UMA data collector for cross-site documents(XSD)

content/child/resource_dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/child/resource_dispatcher.h"
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/compiler_specific.h"
 #include "base/debug/alias.h"
 #include "base/files/file_path.h"
 #include "base/memory/shared_memory.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/strings/string_util.h"
 #include "content/child/request_extra_data.h"
+#include "content/child/site_isolation_policy.h"
 #include "content/common/inter_process_time_ticks_converter.h"
 #include "content/common/resource_messages.h"
 #include "content/public/child/resource_dispatcher_delegate.h"
 #include "content/public/common/resource_response.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "net/base/request_priority.h"
 #include "net/http/http_response_headers.h"
 #include "webkit/common/resource_type.h"
 
@@ skipping 60 matching lines @@
   // The request to send, created on initialization for modification and
   // appending data.
   ResourceHostMsg_Request request_;
 
   // ID for the request, valid once Start()ed, -1 if not valid yet.
   int request_id_;
 
   // The routing id used when sending IPC messages.
   int routing_id_;
 
+  // The security origin of the frame that initiates this request.
+  WebKit::WebString frame_origin_;
+
   bool is_synchronous_request_;
 };
 
 IPCResourceLoaderBridge::IPCResourceLoaderBridge(
     ResourceDispatcher* dispatcher,
     const ResourceLoaderBridge::RequestInfo& request_info)
     : peer_(NULL),
       dispatcher_(dispatcher),
       request_id_(-1),
       routing_id_(request_info.routing_id),
@@ skipping 19 matching lines @@
     request_.is_main_frame = extra_data->is_main_frame();
     request_.frame_id = extra_data->frame_id();
     request_.parent_is_main_frame = extra_data->parent_is_main_frame();
     request_.parent_frame_id = extra_data->parent_frame_id();
     request_.allow_download = extra_data->allow_download();
     request_.transition_type = extra_data->transition_type();
     request_.transferred_request_child_id =
         extra_data->transferred_request_child_id();
     request_.transferred_request_request_id =
         extra_data->transferred_request_request_id();
+    frame_origin_ = extra_data->frame_origin();
   } else {
+    // TODO(dsjang): Consult the expert when this branch is taken.

[Charlie Reis, 2013/08/19 16:20:06]

What are you trying to figure out?

[dsjang, 2013/08/19 21:37:18]

I'm trying to make sure that the lack of request_info.extra_data implies that
this request is not-security relevant.

On 2013/08/19 16:20:06, creis wrote:

     request_.is_main_frame = false;
     request_.frame_id = -1;
     request_.parent_is_main_frame = false;
     request_.parent_frame_id = -1;
     request_.allow_download = true;
     request_.transition_type = PAGE_TRANSITION_LINK;
     request_.transferred_request_child_id = -1;
     request_.transferred_request_request_id = -1;
   }
 }
@@ skipping 19 matching lines @@
   request_.request_body = request_body;
 }
 
 // Writes a footer on the message and sends it
 bool IPCResourceLoaderBridge::Start(Peer* peer) {
   if (request_id_ != -1) {
     NOTREACHED() << "Starting a request twice";
     return false;
   }
 
-  peer_ = peer;
+  // TODO(dsjang): Figure out when exactly frame_id gets -1 to see if that case
+  // is security irrelevant.

[Charlie Reis, 2013/08/19 16:20:06]

Any luck tracking this down?

[dsjang, 2013/08/19 21:37:18]

Resolved this issue, and added a comment about the situation.

On 2013/08/19 16:20:06, creis wrote:

+  if (request_.frame_id >= 0) {
+    // SiteIsolationPolicy is refcounted, and it is deallocated when
+    // IPCResourceLoaderBridge is freed.
+    // This is buggy.

[Charlie Reis, 2013/08/19 16:20:06]

You're storing it in a normal pointer.  :)

[dsjang, 2013/08/19 21:37:18]

Done.

+    peer_ = new SiteIsolationPolicy(peer,
+                                    frame_origin_,
+                                    request_.url,
+                                    request_id_,
+                                    request_.resource_type);
+  }
 
   // generate the request ID, and append it to the message
   request_id_ = dispatcher_->AddPendingRequest(
       peer_, request_.resource_type, request_.url);
 
   return dispatcher_->message_sender()->Send(
       new ResourceHostMsg_RequestResource(routing_id_, request_id_, request_));
 }
 
 void IPCResourceLoaderBridge::Cancel() {
@@ skipping 150 matching lines @@
   if (delegate_) {
     ResourceLoaderBridge::Peer* new_peer =
         delegate_->OnReceivedResponse(
             request_info->peer, response_head.mime_type, request_info->url);
     if (new_peer)
       request_info->peer = new_peer;
   }
 
   ResourceResponseInfo renderer_response_info;
   ToResourceResponseInfo(*request_info, response_head, &renderer_response_info);
+

[Charlie Reis, 2013/08/19 16:20:06]

nit: Remove empty line.

[dsjang, 2013/08/19 21:37:18]

Done.

   request_info->peer->OnReceivedResponse(renderer_response_info);
 }
 
 void ResourceDispatcher::OnReceivedCachedMetadata(
       int request_id, const std::vector<char>& data) {
   PendingRequestInfo* request_info = GetPendingRequestInfo(request_id);
   if (!request_info)
     return;
 
   if (data.size())
@@ skipping 399 matching lines @@
 void ResourceDispatcher::ReleaseResourcesInMessageQueue(MessageQueue* queue) {
   while (!queue->empty()) {
     IPC::Message* message = queue->front();
     ReleaseResourcesInDataMessage(*message);
     queue->pop_front();
     delete message;
   }
 }
 
 }  // namespace content