service worker: Don't control a subframe of an insecure context

content/browser/service_worker/service_worker_provider_host.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_PROVIDER_HOST_H_
 #define CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_PROVIDER_HOST_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 54 matching lines @@
   // MSG_ROUTING_NONE. When this provider host is for a Document,
   // |route_id| is the frame ID of the Document. When this provider host is for
   // a Shared Worker, |route_id| is the Shared Worker route ID.
   // |provider_type| gives additional information whether the provider is
   // created for controller (ServiceWorker) or controllee (Document or
   // SharedWorker).
   ServiceWorkerProviderHost(int render_process_id,
                             int route_id,
                             int provider_id,
                             ServiceWorkerProviderType provider_type,
+                            bool is_parent_frame_secure,
                             base::WeakPtr<ServiceWorkerContextCore> context,
                             ServiceWorkerDispatcherHost* dispatcher_host);
   virtual ~ServiceWorkerProviderHost();
 
   const std::string& client_uuid() const { return client_uuid_; }
   int process_id() const { return render_process_id_; }
   int provider_id() const { return provider_id_; }
   int frame_id() const;
   int route_id() const { return route_id_; }
 
+  bool is_parent_frame_secure() const { return is_parent_frame_secure_; }
+  void set_parent_frame_secure(bool is_parent_frame_secure) {
+    is_parent_frame_secure_ = is_parent_frame_secure;

[horo, 2016/06/03 09:54:45]

Please add DCHECK() to ensure that set_parent_frame_secure() can't be called
after IsContextSecureForServiceWorker() is called.

[falken, 2016/06/03 12:10:45]

Done. I ended up making the bool an enum, which is cleaner anyway.

+  }
+
+  // Returns whether this provider host is secure enough to have a service
+  // worker controller.
+  // Analogous to Blink's Document::isSecureContext. Because of how service
+  // worker intercepts main resource requests, this check must be done
+  // browser-side once the URL is known (see comments in
+  // ServiceWorkerNetworkProvider::CreateForNavigation). This function uses
+  // |document_url_| and |is_parent_frame_secure_| to determine context
+  // security, so they must be set properly before calling this function.
+  bool IsContextSecureForServiceWorker() const;
+
   bool IsHostToRunningServiceWorker() {
     return running_hosted_version_.get() != NULL;
   }
 
   ServiceWorkerVersion* controlling_version() const {
     return controlling_version_.get();
   }
   ServiceWorkerVersion* active_version() const {
     return associated_registration_.get() ?
         associated_registration_->active_version() : NULL;
@@ skipping 205 matching lines @@
   void FinalizeInitialization(int process_id,
                               int frame_routing_id,
                               ServiceWorkerDispatcherHost* dispatcher_host);
 
   std::string client_uuid_;
   int render_process_id_;
   int route_id_;
   int render_thread_id_;
   int provider_id_;
   ServiceWorkerProviderType provider_type_;
+  bool is_parent_frame_secure_;
   GURL document_url_;
   GURL topmost_frame_url_;
 
   std::vector<GURL> associated_patterns_;
   scoped_refptr<ServiceWorkerRegistration> associated_registration_;
 
   // Keyed by registration scope URL length.
   typedef std::map<size_t, scoped_refptr<ServiceWorkerRegistration>>
       ServiceWorkerRegistrationMap;
   // Contains all living registrations which has pattern this document's
   // URL starts with.
   ServiceWorkerRegistrationMap matching_registrations_;
 
   std::unique_ptr<OneShotGetReadyCallback> get_ready_callback_;
   scoped_refptr<ServiceWorkerVersion> controlling_version_;
   scoped_refptr<ServiceWorkerVersion> running_hosted_version_;
   base::WeakPtr<ServiceWorkerContextCore> context_;
   ServiceWorkerDispatcherHost* dispatcher_host_;
   bool allow_association_;
 
   std::vector<base::Closure> queued_events_;
 
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerProviderHost);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_PROVIDER_HOST_H_