OLD | NEW |
---|---|
(Empty) | |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. Use | |
2 // of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef CONTENT_SITE_ISOLATION_POLICY_H_ | |
6 #define CONTENT_SITE_ISOLATION_POLICY_H_ | |
7 | |
8 #include <map> | |
9 #include <utility> | |
10 | |
11 #include "base/gtest_prod_util.h" | |
12 #include "content/common/content_export.h" | |
13 #include "third_party/WebKit/public/platform/WebURLRequest.h" | |
14 #include "third_party/WebKit/public/platform/WebURLResponse.h" | |
15 #include "third_party/WebKit/public/web/WebFrame.h" | |
16 #include "webkit/child/resource_loader_bridge.h" | |
17 #include "webkit/common/resource_response_info.h" | |
18 | |
19 namespace content { | |
20 | |
21 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP) | |
22 // for Site Isolation. XSDP will monitor network responses to a renderer and | |
23 // block illegal responses so that a compromised renderer cannot steal private | |
24 // information from other sites. For now SiteIsolationPolicy monitors responses | |
25 // to gather various UMA stats to see the compatibility impact of actual | |
26 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers | |
27 // are as follows: | |
28 // | |
29 // SiteIsolation.AllResponses : # of all network responses. | |
30 // SiteIsolation.XSD.DataLength : the length of the first packet of a response. | |
31 // SiteIsolation.XSD.MimeType (enum): | |
32 // # of responses from other sites, tagged with a document mime type. | |
33 // 0:HTML, 1:XML, 2:JSON, 3:Plain, 4:Others | |
34 // SiteIsolation.XSD.[%MIMETYPE].Blocked : | |
35 // blocked # of cross-site document responses grouped by sniffed MIME type. | |
36 // SiteIsolation.XSD.[%MIMETYPE].Blocked.RenderableStatusCode : | |
37 // # of responses with renderable status code, | |
38 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. | |
39 // SiteIsolation.XSD.[%MIMETYPE].Blocked.NonRenderableStatusCode : | |
40 // # of responses with non-renderable status code, | |
41 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. | |
42 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.RenderableStatusCode : | |
43 // # of responses failed to be sniffed for its MIME type, but blocked by | |
44 // "X-Content-Type-Options: nosniff" header, and with renderable status code | |
45 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. | |
46 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode : | |
47 // # of responses failed to be sniffed for its MIME type, but blocked by | |
48 // "X-Content-Type-Options: nosniff" header, and with non-renderable status | |
49 // code out of SiteIsolation.XSD.[%MIMETYPE].Blocked. | |
50 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked : | |
51 // # of responses, but not blocked due to failure of mime sniffing. | |
52 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS : | |
53 // # of responses that are plausibly sniffed to be JavaScript. | |
54 | |
55 class CONTENT_EXPORT SiteIsolationPolicy | |
56 : public base::RefCounted<SiteIsolationPolicy>, | |
57 public webkit_glue::ResourceLoaderBridge::Peer { | |
58 public: | |
59 | |
60 SiteIsolationPolicy( | |
61 webkit_glue::ResourceLoaderBridge::Peer* original_peer, | |
62 WebKit::WebString& frame_origin, | |
63 GURL& request_url, | |
64 int request_id, | |
65 ResourceType::Type resource_type); | |
66 | |
67 // ResourceLoaderBridge::Peer methods: we directly calls original_peer_'s | |
68 // corresponding member functions other than OnReceiveRedirect(), | |
69 // OnReceivedResponse(), OnReceivedData(), and OnCompletedRequest(). | |
70 virtual void OnUploadProgress(uint64 position, uint64 size) OVERRIDE; | |
71 virtual void OnDownloadedData(int len) OVERRIDE; | |
72 virtual void OnReceivedCachedMetadata(const char* data, int len) OVERRIDE; | |
73 virtual void OnCompletedRequest( | |
74 int error_code, | |
75 bool was_ignored_by_handler, | |
76 const std::string& security_info, | |
77 const base::TimeTicks& completion_time) OVERRIDE; | |
78 | |
79 // Updates the request_url_ to |new_url| when the request this peer is | |
80 // listening to is redirected. | |
81 virtual bool OnReceivedRedirect( | |
82 const GURL& new_url, | |
83 const webkit_glue::ResourceResponseInfo& info, | |
84 bool* has_new_first_party_for_cookies, | |
85 GURL* new_first_party_for_cookies) OVERRIDE; | |
86 | |
87 // Records the HTTP header information of the response. We use the recorded | |
88 // header information to decide if this response will be the subject of | |
89 // cross-site document blocking. If it is, cross_site_document_header_ is set | |
90 // to true. This also makes state_ proceed from INIT to RESPONSE_RECEIVED. | |
91 virtual void OnReceivedResponse( | |
92 const webkit_glue::ResourceResponseInfo& info) OVERRIDE; | |
93 | |
94 // Examines the first network packet to see whether this response should be | |
95 // blocked by our cross-site document policy. This only examines response data | |
96 // when cross_site_document_header_ is true by OnReceivedResponse(). We apply | |
97 // content-sniffing to the first network packet to decide to block the | |
98 // response and records various kinds of UMA data stats at the same time. | |
99 // TODO(dsjang): Here is where we can do actual blocking of the body of a | |
100 // response. When the body is blocked, we can return an empty string instead. | |
101 virtual void OnReceivedData(const char* data, | |
102 int data_length, | |
103 int encoded_data_length) OVERRIDE; | |
104 | |
105 private: | |
106 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme); | |
107 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite); | |
108 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet); | |
109 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML); | |
110 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML); | |
111 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON); | |
112 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS); | |
113 | |
114 enum CanonicalMimeType { | |
115 HTML = 0, | |
116 XML = 1, | |
117 JSON = 2, | |
118 Plain = 3, | |
119 Others = 4, | |
120 MaxCanonicalMimeType, | |
121 }; | |
122 | |
123 enum RequestProgressState { | |
124 INIT = 0, | |
125 RESPONSE_RECEIVED = 1, | |
126 DATA_RECEIVED = 2, | |
127 COMPLETED = 3, | |
128 }; | |
129 | |
130 // This class wraps original_peer_ to intercept certain calls of it to monitor | |
131 // the lifetime of a request to apply our cross-site document blocking. | |
132 webkit_glue::ResourceLoaderBridge::Peer* original_peer_; | |
Charlie Reis
2013/08/19 16:20:06
Style nit: Fields go below methods.
