OLD | NEW |
(Empty) | |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. Use |
| 2 // of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 #ifndef CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ |
| 6 #define CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ |
| 7 |
| 8 #include <map> |
| 9 #include <utility> |
| 10 |
| 11 #include "base/gtest_prod_util.h" |
| 12 #include "content/common/content_export.h" |
| 13 #include "third_party/WebKit/public/platform/WebURLRequest.h" |
| 14 #include "third_party/WebKit/public/platform/WebURLResponse.h" |
| 15 #include "third_party/WebKit/public/web/WebFrame.h" |
| 16 #include "webkit/common/resource_response_info.h" |
| 17 #include "webkit/common/resource_type.h" |
| 18 |
| 19 namespace content { |
| 20 |
| 21 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP) |
| 22 // for Site Isolation. XSDP will monitor network responses to a renderer and |
| 23 // block illegal responses so that a compromised renderer cannot steal private |
| 24 // information from other sites. For now SiteIsolationPolicy monitors responses |
| 25 // to gather various UMA stats to see the compatibility impact of actual |
| 26 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers |
| 27 // are as follows: |
| 28 // |
| 29 // SiteIsolation.AllResponses : # of all network responses. |
| 30 // SiteIsolation.XSD.DataLength : the length of the first packet of a response. |
| 31 // SiteIsolation.XSD.MimeType (enum): |
| 32 // # of responses from other sites, tagged with a document mime type. |
| 33 // 0:HTML, 1:XML, 2:JSON, 3:Plain, 4:Others |
| 34 // SiteIsolation.XSD.[%MIMETYPE].Blocked : |
| 35 // blocked # of cross-site document responses grouped by sniffed MIME type. |
| 36 // SiteIsolation.XSD.[%MIMETYPE].Blocked.RenderableStatusCode : |
| 37 // # of responses with renderable status code, |
| 38 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. |
| 39 // SiteIsolation.XSD.[%MIMETYPE].Blocked.NonRenderableStatusCode : |
| 40 // # of responses with non-renderable status code, |
| 41 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. |
| 42 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.RenderableStatusCode : |
| 43 // # of responses failed to be sniffed for its MIME type, but blocked by |
| 44 // "X-Content-Type-Options: nosniff" header, and with renderable status code |
| 45 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. |
| 46 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode : |
| 47 // # of responses failed to be sniffed for its MIME type, but blocked by |
| 48 // "X-Content-Type-Options: nosniff" header, and with non-renderable status |
| 49 // code out of SiteIsolation.XSD.[%MIMETYPE].Blocked. |
| 50 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked : |
| 51 // # of responses, but not blocked due to failure of mime sniffing. |
| 52 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS : |
| 53 // # of responses that are plausibly sniffed to be JavaScript. |
| 54 |
| 55 class CONTENT_EXPORT SiteIsolationPolicy { |
| 56 public: |
| 57 |
| 58 // Records the bookkeeping data about the HTTP header information for the |
| 59 // request identified by |request_id|. The bookkeeping data is used by |
| 60 // ShouldBlockResponse. We have to make sure to call OnRequestComplete to free |
| 61 // the bookkeeping data. |
| 62 static void OnReceivedResponse(int request_id, |
| 63 GURL& frame_origin, |
| 64 GURL& response_url, |
| 65 ResourceType::Type resource_type, |
| 66 const webkit_glue::ResourceResponseInfo& info); |
| 67 |
| 68 // Examines the first network packet in case response_url is |
| 69 // registered as a cross-site document by DidReceiveResponse(). |
| 70 // This records various kinds of UMA data stats. This function is |
| 71 // called only if the length of received data is non-zero. |
| 72 static bool ShouldBlockResponse(int request_id, |
| 73 const char* payload, |
| 74 int length); |
| 75 |
| 76 // Clean up booking data registered by OnReceiveResponse and OnReceivedData. |
| 77 static void OnRequestComplete(int request_id); |
| 78 |
| 79 struct ResponseMetaData { |
| 80 |
| 81 enum CanonicalMimeType { |
| 82 HTML = 0, |
| 83 XML = 1, |
| 84 JSON = 2, |
| 85 Plain = 3, |
| 86 Others = 4, |
| 87 MaxCanonicalMimeType, |
| 88 }; |
| 89 |
