| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2013 Google Inc. All rights reserved. | 2 * Copyright (C) 2013 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
| 6 * met: | 6 * met: |
| 7 * | 7 * |
| 8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
| (...skipping 139 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 150 | 150 |
| 151 return disallowFetch; | 151 return disallowFetch; |
| 152 } | 152 } |
| 153 | 153 |
| 154 } // namespace | 154 } // namespace |
| 155 | 155 |
| 156 FrameFetchContext::FrameFetchContext(DocumentLoader* loader, Document* document) | 156 FrameFetchContext::FrameFetchContext(DocumentLoader* loader, Document* document) |
| 157 : m_document(document) | 157 : m_document(document) |
| 158 , m_documentLoader(loader) | 158 , m_documentLoader(loader) |
| 159 { | 159 { |
| 160 ASSERT(frame()); | 160 DCHECK(frame()); |
| 161 } | 161 } |
| 162 | 162 |
| 163 FrameFetchContext::~FrameFetchContext() | 163 FrameFetchContext::~FrameFetchContext() |
| 164 { | 164 { |
| 165 m_document = nullptr; | 165 m_document = nullptr; |
| 166 m_documentLoader = nullptr; | 166 m_documentLoader = nullptr; |
| 167 } | 167 } |
| 168 | 168 |
| 169 LocalFrame* FrameFetchContext::frame() const | 169 LocalFrame* FrameFetchContext::frame() const |
| 170 { | 170 { |
| 171 LocalFrame* frame = nullptr; | 171 LocalFrame* frame = nullptr; |
| 172 if (m_documentLoader) | 172 if (m_documentLoader) |
| 173 frame = m_documentLoader->frame(); | 173 frame = m_documentLoader->frame(); |
| 174 else if (m_document && m_document->importsController()) | 174 else if (m_document && m_document->importsController()) |
| 175 frame = m_document->importsController()->master()->frame(); | 175 frame = m_document->importsController()->master()->frame(); |
| 176 ASSERT(frame); | 176 DCHECK(frame); |
| 177 return frame; | 177 return frame; |
| 178 } | 178 } |
| 179 | 179 |
| 180 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) | 180 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) |
| 181 { | 181 { |
| 182 bool isMainResource = type == FetchMainResource; | 182 bool isMainResource = type == FetchMainResource; |
| 183 if (!isMainResource) { | 183 if (!isMainResource) { |
| 184 RefPtr<SecurityOrigin> outgoingOrigin; | 184 RefPtr<SecurityOrigin> outgoingOrigin; |
| 185 if (!request.didSetHTTPReferrer()) { | 185 if (!request.didSetHTTPReferrer()) { |
| 186 ASSERT(m_document); | 186 DCHECK(m_document); |
| 187 outgoingOrigin = m_document->getSecurityOrigin(); | 187 outgoingOrigin = m_document->getSecurityOrigin(); |
| 188 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>getReferrerPolicy(), request.url(), m_document->outgoingReferrer())); | 188 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>getReferrerPolicy(), request.url(), m_document->outgoingReferrer())); |
| 189 } else { | 189 } else { |
| 190 RELEASE_ASSERT(SecurityPolicy::generateReferrer(request.getReferrerP
olicy(), request.url(), request.httpReferrer()).referrer == request.httpReferrer
()); | 190 CHECK_EQ(SecurityPolicy::generateReferrer(request.getReferrerPolicy(
), request.url(), request.httpReferrer()).referrer, request.httpReferrer()); |
| 191 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); | 191 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); |
| 192 } | 192 } |
| 193 | 193 |
| 194 request.addHTTPOriginIfNeeded(outgoingOrigin.get()); | 194 request.addHTTPOriginIfNeeded(outgoingOrigin.get()); |
| 195 } | 195 } |
| 196 | 196 |
| 197 if (m_document) | 197 if (m_document) |
| 198 request.setExternalRequestStateFromRequestorAddressSpace(m_document->add
ressSpace()); | 198 request.setExternalRequestStateFromRequestorAddressSpace(m_document->add
ressSpace()); |
