helper function for regular and download requests.
   void BeginRequestInternal(scoped_ptr<net::URLRequest> request,
                             scoped_ptr<ResourceHandler> handler);
@@ skipping 173 matching lines @@
                                        ResourceMessageDelegate* delegate);
   void UnregisterResourceMessageDelegate(const GlobalRequestID& id,
                                          ResourceMessageDelegate* delegate);
 
   int BuildLoadFlagsForRequest(const ResourceHostMsg_Request& request_data,
                                int child_id,
                                bool is_sync_load);
 
   LoaderMap pending_loaders_;
 
+  // Keep a set of request ids currently in use. This is used to validate
+  // incoming request ids from renderers and disallow duplicates.
+  std::set<GlobalRequestID> request_ids_in_use_;
+
   // Collection of temp files downloaded for child processes via
   // the download_to_file mechanism. We avoid deleting them until
   // the client no longer needs them.
   typedef std::map<int, scoped_refptr<storage::ShareableFileReference> >
       DeletableFilesMap;  // key is request id
   typedef std::map<int, DeletableFilesMap>
       RegisteredTempFiles;  // key is child process id
   RegisteredTempFiles registered_temp_files_;
 
   // A timer that periodically calls UpdateLoadInfo while pending_loaders_ is
@@ skipping 75 matching lines @@
   DelegateMap delegate_map_;
 
   scoped_ptr<ResourceScheduler> scheduler_;
 
   DISALLOW_COPY_AND_ASSIGN(ResourceDispatcherHostImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_LOADER_RESOURCE_DISPATCHER_HOST_IMPL_H_