Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(921)

Side by Side Diff: content/child/site_isolation_policy.h

Issue 187063006: Moved all state from SiteIsolationPolicy out to the PendingRequestInfo struct in the ResourceSchedu… (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Created 6 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ 5 #ifndef CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
6 #define CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ 6 #define CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
7 7
8 #include <map> 8 #include <map>
9 #include <utility> 9 #include <utility>
10 10
11 #include "base/gtest_prod_util.h" 11 #include "base/gtest_prod_util.h"
12 #include "base/memory/linked_ptr.h"
13 #include "base/strings/string_piece.h"
12 #include "content/common/content_export.h" 14 #include "content/common/content_export.h"
13 #include "third_party/WebKit/public/platform/WebURLRequest.h"
14 #include "third_party/WebKit/public/platform/WebURLResponse.h"
15 #include "third_party/WebKit/public/web/WebFrame.h"
16 #include "webkit/common/resource_response_info.h"
17 #include "webkit/common/resource_type.h" 15 #include "webkit/common/resource_type.h"
18 16
17 class GURL;
18
19 namespace webkit_glue {
20 struct ResourceResponseInfo;
21 }
22
19 namespace content { 23 namespace content {
20 24
21 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP) 25 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP)
22 // for Site Isolation. XSDP will monitor network responses to a renderer and 26 // for Site Isolation. XSDP will monitor network responses to a renderer and
23 // block illegal responses so that a compromised renderer cannot steal private 27 // block illegal responses so that a compromised renderer cannot steal private
24 // information from other sites. For now SiteIsolationPolicy monitors responses 28 // information from other sites. For now SiteIsolationPolicy monitors responses
25 // to gather various UMA stats to see the compatibility impact of actual 29 // to gather various UMA stats to see the compatibility impact of actual
26 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers 30 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers
27 // are as follows: 31 // are as follows:
28 // 32 //
(...skipping 16 matching lines...) Expand all
45 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 49 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
46 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode : 50 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode :
47 // # of responses failed to be sniffed for its MIME type, but blocked by 51 // # of responses failed to be sniffed for its MIME type, but blocked by
48 // "X-Content-Type-Options: nosniff" header, and with non-renderable status 52 // "X-Content-Type-Options: nosniff" header, and with non-renderable status
49 // code out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 53 // code out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
50 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked : 54 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked :
51 // # of responses, but not blocked due to failure of mime sniffing. 55 // # of responses, but not blocked due to failure of mime sniffing.
52 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS : 56 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS :
53 // # of responses that are plausibly sniffed to be JavaScript. 57 // # of responses that are plausibly sniffed to be JavaScript.
54 58
59 struct SiteIsolationResponseMetaData {
60
61 enum CanonicalMimeType {
62 HTML = 0,
63 XML = 1,
64 JSON = 2,
65 Plain = 3,
66 Others = 4,
67 MaxCanonicalMimeType,
68 };
69
70 SiteIsolationResponseMetaData();
71
72 std::string frame_origin;
73 GURL response_url;
74 ResourceType::Type resource_type;
75 CanonicalMimeType canonical_mime_type;
76 int http_status_code;
77 bool no_sniff;
78 };
79
55 class CONTENT_EXPORT SiteIsolationPolicy { 80 class CONTENT_EXPORT SiteIsolationPolicy {
56 public: 81 public:
57 // Set activation flag for the UMA data collection for this renderer process. 82 // Set activation flag for the UMA data collection for this renderer process.
58 static void SetPolicyEnabled(bool enabled); 83 static void SetPolicyEnabled(bool enabled);
59 84
60 // Records the bookkeeping data about the HTTP header information for the 85 // Records the bookkeeping data about the HTTP header information for the
61 // request identified by |request_id|. The bookkeeping data is used by 86 // request identified by |request_id|. The bookkeeping data is used by
62 // ShouldBlockResponse. We have to make sure to call OnRequestComplete to free 87 // ShouldBlockResponse. We have to make sure to call OnRequestComplete to free
63 // the bookkeeping data. 88 // the bookkeeping data.
Charlie Reis 2014/03/05 18:22:44 Maybe mention that the data is stored in the retur
oystein (OOO til 10th of July) 2014/03/05 19:23:39 Done.