| 199 | 199 |
| 200 // The remaining modifications are only necessary for HTTP and HTTPS. | 200 // The remaining modifications are only necessary for HTTP and HTTPS. |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 246 return WebCachePolicy::ValidatingCacheData; | 246 return WebCachePolicy::ValidatingCacheData; |
| 247 if (policy == CachePolicyReload) | 247 if (policy == CachePolicyReload) |
| 248 return WebCachePolicy::BypassingCache; | 248 return WebCachePolicy::BypassingCache; |
| 249 if (policy == CachePolicyHistoryBuffer) | 249 if (policy == CachePolicyHistoryBuffer) |
| 250 return WebCachePolicy::ReturnCacheDataElseLoad; | 250 return WebCachePolicy::ReturnCacheDataElseLoad; |
| 251 return WebCachePolicy::UseProtocolCachePolicy; | 251 return WebCachePolicy::UseProtocolCachePolicy; |
| 252 } | 252 } |
| 253 | 253 |
| 254 WebCachePolicy FrameFetchContext::resourceRequestCachePolicy(const ResourceReque
st& request, Resource::Type type, FetchRequest::DeferOption defer) const | 254 WebCachePolicy FrameFetchContext::resourceRequestCachePolicy(const ResourceReque
st& request, Resource::Type type, FetchRequest::DeferOption defer) const |
| 255 { | 255 { |
| 256 ASSERT(frame()); | 256 DCHECK(frame()); |
| 257 if (type == Resource::MainResource) { | 257 if (type == Resource::MainResource) { |
| 258 FrameLoadType frameLoadType = frame()->loader().loadType(); | 258 FrameLoadType frameLoadType = frame()->loader().loadType(); |
| 259 if (request.httpMethod() == "POST" && frameLoadType == FrameLoadTypeBack
Forward) | 259 if (request.httpMethod() == "POST" && frameLoadType == FrameLoadTypeBack
Forward) |
| 260 return WebCachePolicy::ReturnCacheDataDontLoad; | 260 return WebCachePolicy::ReturnCacheDataDontLoad; |
| 261 if (frameLoadType == FrameLoadTypeReloadMainResource || request.isCondit
ional() || request.httpMethod() == "POST") | 261 if (frameLoadType == FrameLoadTypeReloadMainResource || request.isCondit
ional() || request.httpMethod() == "POST") |
| 262 return WebCachePolicy::ValidatingCacheData; | 262 return WebCachePolicy::ValidatingCacheData; |
| 263 | 263 |
| 264 for (Frame* f = frame(); f; f = f->tree().parent()) { | 264 for (Frame* f = frame(); f; f = f->tree().parent()) { |
| 265 if (!f->isLocalFrame()) | 265 if (!f->isLocalFrame()) |
| 266 continue; | 266 continue; |
| (...skipping 248 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 515 case Resource::Media: | 515 case Resource::Media: |
| 516 case Resource::Manifest: | 516 case Resource::Manifest: |
| 517 // By default these types of resources can be loaded from any origin. | 517 // By default these types of resources can be loaded from any origin. |
| 518 // FIXME: Are we sure about Resource::Font? | 518 // FIXME: Are we sure about Resource::Font? |
| 519 if (originRestriction == FetchRequest::RestrictToSameOrigin && !security
Origin->canRequest(url)) { | 519 if (originRestriction == FetchRequest::RestrictToSameOrigin && !security
Origin->canRequest(url)) { |
| 520 printAccessDeniedMessage(url); | 520 printAccessDeniedMessage(url); |
| 521 return ResourceRequestBlockedReasonOrigin; | 521 return ResourceRequestBlockedReasonOrigin; |
| 522 } | 522 } |
| 523 break; | 523 break; |
| 524 case Resource::XSLStyleSheet: | 524 case Resource::XSLStyleSheet: |
| 525 ASSERT(RuntimeEnabledFeatures::xsltEnabled()); | 525 DCHECK(RuntimeEnabledFeatures::xsltEnabled()); |
| 526 case Resource::SVGDocument: | 526 case Resource::SVGDocument: |
| 527 if (!securityOrigin->canRequest(url)) { | 527 if (!securityOrigin->canRequest(url)) { |
| 528 printAccessDeniedMessage(url); | 528 printAccessDeniedMessage(url); |
| 529 return ResourceRequestBlockedReasonOrigin; | 529 return ResourceRequestBlockedReasonOrigin; |
