Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(287)

Side by Side Diff: content/child/site_isolation_policy.h

Issue 22254005: UMA data collector for cross-site documents(XSD) (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@lkgr
Patch Set: blocking code gets simpler and testcase is moved to /content Created 7 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
(Empty)
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. Use
2 // of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #ifndef CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
6 #define CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
7
8 #include <map>
9 #include <utility>
10
11 #include "base/gtest_prod_util.h"
12 #include "content/common/content_export.h"
13 #include "third_party/WebKit/public/platform/WebURLRequest.h"
14 #include "third_party/WebKit/public/platform/WebURLResponse.h"
15 #include "third_party/WebKit/public/web/WebFrame.h"
16 #include "webkit/common/resource_response_info.h"
17 #include "webkit/common/resource_type.h"
18
19 namespace content {
20
21 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP)
22 // for Site Isolation. XSDP will monitor network responses to a renderer and
23 // block illegal responses so that a compromised renderer cannot steal private
24 // information from other sites. For now SiteIsolationPolicy monitors responses
25 // to gather various UMA stats to see the compatibility impact of actual
26 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers
27 // are as follows:
28 //
29 // SiteIsolation.AllResponses : # of all network responses.
30 // SiteIsolation.XSD.DataLength : the length of the first packet of a response.
31 // SiteIsolation.XSD.MimeType (enum):
32 // # of responses from other sites, tagged with a document mime type.
33 // 0:HTML, 1:XML, 2:JSON, 3:Plain, 4:Others
34 // SiteIsolation.XSD.[%MIMETYPE].Blocked :
35 // blocked # of cross-site document responses grouped by sniffed MIME type.
36 // SiteIsolation.XSD.[%MIMETYPE].Blocked.RenderableStatusCode :
37 // # of responses with renderable status code,
38 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
39 // SiteIsolation.XSD.[%MIMETYPE].Blocked.NonRenderableStatusCode :
40 // # of responses with non-renderable status code,
41 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
42 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.RenderableStatusCode :
43 // # of responses failed to be sniffed for its MIME type, but blocked by
44 // "X-Content-Type-Options: nosniff" header, and with renderable status code
45 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
46 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode :
47 // # of responses failed to be sniffed for its MIME type, but blocked by
48 // "X-Content-Type-Options: nosniff" header, and with non-renderable status
49 // code out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
50 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked :
51 // # of responses, but not blocked due to failure of mime sniffing.
52 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS :
53 // # of responses that are plausibly sniffed to be JavaScript.
54
55 class CONTENT_EXPORT SiteIsolationPolicy {
56 public:
57
58 // Registers the header information of |response|. This function obtains the
59 // target_type set by |WillSendRequest|. We have to make sure to call either
60 // SiteIsolationPolicy::DidFinishResourceLoad(identifier)| or
61 // SiteIsolationPolicy::DidFinishResourceLoadForURL(response.url()) to free
62 // the bookkepping data.
63 // TODO(dsjang): There's a possibility that two distinct responses (identified
Charlie Reis 2013/08/22 18:23:30 Is this still possible? It looks like we always u
dsjang 2013/08/22 19:05:55 Done.
64 // by different identifiers) are from the same url, and this results in
65 // overwriting one of the two responses' bookkeeping data. For example, when
66 // there are <iframe src="urlA" /> and <img src="urlA"> on the same page,
67 // there will be two calls of |DidReceiveResponse| with the same url, but
68 // different identifiers. This can deteriorate our UMA data. Even though we
69 // expect that this rarely happens, find a way to use identifier throughout
70 // the entire HTTP transaction here.
71 static void OnReceivedResponse(int request_id,
72 GURL& frame_origin,
73 GURL& response_url,
74 ResourceType::Type resource_type,
75 const webkit_glue::ResourceResponseInfo& info);
76
77 // Examines the first network packet in case response_url is
78 // registered as a cross-site document by DidReceiveResponse().
