service worker: Don't control a subframe of an insecure context

content/browser/frame_host/navigation_request.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_request.h"
 
 #include <utility>
 
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 #include "content/browser/frame_host/frame_tree.h"
@@ skipping 283 matching lines @@
   // commit; they leave the frame showing the previous page.
   DCHECK(response);
   if (response->head.headers.get() &&
       (response->head.headers->response_code() == 204 ||
        response->head.headers->response_code() == 205)) {
     frame_tree_node_->ResetNavigationRequest(false);
     return;
   }
 
   // Update the service worker params of the request params.
+  // TODO(falken): This should do an isSecureContext check too.

[jww, 2016/05/24 18:06:03]

To ask a dumb question, why not add that check right now?

[falken, 2016/05/25 09:19:58]

I didn't look too hard, but there's no WebFrame here. clamy, how hard would it
be to add a check here like the one in service_worker_navigation_provider?

[clamy, 2016/05/25 11:21:46]

If you're checking for the sandbox flags, you can get them from the
FrameTreeNode that NavigationRequest keeps a pointer to.

[falken, 2016/05/26 02:09:49]

I want to do an ancestor walk over the frame tree, checking their security (I
think FrameTreeNode doesn't have that info). But I think the latest patch
changed this so service_worker_network_provider can handle the PlzNavigate case
well.

[clamy, 2016/05/26 15:45:31]

FrameTreeNodes do allow you to walk over the FrameTree. Each of them has a
FrameTreeNodeReplicationState that has some security info, including the origin
(and whether it's potentially trustworthy). The only thing missing to do a check
that matches the one in RenderFrame is the list of whitelisted urls. I'm not
sure where you'd find that in the renderer.

[alexmos, 2016/05/26 22:13:35]

Yeah, you should be able to follow the FrameTreeNode::parent() chain and do the
check on FrameTreeNode::current_origin().  You'd need to do some additional work
to get isSecureContext's scheme whitelist here, but seems like
secureContextBypassingSchemes() ultimately comes from 
GetSchemesBypassingSecureContextCheckWhitelist(), which is in chrome/common, so
available in the browser process.  So it's actually isn't that bad, but you'd
need some extra delegate plumbing to get to it from content/.

What seems harder is that the origin we have on FrameTreeNodes is a url::Origin,
which doesn't have all the information from a SecurityOrigin.  We do have a
trustworthiness bit in FrameTreeNode::current_replication_state(),
has_potentially_trustworthy_unique_origin, but it isn't actually equivalent to
SecurityOrigin::isPotentiallyTrustworthy.  It's only meaningful for unique
origins (i.e., it indicates potential trustworthiness for a sandboxed iframe),
and you'd still need to either do all the other work in
SecurityOrigin::isPotentiallyTrustworthy() in the browser process, or replicate
the full value of isPotentiallyTrustworthy() from the renderer.  Overall, all
this seems non-trivial and I'd vote for doing it in a separate CL.

CC-ing estark@, who's worked on isSecureContext plumbing recently and may have
more thoughts on getting it to work from the browser process.

[falken, 2016/05/27 05:47:03]

Sorry yes I meant "FrameTreeNode doesn't have the security info". But I think
the latest patchset is OK doing the walk renderer-side, for the PlzNavigation
case?

[clamy, 2016/05/30 16:22:42]

Probably. In any case, we'll have to make significant changes to how PlzNavigate
works with ServiceWorker, so it's quite possible that this code will go away
anyway.

   request_params_.should_create_service_worker =
       (frame_tree_node_->pending_sandbox_flags() &
        blink::WebSandboxFlags::Origin) != blink::WebSandboxFlags::Origin;
   if (navigation_handle_->service_worker_handle()) {
     request_params_.service_worker_provider_id =
         navigation_handle_->service_worker_handle()
             ->service_worker_provider_host_id();
   }
 
   // Update the lofi state of the request.
@@ skipping 154 matching lines @@
       browser_context, navigating_frame_host->GetSiteInstance());
   DCHECK(partition);
 
   ServiceWorkerContextWrapper* service_worker_context =
       static_cast<ServiceWorkerContextWrapper*>(
           partition->GetServiceWorkerContext());
   navigation_handle_->InitServiceWorkerHandle(service_worker_context);
 }
 
 }  // namespace content