| 530 } | 530 } |
| 531 break; | 531 break; |
| 532 } | 532 } |
| 533 | 533 |
| 534 // FIXME: Convert this to check the isolated world's Content Security Policy
once webkit.org/b/104520 is solved. | 534 // FIXME: Convert this to check the isolated world's Content Security Policy
once webkit.org/b/104520 is solved. |
| 535 bool shouldBypassMainWorldCSP = frame()->script().shouldBypassMainWorldCSP()
|| options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy; | 535 bool shouldBypassMainWorldCSP = frame()->script().shouldBypassMainWorldCSP()
|| options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy; |
| 536 | 536 |
| 537 // Don't send CSP messages for preloads, we might never actually display tho
se items. | 537 // Don't send CSP messages for preloads, we might never actually display tho
se items. |
| 538 ContentSecurityPolicy::ReportingStatus cspReporting = forPreload ? | 538 ContentSecurityPolicy::ReportingStatus cspReporting = forPreload ? |
| 539 ContentSecurityPolicy::SuppressReport : ContentSecurityPolicy::SendRepor
t; | 539 ContentSecurityPolicy::SuppressReport : ContentSecurityPolicy::SendRepor
t; |
| 540 | 540 |
| 541 if (m_document) { | 541 if (m_document) { |
| 542 DCHECK(m_document->contentSecurityPolicy()); | 542 DCHECK(m_document->contentSecurityPolicy()); |
| 543 if (!shouldBypassMainWorldCSP && !m_document->contentSecurityPolicy()->a
llowRequest(resourceRequest.requestContext(), url, options.contentSecurityPolicy
Nonce, options.integrityMetadata, redirectStatus, cspReporting)) | 543 if (!shouldBypassMainWorldCSP && !m_document->contentSecurityPolicy()->a
llowRequest(resourceRequest.requestContext(), url, options.contentSecurityPolicy
Nonce, options.integrityMetadata, redirectStatus, cspReporting)) |
| 544 return ResourceRequestBlockedReasonCSP; | 544 return ResourceRequestBlockedReasonCSP; |
| 545 } | 545 } |
| 546 | 546 |
| 547 if (type == Resource::Script || type == Resource::ImportResource) { | 547 if (type == Resource::Script || type == Resource::ImportResource) { |
| 548 ASSERT(frame()); | 548 DCHECK(frame()); |
| 549 if (!frame()->loader().client()->allowScriptFromSource(!frame()->setting
s() || frame()->settings()->scriptEnabled(), url)) { | 549 if (!frame()->loader().client()->allowScriptFromSource(!frame()->setting
s() || frame()->settings()->scriptEnabled(), url)) { |
| 550 frame()->loader().client()->didNotAllowScript(); | 550 frame()->loader().client()->didNotAllowScript(); |
| 551 // TODO(estark): Use a different ResourceRequestBlockedReason | 551 // TODO(estark): Use a different ResourceRequestBlockedReason |
| 552 // here, since this check has nothing to do with | 552 // here, since this check has nothing to do with |
| 553 // CSP. https://crbug.com/600795 | 553 // CSP. https://crbug.com/600795 |
| 554 return ResourceRequestBlockedReasonCSP; | 554 return ResourceRequestBlockedReasonCSP; |
| 555 } | 555 } |
| 556 } else if (type == Resource::Media || type == Resource::TextTrack) { | 556 } else if (type == Resource::Media || type == Resource::TextTrack) { |
| 557 ASSERT(frame()); | 557 DCHECK(frame()); |
| 558 if (!frame()->loader().client()->allowMedia(url)) | 558 if (!frame()->loader().client()->allowMedia(url)) |
| 559 return ResourceRequestBlockedReasonOther; | 559 return ResourceRequestBlockedReasonOther; |
| 560 } | 560 } |
| 561 | 561 |
| 562 // SVG Images have unique security rules that prevent all subresource reques
ts | 562 // SVG Images have unique security rules that prevent all subresource reques
ts |
| 563 // except for data urls. | 563 // except for data urls. |
| 564 if (type != Resource::MainResource && frame()->chromeClient().isSVGImageChro
