| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2013 Google Inc. All rights reserved. | 2 * Copyright (C) 2013 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
| 6 * met: | 6 * met: |
| 7 * | 7 * |
| 8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
| (...skipping 84 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 95 return frame; | 95 return frame; |
| 96 } | 96 } |
| 97 | 97 |
| 98 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) | 98 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) |
| 99 { | 99 { |
| 100 bool isMainResource = type == FetchMainResource; | 100 bool isMainResource = type == FetchMainResource; |
| 101 if (!isMainResource) { | 101 if (!isMainResource) { |
| 102 RefPtr<SecurityOrigin> outgoingOrigin; | 102 RefPtr<SecurityOrigin> outgoingOrigin; |
| 103 if (!request.didSetHTTPReferrer()) { | 103 if (!request.didSetHTTPReferrer()) { |
| 104 ASSERT(m_document); | 104 ASSERT(m_document); |
| 105 outgoingOrigin = m_document->securityOrigin(); | 105 outgoingOrigin = m_document->getSecurityOrigin(); |
| 106 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>getReferrerPolicy(), request.url(), m_document->outgoingReferrer())); | 106 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>getReferrerPolicy(), request.url(), m_document->outgoingReferrer())); |
| 107 } else { | 107 } else { |
| 108 RELEASE_ASSERT(SecurityPolicy::generateReferrer(request.getReferrerP
olicy(), request.url(), request.httpReferrer()).referrer == request.httpReferrer
()); | 108 RELEASE_ASSERT(SecurityPolicy::generateReferrer(request.getReferrerP
olicy(), request.url(), request.httpReferrer()).referrer == request.httpReferrer
()); |
| 109 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); | 109 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); |
| 110 } | 110 } |
| 111 | 111 |
| 112 request.addHTTPOriginIfNeeded(outgoingOrigin); | 112 request.addHTTPOriginIfNeeded(outgoingOrigin); |
| 113 } | 113 } |
| 114 | 114 |
| 115 if (m_document) | 115 if (m_document) |
| (...skipping 288 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 404 ResourceRequestBlockedReason FrameFetchContext::canRequestInternal(Resource::Typ
e type, const ResourceRequest& resourceRequest, const KURL& url, const ResourceL
oaderOptions& options, bool forPreload, FetchRequest::OriginRestriction originRe
striction, ContentSecurityPolicy::RedirectStatus redirectStatus) const | 404 ResourceRequestBlockedReason FrameFetchContext::canRequestInternal(Resource::Typ
e type, const ResourceRequest& resourceRequest, const KURL& url, const ResourceL
oaderOptions& options, bool forPreload, FetchRequest::OriginRestriction originRe
striction, ContentSecurityPolicy::RedirectStatus redirectStatus) const |
| 405 { | 405 { |
| 406 InstrumentingAgents* agents = InspectorInstrumentation::instrumentingAgentsF
or(frame()); | 406 InstrumentingAgents* agents = InspectorInstrumentation::instrumentingAgentsF
or(frame()); |
| 407 if (agents && agents->inspectorResourceAgent()) { | 407 if (agents && agents->inspectorResourceAgent()) { |
| 408 if (agents->inspectorResourceAgent()->shouldBlockRequest(resourceRequest
)) | 408 if (agents->inspectorResourceAgent()->shouldBlockRequest(resourceRequest
)) |
| 409 return ResourceRequestBlockedReasonInspector; | 409 return ResourceRequestBlockedReasonInspector; |
| 410 } | 410 } |
| 411 | 411 |
| 412 SecurityOrigin* securityOrigin = options.securityOrigin.get(); | 412 SecurityOrigin* securityOrigin = options.securityOrigin.get(); |
| 413 if (!securityOrigin && m_document) | 413 if (!securityOrigin && m_document) |
| 414 securityOrigin = m_document->securityOrigin(); | 414 securityOrigin = m_document->getSecurityOrigin(); |
| 415 | 415 |
| 416 if (originRestriction != FetchRequest::NoOriginRestriction && securityOrigin
&& !securityOrigin->canDisplay(url)) { | 416 if (originRestriction != FetchRequest::NoOriginRestriction && securityOrigin
&& !securityOrigin->canDisplay(url)) { |
| 417 if (!forPreload) | 417 if (!forPreload) |
| 418 FrameLoader::reportLocalLoadFailed(frame(), url.elidedString()); | 418 FrameLoader::reportLocalLoadFailed(frame(), url.elidedString()); |
| 419 WTF_LOG(ResourceLoading, "ResourceFetcher::requestResource URL was not a
llowed by SecurityOrigin::canDisplay"); | 419 WTF_LOG(ResourceLoading, "ResourceFetcher::requestResource URL was not a
llowed by SecurityOrigin::canDisplay"); |
| 420 return ResourceRequestBlockedReasonOther; | 420 return ResourceRequestBlockedReasonOther; |
| 421 } | 421 } |
| 422 | 422 |
| 423 // Some types of resources can be loaded only from the same origin. Other | 423 // Some types of resources can be loaded only from the same origin. Other |
| 424 // types of resources, like Images, Scripts, and CSS, can be loaded from | 424 // types of resources, like Images, Scripts, and CSS, can be loaded from |
| (...skipping 115 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 540 ASSERT(csp); | 540 ASSERT(csp); |
| 541 if (!shouldBypassMainWorldCSP && !csp->allowManifestFromSource(url, redi
rectStatus, cspReporting)) | 541 if (!shouldBypassMainWorldCSP && !csp->allowManifestFromSource(url, redi
