Fixing renderer's access to a file from HTTP POST (after a xsite transfer).

content/browser/loader/resource_dispatcher_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 
 #include <stddef.h>
 
@@ skipping 500 matching lines @@
     if (frame_host)
       routing_ids->insert(frame_host->GetGlobalFrameRoutingId());
     if (pending_frame_host)
       routing_ids->insert(pending_frame_host->GetGlobalFrameRoutingId());
   }
   BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
                           base::Bind(&NotifyForRouteSetOnIO, frame_callback,
                                      base::Passed(std::move(routing_ids))));
 }
 
+bool CanAccessFilesOfResourceRequestBody(
+    int child_id,
+    const scoped_refptr<ResourceRequestBody>& body) {
+  if (!body)
+    return true;
+
+  return ChildProcessSecurityPolicyImpl::GetInstance()->CanReadAllFiles(
+      child_id, body->GetReferencedFiles());
+}
+
 }  // namespace
 
 LoaderIOThreadNotifier::LoaderIOThreadNotifier(WebContents* web_contents)
     : WebContentsObserver(web_contents) {}
 
 LoaderIOThreadNotifier::~LoaderIOThreadNotifier() {}
 
 void LoaderIOThreadNotifier::RenderFrameDeleted(
     RenderFrameHost* render_frame_host) {
   NotifyForRouteFromUI(
@@ skipping 842 matching lines @@
   int process_type = filter_->process_type();
   int child_id = filter_->child_id();
 
   // Reject request id that's currently in use.
   if (IsRequestIDInUse(GlobalRequestID(child_id, request_id))) {
     bad_message::ReceivedBadMessage(filter_,
                                     bad_message::RDH_INVALID_REQUEST_ID);
     return;
   }
 
+  // Reject requests attempting to refer to unauthorized files.  This is
+  // important, because after a cross-site transfer, the new renderer process is
+  // unconditionally granted access to files from ResourceRequestBody.
+  if (!CanAccessFilesOfResourceRequestBody(child_id,
+                                           request_data.request_body)) {
+    bad_message::ReceivedBadMessage(
+        filter_, bad_message::RDH_CAN_ACCESS_FILES_OF_REQUEST_BODY);
+    return;
+  }
+
   // PlzNavigate: reject invalid renderer main resource request.
   bool is_navigation_stream_request =
       IsBrowserSideNavigationEnabled() &&
       IsResourceTypeFrame(request_data.resource_type);
   if (is_navigation_stream_request &&
       !request_data.resource_body_stream_url.SchemeIs(url::kBlobScheme)) {
     bad_message::ReceivedBadMessage(filter_, bad_message::RDH_INVALID_URL);
     return;
   }
 
@@ skipping 1300 matching lines @@
   ssl.cert_id = GetCertStore()->StoreCert(ssl_info.cert.get(), child_id);
   response->head.security_info = SerializeSecurityInfo(ssl);
 }
 
 CertStore* ResourceDispatcherHostImpl::GetCertStore() {
   return cert_store_for_testing_ ? cert_store_for_testing_
                                  : CertStore::GetInstance();
 }
 
 }  // namespace content