Apply Referrer-Policy header when following redirects

net/url_request/url_request_job.cc

Index: net/url_request/url_request_job.cc
diff --git a/net/url_request/url_request_job.cc b/net/url_request/url_request_job.cc
index b9c8646f729e75e45b45d65b635d1f51e78da254..cc7fe96cd48457e5f9d991812dfa0d518362cefd 100644
--- a/net/url_request/url_request_job.cc
+++ b/net/url_request/url_request_job.cc
@@ -14,6 +14,7 @@
 #include "base/profiler/scoped_tracker.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/values.h"
@@ -62,6 +63,51 @@ std::string ComputeMethodForRedirect(const std::string& method,
   return method;
 }
 
+// A redirect response can contain a Referrer-Policy header
+// (https://w3c.github.io/webappsec-referrer-policy/). This function
+// checks for a Referrer-Policy header, and parses it if
+// present. Returns the referrer policy that should be used for the
+// request.
+URLRequest::ReferrerPolicy ProcessReferrerPolicyHeaderOnRedirect(
+    URLRequest* request) {
+  URLRequest::ReferrerPolicy new_policy = request->referrer_policy();
+
+  std::string referrer_policy_header;
+  request->GetResponseHeaderByName("Referrer-Policy", &referrer_policy_header);
+  std::vector<std::string> policy_tokens =
+      base::SplitString(referrer_policy_header, ",", base::TRIM_WHITESPACE,
+                        base::SPLIT_WANT_NONEMPTY);
+
+  for (const auto& token : policy_tokens) {
+    if (base::CompareCaseInsensitiveASCII(token, "never") == 0 ||
+        base::CompareCaseInsensitiveASCII(token, "no-referrer") == 0) {
+      new_policy = URLRequest::NO_REFERRER;

[mmenke, 2016/06/28 21:32:08]

Should probably have continues after all of these, just to make it clearer
they're mutually exclusive.  (else if's also work, but unless the code is likely
to change in a way that anything after all these ifs should be shared by them,
think the continue is generally preferred).

[estark, 2016/06/28 22:38:42]

Done.

+    }
+
+    if (base::CompareCaseInsensitiveASCII(token, "default") == 0 ||
+        base::CompareCaseInsensitiveASCII(token,
+                                          "no-referrer-when-downgrade") == 0) {
+      new_policy =
+          URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
+    }
+
+    if (base::CompareCaseInsensitiveASCII(token, "origin") == 0) {
+      new_policy = URLRequest::ORIGIN;
+    }
+
+    if (base::CompareCaseInsensitiveASCII(token, "origin-when-cross-origin") ==
+        0) {
+      new_policy = URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN;
+    }
+
+    if (base::CompareCaseInsensitiveASCII(token, "always") == 0 ||
+        base::CompareCaseInsensitiveASCII(token, "unsafe-url") == 0) {
+      new_policy = URLRequest::NEVER_CLEAR_REFERRER;
+    }
+  }
+  return new_policy;
+}
+
 }  // namespace
 
 URLRequestJob::URLRequestJob(URLRequest* request,
@@ -344,6 +390,13 @@ GURL URLRequestJob::ComputeReferrerForRedirect(
 
     case URLRequest::NEVER_CLEAR_REFERRER:
       return original_referrer;
+    case URLRequest::ORIGIN:
+      return original_referrer.GetOrigin();
+    case URLRequest::NO_REFERRER:
+      return GURL();
+    case URLRequest::MAX_REFERRER_POLICY:

[mmenke, 2016/06/28 21:32:08]

I'm fine with adding this, if it's useful, but why did you need to add this?

[estark, 2016/06/28 22:38:42]

RedirectInfo is sent in IPCs, and adding a ReferrerPolicy to the RedirectInfo
IPC struct requires a max value for the enum... I think. (See
resource_messages.h)

+      NOTREACHED();
+      return original_referrer;

[mmenke, 2016/06/28 21:32:08]

This should probably be GURL(), to match the fallthrough case.

[estark, 2016/06/28 22:38:42]

Done.

   }
 
   NOTREACHED();
@@ -398,6 +451,7 @@ void URLRequestJob::NotifyHeadersComplete() {
 
   GURL new_location;
   int http_status_code;
+
   if (IsRedirectResponse(&new_location, &http_status_code)) {
     // Redirect response bodies are not read. Notify the transaction
     // so it does not treat being stopped as an error.
@@ -944,11 +998,18 @@ RedirectInfo URLRequestJob::ComputeRedirectInfo(const GURL& location,
         request_->first_party_for_cookies();
   }
 
+  if (request_->context()->enable_referrer_policy_header()) {
+    redirect_info.new_referrer_policy =
+        ProcessReferrerPolicyHeaderOnRedirect(request_);
+  } else {
+    redirect_info.new_referrer_policy = request_->referrer_policy();
+  }
+
   // Alter the referrer if redirecting cross-origin (especially HTTP->HTTPS).
   redirect_info.new_referrer =
-      ComputeReferrerForRedirect(request_->referrer_policy(),
-                                 request_->referrer(),
-                                 redirect_info.new_url).spec();
+      ComputeReferrerForRedirect(redirect_info.new_referrer_policy,
+                                 request_->referrer(), redirect_info.new_url)
+          .spec();
 
   std::string include_referer;
   request_->GetResponseHeaderByName("include-referer-token-binding-id",