dsjang
2013/08/19 21:37:18
Done.
| |
133 | |
134 // These are fixed when the object is created. | |
135 GURL frame_origin_; | |
136 // However, request_url_ is updated to a new url when redirected. | |
137 GURL request_url_; | |
138 int request_id_; | |
139 ResourceType::Type resource_type_; | |
140 | |
141 // The current state of the request. This can only proceeds to a greater value | |
142 // when an event happens. This is only used for sanity checks in DCHECK() to | |
143 // see if callbacks are called in an expected order. | |
144 RequestProgressState state_; | |
145 | |
146 // This is set to true when we decide that the response is a target of our | |
147 // cross-site document blocking policy, decided when the headers are deceived | |
148 // by OnReceivedResponse(). | |
149 bool cross_site_document_header_; | |
150 | |
151 // The following 3 member variables are only valid after OnReceivedResponse() | |
152 // is called (after RESPONSE_RECEIVED). This must be the same as request_url_ | |
153 // since request_url_ is updated whenever the request is redirected. | |
154 CanonicalMimeType canonical_mime_type_; | |
155 int http_status_code_; | |
156 bool no_sniff_; | |
157 | |
158 // This is initially false, but becomes true after we confirm that this is | |
159 // safe under our cross-site document policy by applying content sniffing to | |
160 // the first network packet from the response. | |
161 bool confirmed_safe_; | |
162 | |
163 // Find a frame identified by frame_id from the frame tree rooted at |frame|. | |
164 static WebKit::WebFrame* FindFrame(WebKit::WebFrame* frame, int frame_id); | |
165 | |
166 // Returns the representative mime type enum value of the mime type of | |
167 // response. For example, this returns the same value for all text/xml mime | |
168 // type families such as application/xml, application/rss+xml. | |
169 static CanonicalMimeType GetCanonicalMimeType( | |
170 const std::string& mime_type); | |
171 | |
172 // Returns whether this scheme is a target of cross-site document | |
173 // policy(XSDP). This returns true only for http://* and https://* urls. | |
174 static bool IsBlockableScheme(const GURL& frame_origin); | |
175 | |
176 // Returns whether the two urls belong to the same sites. | |
177 static bool IsSameSite(const GURL& frame_origin, const GURL& response_url); | |
178 | |
179 // Returns whether there's a valid CORS header for frame_origin. This is | |
180 // simliar to CrossOriginAccessControl::passesAccessControlCheck(), but we use | |
181 // sites as our security domain, not origins. TODO(dsjang): this must be | |
182 // improved to be more accurate to the actual CORS specification. For now, | |
183 // this works conservatively, allowing XSDs that are not allowed by actual | |
184 // CORS rules by ignoring 1) credentials and 2) methods. Preflight requests | |
185 // don't matter here since they are not used to decide whether to block a | |
186 // document or not on the client side. | |
187 static bool IsValidCorsHeaderSet(GURL& frame_origin, | |
188 GURL& website_origin, | |
189 std::string access_control_origin); | |
190 | |
191 static bool SniffForHTML(const char* data, size_t length); | |
192 static bool SniffForXML(const char* data, size_t length); | |
193 static bool SniffForJSON(const char* data, size_t length); | |
194 | |
195 static bool MatchesSignature(const char* data, | |
196 size_t length, | |
197 const char* signatures[], | |
198 size_t arr_size); | |
199 | |
200 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted | |
201 // when this class is used for actual blocking. | |
202 static bool SniffForJS(const char* data, size_t length); | |
203 | |
204 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted | |
205 // when this class is used for actual blocking. | |
206 static bool IsRenderableStatusCodeForDocument(int status_code); | |
207 | |
208 friend class base::RefCounted<SiteIsolationPolicy>; | |
209 virtual ~SiteIsolationPolicy() {} | |
210 | |
211 DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy); | |
212 }; | |
213 | |
214 } // namespace content | |
215 | |
216 #endif // CONTENT_SITE_ISOLATION_POLICY_H_ | |
OLD | NEW |