OLD | NEW |
---|---|
(Empty) | |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. Use | |
2 // of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef WEBKIT_CHILD_SITE_ISOLATION_POLICY_H_ | |
6 #define WEBKIT_CHILD_SITE_ISOLATION_POLICY_H_ | |
7 | |
8 #include <map> | |
9 #include <utility> | |
10 | |
11 #include "base/gtest_prod_util.h" | |
12 #include "third_party/WebKit/public/platform/WebURLRequest.h" | |
13 #include "third_party/WebKit/public/platform/WebURLResponse.h" | |
14 #include "third_party/WebKit/public/web/WebFrame.h" | |
15 #include "webkit/child/webkit_child_export.h" | |
16 | |
17 using WebKit::WebFrame; | |
darin (slow to review)
2013/08/14 05:23:27
nit: using declarations are not allowed in header
dsjang
2013/08/14 20:47:03
Done.
| |
18 using WebKit::WebURLResponse; | |
19 using WebKit::WebURLRequest; | |
20 | |
21 namespace webkit_glue { | |
22 | |
23 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP) | |
24 // for Site Isolation. XSDP will monitor network responses to a renderer and | |
25 // block illegal responses so that a compromised renderer cannot steal private | |
26 // information from other sites. For now SiteIsolationPolicy monitors responses | |
27 // to gather various UMA stats to see the compatibility impact of actual | |
28 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers | |
29 // are as follows: | |
30 // | |
31 // SiteIsolation.AllResponses : # of all network responses. | |
32 // SiteIsolation.XSD.DataLength : the length of the first packet of a response. | |
33 // SiteIsolation.XSD.MimeType (enum): | |
34 // # of responses from other sites, tagged with a document mime type. | |
35 // 0:HTML, 1:XML, 2:JSON, 3:Plain, 4:Others | |
36 // SiteIsolation.XSD.[%MIMETYPE].Blocked : | |
37 // blocked # of cross-site document responses grouped by sniffed MIME type. | |
38 // SiteIsolation.XSD.[%MIMETYPE].Blocked.RenderableStatusCode : | |
39 // # of responses with renderable status code, | |
40 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. | |
41 // SiteIsolation.XSD.[%MIMETYPE].Blocked.NonRenderableStatusCode : | |
42 // # of responses with non-renderable status code, | |
43 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. | |
44 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.RenderableStatusCode : | |
45 // # of responses failed to be sniffed for its MIME type, but blocked by | |
46 // "X-Content-Type-Options: nosniff" header, and with renderable status code | |
47 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. | |
48 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode : | |
49 // # of responses failed to be sniffed for its MIME type, but blocked by | |
50 // "X-Content-Type-Options: nosniff" header, and with non-renderable status | |
51 // code out of SiteIsolation.XSD.[%MIMETYPE].Blocked. | |
52 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked : | |
53 // # of responses, but not blocked due to failure of mime sniffing. | |
54 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS : | |
55 // # of responses that are plausibly sniffed to be JavaScript. | |
56 | |
57 struct ResponseMetaData { | |
darin (slow to review)
2013/08/14 05:23:27
nit: Perhaps this should be inside an internal nam
dsjang
2013/08/14 20:47:03
Done.
| |
58 | |
59 enum CanonicalMimeType { | |
60 HTML = 0, | |
61 XML = 1, | |
62 JSON = 2, | |
63 Plain = 3, | |
64 Others = 4, | |
65 MaxCanonicalMimeType, | |
66 }; | |
67 | |
68 static const char* CanonicalMimeTypeToString(CanonicalMimeType mime_type) { | |
69 const char* mime_type_names[] = {"HTML", "XML", "JSON", "Plain", "Others"}; | |
70 return mime_type_names[mime_type]; | |
71 }; | |
72 | |
73 static const char* TargetTypeToString(WebURLRequest::TargetType target_type) { | |
74 const char* target_type_names[] = { | |
75 "MainFrame", "Subframe", "Subresource", "StyleSheet", "Script", | |
76 "FontResource", "Image", "Object", "Media", "Worker", "SharedWorker", | |
77 "Prefetch", "Favicon", "XHR", "TextTrack", "Unspecified"}; | |
78 return target_type_names[target_type]; | |
79 }; | |
80 | |
81 ResponseMetaData(); | |
82 | |
83 std::string frame_origin; | |
84 GURL response_url; | |
85 unsigned request_identifier; | |
86 WebURLRequest::TargetType target_type; | |
87 CanonicalMimeType canonical_mime_type; | |
88 int http_status_code; | |
89 bool no_sniff; | |
90 }; | |
91 | |
92 typedef std::map<unsigned, WebURLRequest::TargetType> TargetTypeMap; | |
93 typedef std::map<GURL, ResponseMetaData> UrlResponseMetaDataMap; | |
94 typedef std::map<unsigned, GURL> IdUrlMap; | |
95 | |
96 class WEBKIT_CHILD_EXPORT SiteIsolationPolicy { | |
97 public: | |
98 // Registers |target_type| for |identifier| which identifies a specific | |
99 // request. In case HTTP redirection happens, this function is called multiple | |
100 // times for the same identifier. We do not depend on |target_type| to decide | |
101 // if a request is for navigation or not due to the redirection behavior. | |
102 static void WillSendRequest(unsigned identifier, | |
103 WebURLRequest::TargetType target_type); | |
104 | |
105 // Registers the header information of |response|. This function obtains the | |
106 // target_type set by |WillSendRequest|. We have to make sure to call either | |
107 // SiteIsolationPolicy::DidFinishResourceLoad(identifier)| or | |
108 // SiteIsolationPolicy::DidFinishResourceLoadForURL(response.url()) to free | |
109 // the bookkepping data. | |
110 // TODO(dsjang): There's a possibility that two distinct responses (identified | |
111 // by different identifiers) are from the same url, and this results in | |
112 // overwriting one of the two responses' bookkeeping data. For example, when | |
