OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2013 Google Inc. All rights reserved. | 2 * Copyright (C) 2013 Google Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
6 * met: | 6 * met: |
7 * | 7 * |
8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
(...skipping 85 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
96 } | 96 } |
97 | 97 |
98 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) | 98 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) |
99 { | 99 { |
100 bool isMainResource = type == FetchMainResource; | 100 bool isMainResource = type == FetchMainResource; |
101 if (!isMainResource) { | 101 if (!isMainResource) { |
102 RefPtr<SecurityOrigin> outgoingOrigin; | 102 RefPtr<SecurityOrigin> outgoingOrigin; |
103 if (!request.didSetHTTPReferrer()) { | 103 if (!request.didSetHTTPReferrer()) { |
104 ASSERT(m_document); | 104 ASSERT(m_document); |
105 outgoingOrigin = m_document->securityOrigin(); | 105 outgoingOrigin = m_document->securityOrigin(); |
106 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>referrerPolicy(), request.url(), m_document->outgoingReferrer())); | 106 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>getReferrerPolicy(), request.url(), m_document->outgoingReferrer())); |
107 } else { | 107 } else { |
108 RELEASE_ASSERT(SecurityPolicy::generateReferrer(request.referrerPoli
cy(), request.url(), request.httpReferrer()).referrer == request.httpReferrer())
; | 108 RELEASE_ASSERT(SecurityPolicy::generateReferrer(request.referrerPoli
cy(), request.url(), request.httpReferrer()).referrer == request.httpReferrer())
; |
109 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); | 109 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); |
110 } | 110 } |
111 | 111 |
112 request.addHTTPOriginIfNeeded(outgoingOrigin); | 112 request.addHTTPOriginIfNeeded(outgoingOrigin); |
113 } | 113 } |
114 | 114 |
115 if (m_document) | 115 if (m_document) |
116 request.setOriginatesFromReservedIPRange(m_document->isHostedInReservedI
PRange()); | 116 request.setOriginatesFromReservedIPRange(m_document->isHostedInReservedI
PRange()); |
(...skipping 530 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
647 | 647 |
648 void FrameFetchContext::upgradeInsecureRequest(FetchRequest& fetchRequest) | 648 void FrameFetchContext::upgradeInsecureRequest(FetchRequest& fetchRequest) |
649 { | 649 { |
650 KURL url = fetchRequest.resourceRequest().url(); | 650 KURL url = fetchRequest.resourceRequest().url(); |
651 | 651 |
652 // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational reque
sts, as described in | 652 // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational reque
sts, as described in |
653 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect | 653 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect |
654 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne) | 654 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne) |
655 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Upgrade-Insecu
re-Requests", "1"); | 655 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Upgrade-Insecu
re-Requests", "1"); |
656 | 656 |
657 if (m_document && m_document->insecureRequestsPolicy() == SecurityContext::I
nsecureRequestsUpgrade && url.protocolIs("http")) { | 657 if (m_document && m_document->getInsecureRequestsPolicy() == SecurityContext
::InsecureRequestsUpgrade && url.protocolIs("http")) { |
658 ASSERT(m_document->insecureNavigationsToUpgrade()); | 658 ASSERT(m_document->insecureNavigationsToUpgrade()); |
659 | 659 |
660 // We always upgrade requests that meet any of the following criteria: | 660 // We always upgrade requests that meet any of the following criteria: |
661 // | 661 // |
662 // 1. Are for subresources (including nested frames). | 662 // 1. Are for subresources (including nested frames). |
663 // 2. Are form submissions. | 663 // 2. Are form submissions. |
664 // 3. Whose hosts are contained in the document's InsecureNavigationSet. | 664 // 3. Whose hosts are contained in the document's InsecureNavigationSet. |
665 const ResourceRequest& request = fetchRequest.resourceRequest(); | 665 const ResourceRequest& request = fetchRequest.resourceRequest(); |
666 if (request.frameType() == WebURLRequest::FrameTypeNone | 666 if (request.frameType() == WebURLRequest::FrameTypeNone |
667 || request.frameType() == WebURLRequest::FrameTypeNested | 667 || request.frameType() == WebURLRequest::FrameTypeNested |
(...skipping 134 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
802 } | 802 } |
803 | 803 |
804 DEFINE_TRACE(FrameFetchContext) | 804 DEFINE_TRACE(FrameFetchContext) |
805 { | 805 { |
806 visitor->trace(m_document); | 806 visitor->trace(m_document); |
807 visitor->trace(m_documentLoader); | 807 visitor->trace(m_documentLoader); |
808 FetchContext::trace(visitor); | 808 FetchContext::trace(visitor); |
809 } | 809 } |
810 | 810 |
811 } // namespace blink | 811 } // namespace blink |
OLD | NEW |