meClient() && !url.protocolIsData()) | 564 if (type != Resource::MainResource && frame()->chromeClient().isSVGImageChro
meClient() && !url.protocolIsData()) |
| 565 return ResourceRequestBlockedReasonOrigin; | 565 return ResourceRequestBlockedReasonOrigin; |
| 566 | 566 |
| 567 // Measure the number of legacy URL schemes ('ftp://') and the number of emb
edded-credential | 567 // Measure the number of legacy URL schemes ('ftp://') and the number of emb
edded-credential |
| 568 // ('http://user:password@...') resources embedded as subresources. in the h
opes that we can | 568 // ('http://user:password@...') resources embedded as subresources. in the h
opes that we can |
| 569 // block them at some point in the future. | 569 // block them at some point in the future. |
| 570 if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) { | 570 if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) { |
| 571 ASSERT(frame()->document()); | 571 DCHECK(frame()->document()); |
| 572 if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) && !Sch
emeRegistry::shouldTreatURLSchemeAsLegacy(frame()->document()->getSecurityOrigin
()->protocol())) | 572 if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) && !Sch
emeRegistry::shouldTreatURLSchemeAsLegacy(frame()->document()->getSecurityOrigin
()->protocol())) |
| 573 UseCounter::count(frame()->document(), UseCounter::LegacyProtocolEmb
eddedAsSubresource); | 573 UseCounter::count(frame()->document(), UseCounter::LegacyProtocolEmb
eddedAsSubresource); |
| 574 if (!url.user().isEmpty() || !url.pass().isEmpty()) | 574 if (!url.user().isEmpty() || !url.pass().isEmpty()) |
| 575 UseCounter::count(frame()->document(), UseCounter::RequestedSubresou
rceWithEmbeddedCredentials); | 575 UseCounter::count(frame()->document(), UseCounter::RequestedSubresou
rceWithEmbeddedCredentials); |
| 576 } | 576 } |
| 577 | 577 |
| 578 // Check for mixed content. We do this second-to-last so that when folks blo
ck | 578 // Check for mixed content. We do this second-to-last so that when folks blo
ck |
| 579 // mixed content with a CSP policy, they don't get a warning. They'll still | 579 // mixed content with a CSP policy, they don't get a warning. They'll still |
| 580 // get a warning in the console about CSP blocking the load. | 580 // get a warning in the console about CSP blocking the load. |
| 581 MixedContentChecker::ReportingStatus mixedContentReporting = forPreload ? | 581 MixedContentChecker::ReportingStatus mixedContentReporting = forPreload ? |
| 582 MixedContentChecker::SuppressReport : MixedContentChecker::SendReport; | 582 MixedContentChecker::SuppressReport : MixedContentChecker::SendReport; |
| 583 if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url, mix
edContentReporting)) | 583 if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url, mix
edContentReporting)) |
| 584 return ResourceRequestBlockedReasonMixedContent; | 584 return ResourceRequestBlockedReasonMixedContent; |
| 585 | 585 |
| 586 // Let the client have the final say into whether or not the load should pro
ceed. | 586 // Let the client have the final say into whether or not the load should pro
ceed. |
| 587 DocumentLoader* documentLoader = masterDocumentLoader(); | 587 DocumentLoader* documentLoader = masterDocumentLoader(); |
| 588 if (documentLoader && documentLoader->subresourceFilter() && type != Resourc
e::MainResource && type != Resource::ImportResource && !documentLoader->subresou
rceFilter()->allowLoad(url, resourceRequest.requestContext())) | 588 if (documentLoader && documentLoader->subresourceFilter() && type != Resourc
e::MainResource && type != Resource::ImportResource && !documentLoader->subresou