rectStatus, cspReporting)) |
| 542 return ResourceRequestBlockedReasonCSP; | 542 return ResourceRequestBlockedReasonCSP; |
| 543 } | 543 } |
| 544 | 544 |
| 545 // Measure the number of legacy URL schemes ('ftp://') and the number of emb
edded-credential | 545 // Measure the number of legacy URL schemes ('ftp://') and the number of emb
edded-credential |
| 546 // ('http://user:password@...') resources embedded as subresources. in the h
opes that we can | 546 // ('http://user:password@...') resources embedded as subresources. in the h
opes that we can |
| 547 // block them at some point in the future. | 547 // block them at some point in the future. |
| 548 if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) { | 548 if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) { |
| 549 ASSERT(frame()->document()); | 549 ASSERT(frame()->document()); |
| 550 if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) && !Sch
emeRegistry::shouldTreatURLSchemeAsLegacy(frame()->document()->securityOrigin()-
>protocol())) | 550 if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) && !Sch
emeRegistry::shouldTreatURLSchemeAsLegacy(frame()->document()->getSecurityOrigin
()->protocol())) |
| 551 UseCounter::count(frame()->document(), UseCounter::LegacyProtocolEmb
eddedAsSubresource); | 551 UseCounter::count(frame()->document(), UseCounter::LegacyProtocolEmb
eddedAsSubresource); |
| 552 if (!url.user().isEmpty() || !url.pass().isEmpty()) | 552 if (!url.user().isEmpty() || !url.pass().isEmpty()) |
| 553 UseCounter::count(frame()->document(), UseCounter::RequestedSubresou
rceWithEmbeddedCredentials); | 553 UseCounter::count(frame()->document(), UseCounter::RequestedSubresou
rceWithEmbeddedCredentials); |
| 554 } | 554 } |
| 555 | 555 |
| 556 // Measure the number of pages that load resources after a redirect | 556 // Measure the number of pages that load resources after a redirect |
| 557 // when a CSP is active, to see if implementing CSP | 557 // when a CSP is active, to see if implementing CSP |
| 558 // 'unsafe-redirect' is feasible. | 558 // 'unsafe-redirect' is feasible. |
| 559 if (csp && csp->isActive() && resourceRequest.frameType() != WebURLRequest::
FrameTypeTopLevel && resourceRequest.frameType() != WebURLRequest::FrameTypeAuxi
liary && redirectStatus == ContentSecurityPolicy::DidRedirect) { | 559 if (csp && csp->isActive() && resourceRequest.frameType() != WebURLRequest::
FrameTypeTopLevel && resourceRequest.frameType() != WebURLRequest::FrameTypeAuxi
liary && redirectStatus == ContentSecurityPolicy::DidRedirect) { |
| 560 ASSERT(frame()->document()); | 560 ASSERT(frame()->document()); |
| (...skipping 72 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 633 { | 633 { |
| 634 PingLoader::loadImage(frame(), url); | 634 PingLoader::loadImage(frame(), url); |
| 635 } | 635 } |
| 636 | 636 |
| 637 void FrameFetchContext::addConsoleMessage(const String& message) const | 637 void FrameFetchContext::addConsoleMessage(const String& message) const |
| 638 { | 638 { |
| 639 if (frame()->document()) | 639 if (frame()->document()) |
| 640 frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageS
ource, ErrorMessageLevel, message)); | 640 frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageS
ource, ErrorMessageLevel, message)); |
| 641 } | 641 } |
| 642 | 642 |
| 643 SecurityOrigin* FrameFetchContext::securityOrigin() const | 643 SecurityOrigin* FrameFetchContext::getSecurityOrigin() const |
| 644 { | 644 { |
| 645 return m_document ? m_document->securityOrigin() : nullptr; | 645 return m_document ? m_document->getSecurityOrigin() : nullptr; |
| 646 } | 646 } |
| 647 | 647 |
| 648 void FrameFetchContext::upgradeInsecureRequest(FetchRequest& fetchRequest) | 648 void FrameFetchContext::upgradeInsecureRequest(FetchRequest& fetchRequest) |
| 649 { | 649 { |
| 650 KURL url = fetchRequest.resourceRequest().url(); | 650 KURL url = fetchRequest.resourceRequest().url(); |
| 651 | 651 |
| 652 // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational reque
sts, as described in | 652 // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational reque
sts, as described in |
| 653 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect | 653 // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect |
| 654 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne) | 654 if (fetchRequest.resourceRequest().frameType() != WebURLRequest::FrameTypeNo
ne) |
| 655 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Upgrade-Insecu
re-Requests", "1"); | 655 fetchRequest.mutableResourceRequest().addHTTPHeaderField("Upgrade-Insecu
re-Requests", "1"); |
| (...skipping 151 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 807 } | 807 } |
| 808 | 808 |
| 809 DEFINE_TRACE(FrameFetchContext) | 809 DEFINE_TRACE(FrameFetchContext) |
| 810 { | 810 { |
| 811 visitor->trace(m_document); | 811 visitor->trace(m_document); |
| 812 visitor->trace(m_documentLoader); | 812 visitor->trace(m_documentLoader); |
| 813 FetchContext::trace(visitor); | 813 FetchContext::trace(visitor); |
| 814 } | 814 } |
| 815 | 815 |
| 816 } // namespace blink | 816 } // namespace blink |
| OLD | NEW |