Add basic Referrer-Policy support for Documents

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 67 matching lines @@
 #include "core/page/ChromeClient.h"
 #include "core/page/CreateWindow.h"
 #include "core/page/FrameTree.h"
 #include "core/page/Page.h"
 #include "core/page/WindowFeatures.h"
 #include "core/page/scrolling/ScrollingCoordinator.h"
 #include "core/svg/graphics/SVGImage.h"
 #include "core/xml/parser/XMLDocumentParser.h"
 #include "platform/Logging.h"
 #include "platform/PluginScriptForbiddenScope.h"
+#include "platform/RuntimeEnabledFeatures.h"
 #include "platform/ScriptForbiddenScope.h"
 #include "platform/TraceEvent.h"
 #include "platform/UserGestureIndicator.h"
 #include "platform/network/HTTPParsers.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/scroll/ScrollAnimatorBase.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "platform/weborigin/SecurityPolicy.h"
 #include "platform/weborigin/Suborigin.h"
 #include "public/platform/WebCachePolicy.h"
@@ skipping 409 matching lines @@
             size_t commaIndex = headerContentLanguage.find(',');
             headerContentLanguage.truncate(commaIndex); // kNotFound == -1 == don't truncate
             headerContentLanguage = headerContentLanguage.stripWhiteSpace(isHTMLSpace<UChar>);
             if (!headerContentLanguage.isEmpty())
                 m_frame->document()->setContentLanguage(AtomicString(headerContentLanguage));
         }
 
         OriginTrialContext::addTokensFromHeader(m_frame->document(), m_documentLoader->response().httpHeaderField(HTTPNames::Origin_Trial));
     }
 
+    if (m_documentLoader && RuntimeEnabledFeatures::referrerPolicyHeaderEnabled()) {
+        String referrerPolicyHeader = m_documentLoader->response().httpHeaderField(HTTPNames::Referrer_Policy);
+        if (!referrerPolicyHeader.isNull()) {
+            ReferrerPolicy referrerPolicy = parseReferrerPolicyHeader(referrerPolicyHeader);

[Mike West, 2016/06/21 07:40:03]

Could you call `Document::processReferrerPolicy(referrerPolicyHeader)` instead,
and either inline the new parsing code there (or in
`SecurityPolicy::referrerPolicyFromString(...)`, I suppose?), making the header
behave exactly the same way as `<meta>`? This would have the impact of allowing
comma-separated tokens in the `<meta>` content, but I think I'd prefer that to
having two separate code paths.

[estark, 2016/06/21 17:41:33]

Hmm. If I put the new parsing code in Document::processReferrerPolicy(), then I
can't easily reuse it for processing headers delivered on Worker scripts. If I
put it in SecurityPolicy::referrerPolicyFromString(), then that means
comma-separated values will also be allowed for the 'referrerpolicy' attribute,
which seems weird to me.

I could move Document::processReferrerPolicy() to be a method on
ExecutionContext instead of Document and do the new parsing there, so that I can
call it for both Documents and Workers. WDYT of that plan?

[Mike West, 2016/06/22 18:57:04]

I trust your judgement. I think it's probably reasonable to just accept `a, b,
c` in `<meta>` and send them through the same processing internally, but if
you'd prefer not to do that, more power to you.

LGTM either way.

+            if (referrerPolicy != ReferrerPolicyDefault) {
+                m_frame->document()->setReferrerPolicy(referrerPolicy);
+            }
+        }
+    }
+
     client()->didCreateNewDocument();
 }
 
 void FrameLoader::finishedParsing()
 {
     if (m_stateMachine.creatingInitialEmptyDocument())
         return;
 
     m_progressTracker->finishedParsing();
 
@@ skipping 1085 matching lines @@
     tracedValue->setString("documentLoaderURL", m_documentLoader ? m_documentLoader->url() : String());
     return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const
 {
     TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this, toTracedValue());
 }
 
 } // namespace blink