OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2013 Google Inc. All rights reserved. | 2 * Copyright (C) 2013 Google Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
6 * met: | 6 * met: |
7 * | 7 * |
8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
(...skipping 84 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
95 return frame; | 95 return frame; |
96 } | 96 } |
97 | 97 |
98 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) | 98 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) |
99 { | 99 { |
100 bool isMainResource = type == FetchMainResource; | 100 bool isMainResource = type == FetchMainResource; |
101 if (!isMainResource) { | 101 if (!isMainResource) { |
102 RefPtr<SecurityOrigin> outgoingOrigin; | 102 RefPtr<SecurityOrigin> outgoingOrigin; |
103 if (!request.didSetHTTPReferrer()) { | 103 if (!request.didSetHTTPReferrer()) { |
104 ASSERT(m_document); | 104 ASSERT(m_document); |
105 outgoingOrigin = m_document->securityOrigin(); | 105 outgoingOrigin = m_document->getSecurityOrigin(); |
106 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>getReferrerPolicy(), request.url(), m_document->outgoingReferrer())); | 106 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>getReferrerPolicy(), request.url(), m_document->outgoingReferrer())); |
107 } else { | 107 } else { |
108 RELEASE_ASSERT(SecurityPolicy::generateReferrer(request.getReferrerP
olicy(), request.url(), request.httpReferrer()).referrer == request.httpReferrer
()); | 108 RELEASE_ASSERT(SecurityPolicy::generateReferrer(request.getReferrerP
olicy(), request.url(), request.httpReferrer()).referrer == request.httpReferrer
()); |
109 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); | 109 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); |
110 } | 110 } |
111 | 111 |
112 request.addHTTPOriginIfNeeded(outgoingOrigin); | 112 request.addHTTPOriginIfNeeded(outgoingOrigin); |
113 } | 113 } |
114 | 114 |
115 if (m_document) | 115 if (m_document) |
(...skipping 288 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
404 ResourceRequestBlockedReason FrameFetchContext::canRequestInternal(Resource::Typ
e type, const ResourceRequest& resourceRequest, const KURL& url, const ResourceL
oaderOptions& options, bool forPreload, FetchRequest::OriginRestriction originRe
striction, ContentSecurityPolicy::RedirectStatus redirectStatus) const | 404 ResourceRequestBlockedReason FrameFetchContext::canRequestInternal(Resource::Typ
e type, const ResourceRequest& resourceRequest, const KURL& url, const ResourceL
oaderOptions& options, bool forPreload, FetchRequest::OriginRestriction originRe
striction, ContentSecurityPolicy::RedirectStatus redirectStatus) const |
405 { | 405 { |
406 InstrumentingAgents* agents = InspectorInstrumentation::instrumentingAgentsF
or(frame()); | 406 InstrumentingAgents* agents = InspectorInstrumentation::instrumentingAgentsF
or(frame()); |
407 if (agents && agents->inspectorResourceAgent()) { | 407 if (agents && agents->inspectorResourceAgent()) { |
408 if (agents->inspectorResourceAgent()->shouldBlockRequest(resourceRequest
)) | 408 if (agents->inspectorResourceAgent()->shouldBlockRequest(resourceRequest
)) |
409 return ResourceRequestBlockedReasonInspector; | 409 return ResourceRequestBlockedReasonInspector; |
410 } | 410 } |
411 | 411 |
412 SecurityOrigin* securityOrigin = options.securityOrigin.get(); | 412 SecurityOrigin* securityOrigin = options.securityOrigin.get(); |
413 if (!securityOrigin && m_document) | 413 if (!securityOrigin && m_document) |
414 securityOrigin = m_document->securityOrigin(); | 414 securityOrigin = m_document->getSecurityOrigin(); |
415 | 415 |
416 if (originRestriction != FetchRequest::NoOriginRestriction && securityOrigin
&& !securityOrigin->canDisplay(url)) { | 416 if (originRestriction != FetchRequest::NoOriginRestriction && securityOrigin
&& !securityOrigin->canDisplay(url)) { |
417 if (!forPreload) | 417 if (!forPreload) |
418 FrameLoader::reportLocalLoadFailed(frame(), url.elidedString()); | 418 FrameLoader::reportLocalLoadFailed(frame(), url.elidedString()); |
419 WTF_LOG(ResourceLoading, "ResourceFetcher::requestResource URL was not a
llowed by SecurityOrigin::canDisplay"); | 419 WTF_LOG(ResourceLoading, "ResourceFetcher::requestResource URL was not a
llowed by SecurityOrigin::canDisplay"); |
420 return ResourceRequestBlockedReasonOther; | 420 return ResourceRequestBlockedReasonOther; |
421 } | 421 } |
422 | 422 |
423 // Some types of resources can be loaded only from the same origin. Other | 423 // Some types of resources can be loaded only from the same origin. Other |
424 // types of resources, like Images, Scripts, and CSS, can be loaded from | 424 // types of resources, like Images, Scripts, and CSS, can be loaded from |
(...skipping 115 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
540 ASSERT(csp); | 540 ASSERT(csp); |
541 if (!shouldBypassMainWorldCSP && !csp->allowManifestFromSource(url, redi
rectStatus, cspReporting)) | 541 if (!shouldBypassMainWorldCSP && !csp->allowManifestFromSource(url, redi
