Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(616)

Unified Diff: content/browser/loader/resource_dispatcher_host_impl.cc

Issue 1608573002: RDH: Block a compromised renderer from reusing request ids (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Rebase Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: content/browser/loader/resource_dispatcher_host_impl.cc
diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc
index 68f8fd0664762b8d3982f0e64a12a95ed66f686d..1db3d98e157c29ae3455281fdbd72dbf65d12d4a 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.cc
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc
@@ -1187,6 +1187,20 @@ void ResourceDispatcherHostImpl::OnSyncLoad(
sync_result->routing_id());
}
+bool ResourceDispatcherHostImpl::IsRequestIDInUse(
+ const GlobalRequestID& id) const {
+ if (pending_loaders_.find(id) != pending_loaders_.end())
+ return true;
+ for (const auto& blocked_loaders : blocked_loaders_map_) {
+ for (const auto& loader : *blocked_loaders.second.get()) {
+ ResourceRequestInfoImpl* info = loader->GetRequestInfo();
+ if (info->GetGlobalRequestID() == id)
+ return true;
+ }
+ }
+ return false;
+}
+
void ResourceDispatcherHostImpl::UpdateRequestForTransfer(
int child_id,
int route_id,
@@ -1281,6 +1295,13 @@ void ResourceDispatcherHostImpl::BeginRequest(
int process_type = filter_->process_type();
int child_id = filter_->child_id();
+ // Reject request id that's currently in use.
+ if (IsRequestIDInUse(GlobalRequestID(child_id, request_id))) {
+ bad_message::ReceivedBadMessage(filter_,
+ bad_message::RDH_INVALID_REQUEST_ID);
+ return;
+ }
+
// PlzNavigate: reject invalid renderer main resource request.
if (IsBrowserSideNavigationEnabled() &&
IsResourceTypeFrame(request_data.resource_type) &&
« no previous file with comments | « content/browser/loader/resource_dispatcher_host_impl.h ('k') | content/browser/security_exploit_browsertest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698