Forwarding POST body into renderer after a cross-site transfer.

content/browser/loader/navigation_resource_throttle.cc

Index: content/browser/loader/navigation_resource_throttle.cc
diff --git a/content/browser/loader/navigation_resource_throttle.cc b/content/browser/loader/navigation_resource_throttle.cc
index 3c0f5121c4c188e3b599069b6e1cd0877d8d01b7..ac286d73c773e2ddce30ca287a0c589fd7eb9d76 100644
--- a/content/browser/loader/navigation_resource_throttle.cc
+++ b/content/browser/loader/navigation_resource_throttle.cc
@@ -10,8 +10,10 @@
 #include "base/callback.h"
 #include "base/location.h"
 #include "base/logging.h"
+#include "base/memory/ref_counted.h"
 #include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/loader/resource_request_info_impl.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_data.h"
 #include "content/public/browser/resource_context.h"
@@ -39,14 +41,16 @@ void SendCheckResultToIOThread(UIChecksPerformedCallback callback,
                           base::Bind(callback, result));
 }
 
-void CheckWillStartRequestOnUIThread(UIChecksPerformedCallback callback,
-                                     int render_process_id,
-                                     int render_frame_host_id,
-                                     const std::string& method,
-                                     const Referrer& sanitized_referrer,
-                                     bool has_user_gesture,
-                                     ui::PageTransition transition,
-                                     bool is_external_protocol) {
+void CheckWillStartRequestOnUIThread(
+    UIChecksPerformedCallback callback,
+    int render_process_id,
+    int render_frame_host_id,
+    const std::string& method,
+    const scoped_refptr<content::ResourceRequestBody>& resource_request_body,
+    const Referrer& sanitized_referrer,
+    bool has_user_gesture,
+    ui::PageTransition transition,
+    bool is_external_protocol) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RenderFrameHostImpl* render_frame_host =
       RenderFrameHostImpl::FromID(render_process_id, render_frame_host_id);
@@ -63,8 +67,9 @@ void CheckWillStartRequestOnUIThread(UIChecksPerformedCallback callback,
   }
 
   navigation_handle->WillStartRequest(
-      method, sanitized_referrer, has_user_gesture, transition,
-      is_external_protocol, base::Bind(&SendCheckResultToIOThread, callback));
+      method, resource_request_body, sanitized_referrer, has_user_gesture,
+      transition, is_external_protocol,
+      base::Bind(&SendCheckResultToIOThread, callback));
 }
 
 void CheckWillRedirectRequestOnUIThread(
@@ -141,7 +146,8 @@ NavigationResourceThrottle::~NavigationResourceThrottle() {}
 
 void NavigationResourceThrottle::WillStartRequest(bool* defer) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  const ResourceRequestInfo* info = ResourceRequestInfo::ForRequest(request_);
+  const ResourceRequestInfoImpl* info =
+      ResourceRequestInfoImpl::ForRequest(request_);
   if (!info)
     return;
 
@@ -159,7 +165,7 @@ void NavigationResourceThrottle::WillStartRequest(bool* defer) {
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&CheckWillStartRequestOnUIThread, callback, render_process_id,
-                 render_frame_id, request_->method(),
+                 render_frame_id, request_->method(), info->body(),
                  Referrer::SanitizeForRequest(
                      request_->url(), Referrer(GURL(request_->referrer()),
                                                info->GetReferrerPolicy())),
@@ -172,10 +178,13 @@ void NavigationResourceThrottle::WillRedirectRequest(
     const net::RedirectInfo& redirect_info,
     bool* defer) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  const ResourceRequestInfo* info = ResourceRequestInfo::ForRequest(request_);
+  ResourceRequestInfoImpl* info = ResourceRequestInfoImpl::ForRequest(request_);
   if (!info)
     return;
 
+  if (redirect_info.new_method != "POST")
+    info->ResetBody();

[Charlie Reis, 2016/05/31 21:08:36]

Is this a second line of defense, or did we actually get this wrong before and
leave the POST data in the request after converting it to a GET?

[Łukasz Anforowicz, 2016/05/31 22:40:55]

This is a separate code path.  Network stack operates on net::UploadDataStream
(which is created from content::ResourceRequestBody, but doesn't retain any ties
to the original content::ResourceRequestBody object).

We need to stash ResourceRequestBody inside ResourceRequestInfoImpl so it can be
passed to NavigationHandleImpl::WillStartRequest.  We never use
ResourceRequestInfoImpl::body() afterwards - after the call to
NHI::WillStartRequest, we could in theory ResetBody.  WDYT about doing this?

The current code keeps ResourceRequestInfoImpl::body (even after it is not
really needed after the call to NHI::WillStartRequest), because I felt it would
be weird to have to describe that RRII::original_headers_ are valid forever, but
RRII::body_ is only valid for a little while.

[Charlie Reis, 2016/06/01 23:46:32]

I see.  Sounds like there's a slight risk the two copies could fork and become
different, but I don't think that's likely.  Anyway, seems ok to leave it in
place here.

+
   int render_process_id, render_frame_id;
   if (!info->GetAssociatedRenderFrame(&render_process_id, &render_frame_id))
     return;