rectStatus, cspReporting)) |
542 return ResourceRequestBlockedReasonCSP; | 542 return ResourceRequestBlockedReasonCSP; |
543 } | 543 } |
544 | 544 |
545 // Measure the number of legacy URL schemes ('ftp://') and the number of emb
edded-credential | 545 // Measure the number of legacy URL schemes ('ftp://') and the number of emb
edded-credential |
546 // ('http://user:password@...') resources embedded as subresources. in the h
opes that we can | 546 // ('http://user:password@...') resources embedded as subresources. in the h
opes that we can |
547 // block them at some point in the future. | 547 // block them at some point in the future. |
548 if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) { | 548 if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) { |
549 ASSERT(frame()->document()); | 549 ASSERT(frame()->document()); |
550 if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) && !Sch
emeRegistry::shouldTreatURLSchemeAsLegacy(frame()->document()->securityOrigin()-
>protocol())) | 550 if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) && !Sch
emeRegistry::shouldTreatURLSchemeAsLegacy(frame()->document()->getSecurityOrigin
()->protocol())) |
551 UseCounter::count(frame()->document(), UseCounter::LegacyProtocolEmb
eddedAsSubresource); | 551 UseCounter::count(frame()->document(), UseCounter::LegacyProtocolEmb
eddedAsSubresource); |
552 if (!url.user().isEmpty() || !url.pass().isEmpty()) | 552 if (!url.user().isEmpty() || !url.pass().isEmpty()) |
553 UseCounter::count(frame()->document(), UseCounter::RequestedSubresou
rceWithEmbeddedCredentials); | 553 UseCounter::count(frame()->document(), UseCounter::RequestedSubresou
rceWithEmbeddedCredentials); |
554 } | 554 } |
555 | 555 |
556 // Measure the number of pages that load resources after a redirect | 556 // Measure the number of pages that load resources after a redirect |
557 // when a CSP is active, to see if implementing CSP | 557 // when a CSP is active, to see if implementing CSP |
558 // 'unsafe-redirect' is feasible. | 558 // 'unsafe-redirect' is feasible. |
559 if (csp && csp->isActive() && resourceRequest.frameType() != WebURLRequest::
FrameTypeTopLevel && resourceRequest.frameType() != WebURLRequest::FrameTypeAuxi
liary && redirectStatus == ContentSecurityPolicy::DidRedirect) { | 559 if (csp && csp->isActive() && resourceRequest.frameType() != WebURLRequest::
FrameTypeTopLevel && resourceRequest.frameType() != WebURLRequest::FrameTypeAuxi
liary && redirectStatus == ContentSecurityPolicy::DidRedirect) { |
560 ASSERT(frame()->document()); | 560 ASSERT(frame()->document()); |
(...skipping 72 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
633 { | 633 { |
634 PingLoader::loadImage(frame(), url); | 634 PingLoader::loadImage(frame(), url); |
635 } | 635 } |
636 | 636 |
637 void FrameFetchContext::addConsoleMessage(const String& message) const | 637 void FrameFetchContext::addConsoleMessage(const String& message) const |
638 { | 638 { |
639 if (frame()->document()) | 639 if (frame()->document()) |
640 frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageS
ource, ErrorMessageLevel, message)); | 640 frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageS
ource, ErrorMessageLevel, message)); |
641 } | 641 } |
642 | 642 |
643 SecurityOrigin* FrameFetchContext::securityOrigin() const | 643 SecurityOrigin* FrameFetchContext::getSecurityOrigin() const |
644 { | 644 { |
645 return m_document ? m_document->securityOrigin() : nullptr; | 645 return m_document ? m_document->getSecurityOrigin() : nullptr; |
646 } | 646 } |
647 | 647 |
648 void FrameFetchContext::upgradeInsecureRequest(FetchRequest& fetchRequest) | 648 void FrameFetchContext::upgradeInsecureRequest(FetchRequest& fetchRequest) |
649 { | 649 { |
650 KURL url = fetchRequest.resourceRequest().url(); | 650 KURL url = fetchRequest.resourceRequest().url(); |
651 | 651 |
652 // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational reque
sts, as described in | 652 // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational reque
sts, as described in |
653 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect | 653 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect |
654 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne) | 654 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne) |
655 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Upgrade-Insecu
re-Requests", "1"); | 655 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Upgrade-Insecu
re-Requests", "1"); |
(...skipping 151 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
807 } | 807 } |
808 | 808 |
809 DEFINE_TRACE(FrameFetchContext) | 809 DEFINE_TRACE(FrameFetchContext) |
810 { | 810 { |
811 visitor->trace(m_document); | 811 visitor->trace(m_document); |
812 visitor->trace(m_documentLoader); | 812 visitor->trace(m_documentLoader); |
813 FetchContext::trace(visitor); | 813 FetchContext::trace(visitor); |
814 } | 814 } |
815 | 815 |
816 } // namespace blink | 816 } // namespace blink |
OLD | NEW |