64 static void OnReceivedResponse(int request_id, 89 static linked_ptr<SiteIsolationResponseMetaData> OnReceivedResponse(
65 const GURL& frame_origin, 90 const GURL& frame_origin, const GURL& response_url,
66 const GURL& response_url, 91 ResourceType::Type resource_type, int origin_pid,
67 ResourceType::Type resource_type, 92 const webkit_glue::ResourceResponseInfo& info);
68 int origin_pid,
69 const webkit_glue::ResourceResponseInfo& info);
70 93
71 // Examines the first network packet in case response_url is registered as a 94 // Examines the first network packet in case response_url is registered as a
72 // cross-site document by DidReceiveResponse(). In case that this response is 95 // cross-site document by DidReceiveResponse(). In case that this response is
73 // blocked, it returns an alternative data to be sent to the renderer in 96 // blocked, it returns an alternative data to be sent to the renderer in
74 // |alternative_data|. This records various kinds of UMA data stats. This 97 // |alternative_data|. This records various kinds of UMA data stats. This
75 // function is called only if the length of received data is non-zero. 98 // function is called only if the length of received data is non-zero.
76 static bool ShouldBlockResponse(int request_id, 99 static bool ShouldBlockResponse(
77 const char* payload, 100 linked_ptr<SiteIsolationResponseMetaData>& resp_data, const char* payload,
78 int length, 101 int length, std::string* alternative_data);
79 std::string* alternative_data);
80
81 // Clean up booking data registered by OnReceiveResponse and OnReceivedData.
82 static void OnRequestComplete(int request_id);
83
84 struct ResponseMetaData {
85
86 enum CanonicalMimeType {
87 HTML = 0,
88 XML = 1,
89 JSON = 2,
90 Plain = 3,
91 Others = 4,
92 MaxCanonicalMimeType,
93 };
94
95 ResponseMetaData();
96
97 std::string frame_origin;
98 GURL response_url;
99 ResourceType::Type resource_type;
100 CanonicalMimeType canonical_mime_type;
101 int http_status_code;
102 bool no_sniff;
103 };
104
105 typedef std::map<int, ResponseMetaData> RequestIdToMetaDataMap;
106 typedef std::map<int, bool> RequestIdToResultMap;
107 102
108 private: 103 private:
109 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme); 104 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme);
110 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite); 105 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite);
111 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet); 106 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet);
112 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML); 107 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML);
113 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML); 108 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML);
114 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON); 109 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON);
115 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS); 110 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS);
116 111
117 // Returns the representative mime type enum value of the mime type of 112 // Returns the representative mime type enum value of the mime type of
118 // response. For example, this returns the same value for all text/xml mime 113 // response. For example, this returns the same value for all text/xml mime
119 // type families such as application/xml, application/rss+xml. 114 // type families such as application/xml, application/rss+xml.
120 static ResponseMetaData::CanonicalMimeType GetCanonicalMimeType( 115 static SiteIsolationResponseMetaData::CanonicalMimeType GetCanonicalMimeType(
121 const std::string& mime_type); 116 const std::string& mime_type);
122 117
123 // Returns whether this scheme is a target of cross-site document 118 // Returns whether this scheme is a target of cross-site document
124 // policy(XSDP). This returns true only for http://* and https://* urls. 119 // policy(XSDP). This returns true only for http://* and https://* urls.
125 static bool IsBlockableScheme(const GURL& frame_origin); 120 static bool IsBlockableScheme(const GURL& frame_origin);
126 121
127 // Returns whether the two urls belong to the same sites. 122 // Returns whether the two urls belong to the same sites.
128 static bool IsSameSite(const GURL& frame_origin, const GURL& response_url); 123 static bool IsSameSite(const GURL& frame_origin, const GURL& response_url);
129 124
130 // Returns whether there's a valid CORS header for frame_origin. This is 125 // Returns whether there's a valid CORS header for frame_origin. This is
(...skipping 19 matching lines...) Expand all
150 // Never needs to be constructed/destructed. 145 // Never needs to be constructed/destructed.
151 SiteIsolationPolicy() {} 146 SiteIsolationPolicy() {}
152 ~SiteIsolationPolicy() {} 147 ~SiteIsolationPolicy() {}
153 148
154 DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy); 149 DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy);
155 }; 150 };
156 151
157 } // namespace content 152 } // namespace content
158 153
159 #endif // CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ 154 #endif // CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698