113 // there are <iframe src="urlA" /> and <img src="urlA"> on the same page, | |
114 // there will be two calls of |DidReceiveResponse| with the same url, but | |
115 // different identifiers. This can deteriorate our UMA data. Even though we | |
116 // expect that this rarely happens, find a way to use identifier throughout | |
117 // the entire HTTP transaction here. | |
118 static void DidReceiveResponse(WebFrame* frame, | |
119 unsigned identifier, | |
120 const WebURLResponse& response); | |
121 | |
122 // Examines the first network packet in case response_url is | |
123 // registered as a cross-site document by DidReceiveResponse(). | |
124 // This records various kinds of UMA data stats. This function is | |
125 // called only if the length of received data is non-zero. | |
126 static void DidReceiveData(const char* payload, | |
127 int length, | |
128 WebKit::WebURL& response_url); | |
129 | |
130 // TODO(dsjang): Either of the following two functions must be called at the | |
131 // end of the transaction. WebURLLoaderImpl::didReceivedData() is not a place | |
132 // where this can be called since it is not guaranteed that the function is | |
133 // called in case of network error. Instead, | |
134 // RenderFrameImpl::didFinishResourceLoad(identifier) and didFailLoad() are | |
135 // used for successful loading and failed loading, respectively. | |
136 static void DidFinishResourceLoad(unsigned identifier); | |
137 | |
138 // Does the same thing as DidFinishResourceLoad(), but accepts response_url. | |
139 static void DidFinishResourceLoadForUrl(const WebKit::WebURL& response_url); | |
140 | |
141 private: | |
142 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme); | |
143 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite); | |
144 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet); | |
145 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML); | |
146 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML); | |
147 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON); | |
148 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS); | |
149 | |
150 // Returns the representative mime type enum value of the mime type of | |
151 // response. For example, this returns the same value for all text/xml mime | |
152 // type families such as application/xml, application/rss+xml. | |
153 static ResponseMetaData::CanonicalMimeType GetCanonicalMimeType( | |
154 const WebURLResponse& response); | |
155 | |
156 // Returns whether this scheme is a target of cross-site document | |
157 // policy(XSDP). This returns true only for http://* and https://* urls. | |
158 static bool IsBlockableScheme(const GURL& frame_origin); | |
159 | |
160 // Returns whether the two urls belong to the same sites. | |
161 static bool IsSameSite(const GURL& frame_origin, const GURL& response_url); | |
162 | |
163 // Returns whether there's a valid CORS header for frame_origin. This is | |
164 // simliar to CrossOriginAccessControl::passesAccessControlCheck(), but we use | |
165 // sites as our security domain, not origins. | |
166 // TODO(dsjang): this must be improved to be more accurate to the actual CORS | |
167 // specification. For now, this works conservatively, allowing XSDs that are | |
168 // not allowed by actual CORS rules by ignoring 1) credentials and 2) | |
169 // methods. Preflight requests don't matter here since they are not used to | |
170 // decide whether to block a document or not on the client side. | |
171 static bool IsValidCorsHeaderSet(GURL& frame_origin, | |
172 GURL& website_origin, | |
173 std::string access_control_origin); | |
174 | |
175 // Returns whether the given frame is navigating. When this is true, the frame | |
176 // is requesting is a web page to be loaded. | |
177 static bool IsFrameNavigating(WebFrame* frame); | |
178 | |
179 static bool SniffForHTML(const char* data, size_t length); | |
180 static bool SniffForXML(const char* data, size_t length); | |
181 static bool SniffForJSON(const char* data, size_t length); | |
182 | |
183 static bool MatchesSignature(const char* data, | |
184 size_t length, | |
185 const char* signatures[], | |
186 size_t arr_size); | |
187 | |
188 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted | |
189 // when this class is used for actual blocking. | |
190 static bool SniffForJS(const char* data, size_t length); | |
191 | |
192 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted | |
193 // when this class is used for actual blocking. | |
194 static bool IsRenderableStatusCodeForDocument(int status_code); | |
195 | |
196 // Maintain bookkeeping data between WillSendRequest() and | |
197 // DidReceiveResponse(). The key is the identifier of response. | |
198 static TargetTypeMap* GetIdTargetMap(); | |
199 | |
200 // Maintain data between DidReceiveResponse() and DidReceiveData(). The key | |
201 // is the url of response. We can't use identifier anymore from here since | |
202 // that information is no longer available for DidReceiveData(). | |
203 static UrlResponseMetaDataMap* GetUrlResponseMetaDataMap(); | |
204 | |
205 // This maps the identifier of a response to the response's url. This is used | |
206 // to free ResponseMetaData in url_responsedata_map_, when DidReceiveData() is | |
207 // never called. | |
208 static IdUrlMap* GetIdUrlMap(); | |
209 | |
210 // Never needs to be constructed/destructed. | |
211 SiteIsolationPolicy() {} | |
212 ~SiteIsolationPolicy() {} | |
213 | |
214 DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy); | |
215 }; | |
216 | |
217 } // namespace content | |
218 | |
219 #endif // WEBKIT_CHILD_SITE_ISOLATION_POLICY_H_ | |
OLD | NEW |