Forwarding POST body into renderer after a cross-site transfer.

content/browser/loader/cross_site_resource_handler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/loader/cross_site_resource_handler.h"
 
 #include <string>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "content/browser/appcache/appcache_interceptor.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/frame_host/cross_site_transferring_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 #include "content/browser/loader/resource_request_info_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/common/resource_request_body.h"
 #include "content/common/site_isolation_policy.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/global_request_id.h"
 #include "content/public/browser/resource_controller.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/resource_response.h"
 #include "content/public/common/url_constants.h"
 #include "net/http/http_response_headers.h"
 #include "net/url_request/url_request.h"
 
 namespace content {
 
 namespace {
 
 bool leak_requests_for_testing_ = false;
 
 // The parameters to OnCrossSiteResponseHelper exceed the number of arguments
 // base::Bind supports.
 struct CrossSiteResponseParams {
   CrossSiteResponseParams(
       int render_frame_id,
       const GlobalRequestID& global_request_id,
       const std::vector<GURL>& transfer_url_chain,
       const Referrer& referrer,
       ui::PageTransition page_transition,
-      bool should_replace_current_entry)
+      bool should_replace_current_entry,
+      const scoped_refptr<ResourceRequestBody> resource_request_body)
       : render_frame_id(render_frame_id),
         global_request_id(global_request_id),
         transfer_url_chain(transfer_url_chain),
         referrer(referrer),
         page_transition(page_transition),
-        should_replace_current_entry(should_replace_current_entry) {
-  }
+        should_replace_current_entry(should_replace_current_entry),
+        resource_request_body(resource_request_body) {}
 
   int render_frame_id;
   GlobalRequestID global_request_id;
   std::vector<GURL> transfer_url_chain;
   Referrer referrer;
   ui::PageTransition page_transition;
   bool should_replace_current_entry;
+  scoped_refptr<ResourceRequestBody> resource_request_body;
 };
 
 void OnCrossSiteResponseHelper(const CrossSiteResponseParams& params) {
   std::unique_ptr<CrossSiteTransferringRequest> cross_site_transferring_request(
       new CrossSiteTransferringRequest(params.global_request_id));
 
   RenderFrameHostImpl* rfh =
       RenderFrameHostImpl::FromID(params.global_request_id.child_id,
                                   params.render_frame_id);
   if (rfh && rfh->is_active()) {
     if (rfh->GetParent()) {
       // We should only swap processes for subframes in --site-per-process mode.
       // CrossSiteResourceHandler is not installed on subframe requests in
       // default Chrome.
       CHECK(SiteIsolationPolicy::AreCrossProcessFramesPossible());
     }
+
+    // TODO(lukasza): DO NOT SUBMIT: Double-check that post body is cleared
+    // upon redirect - otherwise we would leak post body to a cross-site
+    // renderer (violating site isolation goals).
+
     rfh->OnCrossSiteResponse(
         params.global_request_id, std::move(cross_site_transferring_request),
         params.transfer_url_chain, params.referrer, params.page_transition,
-        params.should_replace_current_entry);
+        params.should_replace_current_entry, params.resource_request_body);
   } else if (leak_requests_for_testing_) {
     // Some unit tests expect requests to be leaked in this case, so they can
     // pass them along manually.
     cross_site_transferring_request->ReleaseRequest();
   }
 }
 
 // Returns whether a transfer is needed by doing a check on the UI thread.
 CrossSiteResourceHandler::NavigationDecision
 CheckNavigationPolicyOnUI(GURL real_url, int process_id, int render_frame_id) {
@@ skipping 231 matching lines @@
   // occurred, plus the destination URL at the end.
   std::vector<GURL> transfer_url_chain;
   Referrer referrer;
   int render_frame_id = info->GetRenderFrameID();
   transfer_url_chain = request()->url_chain();
   referrer = Referrer(GURL(request()->referrer()), info->GetReferrerPolicy());
   ResourceDispatcherHostImpl::Get()->MarkAsTransferredNavigation(global_id,
                                                                  response_);
 
   BrowserThread::PostTask(
-      BrowserThread::UI,
-      FROM_HERE,
-      base::Bind(
-          &OnCrossSiteResponseHelper,
-          CrossSiteResponseParams(render_frame_id,
-                                  global_id,
-                                  transfer_url_chain,
-                                  referrer,
-                                  info->GetPageTransition(),
-                                  info->should_replace_current_entry())));
+      BrowserThread::UI, FROM_HERE,
+      base::Bind(&OnCrossSiteResponseHelper,
+                 CrossSiteResponseParams(
+                     render_frame_id, global_id, transfer_url_chain, referrer,
+                     info->GetPageTransition(),
+                     info->should_replace_current_entry(), info->body())));
 }
 
 bool CrossSiteResourceHandler::DeferForNavigationPolicyCheck(
     ResourceRequestInfoImpl* info,
     ResourceResponse* response,
     bool* defer) {
   // Store the response_ object internally, since the navigation is deferred
   // regardless of whether it will be a transfer or not.
   response_ = response;
 
@@ skipping 28 matching lines @@
     controller()->Resume();
   }
 }
 
 void CrossSiteResourceHandler::OnDidDefer() {
   did_defer_ = true;
   request()->LogBlockedBy("CrossSiteResourceHandler");
 }
 
 }  // namespace content