| 90 ResponseMetaData(); |
| 91 |
| 92 std::string frame_origin; |
| 93 GURL response_url; |
| 94 ResourceType::Type resource_type; |
| 95 CanonicalMimeType canonical_mime_type; |
| 96 int http_status_code; |
| 97 bool no_sniff; |
| 98 }; |
| 99 |
| 100 typedef std::map<int, ResponseMetaData> RequestIdToMetaDataMap; |
| 101 typedef std::map<int, bool> RequestIdToResultMap; |
| 102 |
| 103 private: |
| 104 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme); |
| 105 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite); |
| 106 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet); |
| 107 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML); |
| 108 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML); |
| 109 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON); |
| 110 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS); |
| 111 |
| 112 // Returns the representative mime type enum value of the mime type of |
| 113 // response. For example, this returns the same value for all text/xml mime |
| 114 // type families such as application/xml, application/rss+xml. |
| 115 static ResponseMetaData::CanonicalMimeType GetCanonicalMimeType( |
| 116 const std::string& mime_type); |
| 117 |
| 118 // Returns whether this scheme is a target of cross-site document |
| 119 // policy(XSDP). This returns true only for http://* and https://* urls. |
| 120 static bool IsBlockableScheme(const GURL& frame_origin); |
| 121 |
| 122 // Returns whether the two urls belong to the same sites. |
| 123 static bool IsSameSite(const GURL& frame_origin, const GURL& response_url); |
| 124 |
| 125 // Returns whether there's a valid CORS header for frame_origin. This is |
| 126 // simliar to CrossOriginAccessControl::passesAccessControlCheck(), but we use |
| 127 // sites as our security domain, not origins. |
| 128 // TODO(dsjang): this must be improved to be more accurate to the actual CORS |
| 129 // specification. For now, this works conservatively, allowing XSDs that are |
| 130 // not allowed by actual CORS rules by ignoring 1) credentials and 2) |
| 131 // methods. Preflight requests don't matter here since they are not used to |
| 132 // decide whether to block a document or not on the client side. |
| 133 static bool IsValidCorsHeaderSet(GURL& frame_origin, |
| 134 GURL& website_origin, |
| 135 std::string access_control_origin); |
| 136 |
| 137 // Returns whether the given frame is navigating. When this is true, the frame |
| 138 // is requesting is a web page to be loaded. |
| 139 static bool IsFrameNavigating(WebKit::WebFrame* frame); |
| 140 |
| 141 static bool SniffForHTML(const char* data, size_t length); |
| 142 static bool SniffForXML(const char* data, size_t length); |
| 143 static bool SniffForJSON(const char* data, size_t length); |
| 144 |
| 145 static bool MatchesSignature(const char* data, |
| 146 size_t length, |
| 147 const char* signatures[], |
| 148 size_t arr_size); |
| 149 |
| 150 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted |
| 151 // when this class is used for actual blocking. |
| 152 static bool SniffForJS(const char* data, size_t length); |
| 153 |
| 154 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted |
| 155 // when this class is used for actual blocking. |
| 156 static bool IsRenderableStatusCodeForDocument(int status_code); |
| 157 |
| 158 // Maintain the bookkeeping data between OnReceivedResponse and |
| 159 // OnReceivedData. The key is a request id maintained by ResourceDispatcher. |
| 160 static RequestIdToMetaDataMap* GetRequestIdToMetaDataMap(); |
| 161 |
| 162 // Maintain the bookkeeping data for OnReceivedData. Blocking decision is made |
| 163 // when OnReceivedData is called for the first time for a request, and the |
| 164 // decision will remain the same for following data. This map maintains the |
| 165 // decision. The key is a request id maintained by ResourceDispatcher. |
| 166 static RequestIdToResultMap* GetRequestIdToResultMap(); |
| 167 |
| 168 // Never needs to be constructed/destructed. |
| 169 SiteIsolationPolicy() {} |
| 170 ~SiteIsolationPolicy() {} |
| 171 |
| 172 DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy); |
| 173 }; |
| 174 |
| 175 } // namespace content |
| 176 |
| 177 #endif // CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ |
OLD | NEW |