XFO: Bypass ancestor checks for 'Content-Disposition: attachment; ...'

content/browser/frame_host/ancestor_throttle.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/ancestor_throttle.h"
 
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/common/console_message_level.h"
+#include "net/http/http_content_disposition.h"
 #include "net/http/http_response_headers.h"
 #include "url/origin.h"
 
 namespace content {
 
 // static
 std::unique_ptr<NavigationThrottle> AncestorThrottle::MaybeCreateThrottleFor(
     NavigationHandle* handle) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
@@ skipping 125 matching lines @@
       current = HeaderDisposition::INVALID;
 
     if (result == HeaderDisposition::NONE)
       result = current;
     else if (result != current)
       result = HeaderDisposition::CONFLICT;
   }
 
   // If 'X-Frame-Options' would potentially block the response, check whether
   // the 'frame-ancestors' CSP directive should take effect instead. See
-  // https://www.w3.org/TR/CSP/#frame-ancestors-and-frame-options
+  // https://www.w3.org/TR/CSP/#frame-ancestors-and-frame-options. Also, check
+  // whether the response should be treated as a download.
   if (result != HeaderDisposition::NONE &&
       result != HeaderDisposition::ALLOWALL) {
     iter = 0;
     value = std::string();
     while (headers->EnumerateHeader(&iter, "content-security-policy", &value)) {
       // TODO(mkwst): 'frame-ancestors' is currently handled in Blink. We should
       // handle it here instead. Until then, don't block the request, and let
       // Blink handle it. https://crbug.com/555418
       std::vector<std::string> tokens = base::SplitString(
           value, ";", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
       if (std::count_if(tokens.begin(), tokens.end(), [](std::string token) {
             // The trailing " " is intentional; we'd otherwise match
             // "frame-ancestors-is-not-this-directive".
             return base::StartsWith(token, "frame-ancestors ",
                                     base::CompareCase::INSENSITIVE_ASCII);
           })) {
         return HeaderDisposition::BYPASS;
       }
     }
+
+    iter = 0;
+    value = std::string();
+    while (headers->EnumerateHeader(&iter, "content-disposition", &value)) {
+      if (net::HttpContentDisposition(value, std::string()).is_attachment())
+        return HeaderDisposition::BYPASS;
+    }
   }
   return result;
 }
 
 }  // namespace content