79 // This records various kinds of UMA data stats. This function is
80 // called only if the length of received data is non-zero.
81 static bool OnReceivedData(int request_id, const char* payload, int length);
82
83 // Clean up booking data registered by OnReceiveResponse and OnReceivedData.
84 static void OnRequestComplete(int request_id);
85
86 struct ResponseMetaData {
87
88 enum CanonicalMimeType {
89 HTML = 0,
90 XML = 1,
91 JSON = 2,
92 Plain = 3,
93 Others = 4,
94 MaxCanonicalMimeType,
95 };
96
97 ResponseMetaData();
98
99 std::string frame_origin;
100 GURL response_url;
101 ResourceType::Type resource_type;
102 CanonicalMimeType canonical_mime_type;
103 int http_status_code;
104 bool no_sniff;
105 };
106
107 typedef std::map<int, ResponseMetaData> RequestIdToMetaDataMap;
108 typedef std::map<int, bool> RequestIdToResultMap;
109
110 private:
111 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme);
112 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite);
113 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet);
114 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML);
115 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML);
116 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON);
117 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS);
118
119 // Returns the representative mime type enum value of the mime type of
120 // response. For example, this returns the same value for all text/xml mime
121 // type families such as application/xml, application/rss+xml.
122 static ResponseMetaData::CanonicalMimeType GetCanonicalMimeType(
123 const std::string& mime_type);
124
125 // Returns whether this scheme is a target of cross-site document
126 // policy(XSDP). This returns true only for http://* and https://* urls.
127 static bool IsBlockableScheme(const GURL& frame_origin);
128
129 // Returns whether the two urls belong to the same sites.
130 static bool IsSameSite(const GURL& frame_origin, const GURL& response_url);
131
132 // Returns whether there's a valid CORS header for frame_origin. This is
133 // simliar to CrossOriginAccessControl::passesAccessControlCheck(), but we use
134 // sites as our security domain, not origins.
135 // TODO(dsjang): this must be improved to be more accurate to the actual CORS
136 // specification. For now, this works conservatively, allowing XSDs that are
137 // not allowed by actual CORS rules by ignoring 1) credentials and 2)
138 // methods. Preflight requests don't matter here since they are not used to
139 // decide whether to block a document or not on the client side.
140 static bool IsValidCorsHeaderSet(GURL& frame_origin,
141 GURL& website_origin,
142 std::string access_control_origin);
143
144 // Returns whether the given frame is navigating. When this is true, the frame
145 // is requesting is a web page to be loaded.
146 static bool IsFrameNavigating(WebKit::WebFrame* frame);
147
148 static bool SniffForHTML(const char* data, size_t length);
149 static bool SniffForXML(const char* data, size_t length);
150 static bool SniffForJSON(const char* data, size_t length);
151
152 static bool MatchesSignature(const char* data,
153 size_t length,
154 const char* signatures[],
155 size_t arr_size);
156
157 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted
158 // when this class is used for actual blocking.
159 static bool SniffForJS(const char* data, size_t length);
160
161 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted
162 // when this class is used for actual blocking.
163 static bool IsRenderableStatusCodeForDocument(int status_code);
164
165 // Maintain the bookkeeping data between OnReceivedResponse and
166 // OnReceivedData. The key is a request id maintained by ResourceDispatcher.
167 static RequestIdToMetaDataMap* GetRequestIdToMetaDataMap();
168
169 // Maintain the bookkeeping data for OnReceivedData. Blocking decision is made
170 // when OnReceivedData is called for the first time for a request, and the
171 // decision will remain the same for following data. This map maintains the
172 // decision. The key is a request id maintained by ResourceDispatcher.
173 static RequestIdToResultMap* GetRequestIdToResultMap();
174
175 // Never needs to be constructed/destructed.
176 SiteIsolationPolicy() {}
177 ~SiteIsolationPolicy() {}
178
179 DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy);
180 };
181
182 } // namespace content
183
184 #endif // CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698