CORS-RFC1918: Teach ResourceRequest about "external" requests

third_party/WebKit/Source/platform/network/ResourceRequest.cpp

 /*
  * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "platform/network/ResourceRequest.h"
 
 #include "platform/HTTPNames.h"
+#include "platform/RuntimeEnabledFeatures.h"
 #include "platform/weborigin/SecurityOrigin.h"
+#include "public/platform/Platform.h"
 #include "public/platform/WebURLRequest.h"
 
 namespace blink {
 
 double ResourceRequest::s_defaultTimeoutInterval = INT_MAX;
 
 ResourceRequest::ResourceRequest(CrossThreadResourceRequestData* data)
     : ResourceRequest()
 {
     setURL(data->m_url);
@@ skipping 20 matching lines @@
     setRequestContext(data->m_requestContext);
     setFrameType(data->m_frameType);
     setFetchRequestMode(data->m_fetchRequestMode);
     setFetchCredentialsMode(data->m_fetchCredentialsMode);
     setFetchRedirectMode(data->m_fetchRedirectMode);
     setLoFiState(data->m_loFiState);
     m_referrerPolicy = data->m_referrerPolicy;
     m_didSetHTTPReferrer = data->m_didSetHTTPReferrer;
     m_checkForBrowserSideNavigation = data->m_checkForBrowserSideNavigation;
     m_uiStartTime = data->m_uiStartTime;
-    m_originatesFromReservedIPRange = data->m_originatesFromReservedIPRange;
+    m_isExternalRequest = data->m_isExternalRequest;
     m_inputPerfMetricReportPolicy = data->m_inputPerfMetricReportPolicy;
     m_followedRedirect = data->m_followedRedirect;
 }
 
 PassOwnPtr<CrossThreadResourceRequestData> ResourceRequest::copyData() const
 {
     OwnPtr<CrossThreadResourceRequestData> data = adoptPtr(new CrossThreadResourceRequestData());
     data->m_url = url().copy();
     data->m_cachePolicy = getCachePolicy();
     data->m_timeoutInterval = timeoutInterval();
@@ skipping 19 matching lines @@
     data->m_requestContext = m_requestContext;
     data->m_frameType = m_frameType;
     data->m_fetchRequestMode = m_fetchRequestMode;
     data->m_fetchCredentialsMode = m_fetchCredentialsMode;
     data->m_fetchRedirectMode = m_fetchRedirectMode;
     data->m_loFiState = m_loFiState;
     data->m_referrerPolicy = m_referrerPolicy;
     data->m_didSetHTTPReferrer = m_didSetHTTPReferrer;
     data->m_checkForBrowserSideNavigation = m_checkForBrowserSideNavigation;
     data->m_uiStartTime = m_uiStartTime;
-    data->m_originatesFromReservedIPRange = m_originatesFromReservedIPRange;
+    data->m_isExternalRequest = m_isExternalRequest;
     data->m_inputPerfMetricReportPolicy = m_inputPerfMetricReportPolicy;
     data->m_followedRedirect = m_followedRedirect;
     return data.release();
 }
 
 bool ResourceRequest::isEmpty() const
 {
     return m_url.isEmpty();
 }
 
@@ skipping 242 matching lines @@
 {
     if (!equalIgnoringHeaderFields(a, b))
         return false;
 
     if (a.httpHeaderFields() != b.httpHeaderFields())
         return false;
 
     return true;
 }
 
+void ResourceRequest::setIsExternalRequest(bool contextHostedInReservedIPRange)
+{
+    // TODO(mkwst): This only checks explicit IP addresses. We'll have to move all this up to //net and //content in
+    // order to have any real impact on gateway attacks. That turns out to be a TON of work. https://crbug.com/378566
+    m_isExternalRequest = RuntimeEnabledFeatures::corsRFC1918Enabled() && !contextHostedInReservedIPRange && (Platform::current()->isReservedIPAddress(m_url.host()) || m_url.host() == "localhost");
+}
+
 bool ResourceRequest::isConditional() const
 {
     return (m_httpHeaderFields.contains(HTTPNames::If_Match)
         || m_httpHeaderFields.contains(HTTPNames::If_Modified_Since)
         || m_httpHeaderFields.contains(HTTPNames::If_None_Match)
         || m_httpHeaderFields.contains(HTTPNames::If_Range)
         || m_httpHeaderFields.contains(HTTPNames::If_Unmodified_Since));
 }
 
 void ResourceRequest::setHasUserGesture(bool hasUserGesture)
@@ skipping 48 matching lines @@
     // Contrary to the Fetch spec, we default to same-origin mode here, and deal
     // with CORS modes in updateRequestForAccessControl if we're called in a
     // context which requires it.
     m_fetchCredentialsMode = WebURLRequest::FetchCredentialsModeSameOrigin;
     m_fetchRedirectMode = WebURLRequest::FetchRedirectModeFollow;
     m_referrerPolicy = ReferrerPolicyDefault;
     m_loFiState = WebURLRequest::LoFiUnspecified;
     m_didSetHTTPReferrer = false;
     m_checkForBrowserSideNavigation = true;
     m_uiStartTime = 0;
-    m_originatesFromReservedIPRange = false;
+    m_isExternalRequest = false;

[jochen (gone - plz use gerrit), 2016/03/01 15:42:29]

should this default to true if the runtime flag is on?

[Mike West, 2016/03/02 08:50:03]

I don't think so, because we'll end up using this for navigations as well, and
need to ensure that top-level navigations that are user-initiated (address bar,
bookmark, etc) don't force preflights. It seems like the right way to do that is
for the default to be non-external, and only change the setting if we're in the
context of a document (as we do in FrameFetchContext).

     m_inputPerfMetricReportPolicy = InputToLoadPerfMetricReportPolicy::NoReport;
     m_followedRedirect = false;
     m_requestorOrigin = SecurityOrigin::createUnique();
 }
 
 } // namespace blink