rceFilter()->allowLoad(url, resourceRequest.requestContext())) |
| 589 return ResourceRequestBlockedReasonSubresourceFilter; | 589 return ResourceRequestBlockedReasonSubresourceFilter; |
| 590 | 590 |
| 591 return ResourceRequestBlockedReasonNone; | 591 return ResourceRequestBlockedReasonNone; |
| 592 } | 592 } |
| 593 | 593 |
| 594 bool FrameFetchContext::isControlledByServiceWorker() const | 594 bool FrameFetchContext::isControlledByServiceWorker() const |
| 595 { | 595 { |
| 596 ASSERT(m_documentLoader || frame()->loader().documentLoader()); | 596 DCHECK(m_documentLoader || frame()->loader().documentLoader()); |
| 597 if (m_documentLoader) | 597 if (m_documentLoader) |
| 598 return frame()->loader().client()->isControlledByServiceWorker(*m_docume
ntLoader); | 598 return frame()->loader().client()->isControlledByServiceWorker(*m_docume
ntLoader); |
| 599 // m_documentLoader is null while loading resources from an HTML import. | 599 // m_documentLoader is null while loading resources from an HTML import. |
| 600 // In such cases whether the request is controlled by ServiceWorker or not | 600 // In such cases whether the request is controlled by ServiceWorker or not |
| 601 // is determined by the document loader of the frame. | 601 // is determined by the document loader of the frame. |
| 602 return frame()->loader().client()->isControlledByServiceWorker(*frame()->loa
der().documentLoader()); | 602 return frame()->loader().client()->isControlledByServiceWorker(*frame()->loa
der().documentLoader()); |
| 603 } | 603 } |
| 604 | 604 |
| 605 int64_t FrameFetchContext::serviceWorkerID() const | 605 int64_t FrameFetchContext::serviceWorkerID() const |
| 606 { | 606 { |
| 607 ASSERT(m_documentLoader || frame()->loader().documentLoader()); | 607 DCHECK(m_documentLoader || frame()->loader().documentLoader()); |
| 608 if (m_documentLoader) | 608 if (m_documentLoader) |
| 609 return frame()->loader().client()->serviceWorkerID(*m_documentLoader); | 609 return frame()->loader().client()->serviceWorkerID(*m_documentLoader); |
| 610 // m_documentLoader is null while loading resources from an HTML import. | 610 // m_documentLoader is null while loading resources from an HTML import. |
| 611 // In such cases a service worker ID could be retrieved from the document | 611 // In such cases a service worker ID could be retrieved from the document |
| 612 // loader of the frame. | 612 // loader of the frame. |
| 613 return frame()->loader().client()->serviceWorkerID(*frame()->loader().docume
ntLoader()); | 613 return frame()->loader().client()->serviceWorkerID(*frame()->loader().docume
ntLoader()); |
| 614 } | 614 } |
| 615 | 615 |
| 616 bool FrameFetchContext::isMainFrame() const | 616 bool FrameFetchContext::isMainFrame() const |
| 617 { | 617 { |
| (...skipping 105 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 723 // `isNull()` check. https://crbug.com/625969 | 723 // `isNull()` check. https://crbug.com/625969 |
| 724 if (request.frameType() == WebURLRequest::FrameTypeNone && request.requestor
Origin()->isUnique()) { | 724 if (request.frameType() == WebURLRequest::FrameTypeNone && request.requestor
Origin()->isUnique()) { |
| 725 request.setRequestorOrigin(m_document->isSandboxed(SandboxOrigin) | 725 request.setRequestorOrigin(m_document->isSandboxed(SandboxOrigin) |
| 726 ? SecurityOrigin::create(m_document->url()) | 726 ? SecurityOrigin::create(m_document->url()) |
| 727 : m_document->getSecurityOrigin()); | 727 : m_document->getSecurityOrigin()); |
| 728 } | 728 } |
| 729 } | 729 } |
| 730 | 730 |
| 731 MHTMLArchive* FrameFetchContext::archive() const | 731 MHTMLArchive* FrameFetchContext::archive() const |
| 732 { | 732 { |
| 733 ASSERT(!isMainFrame()); | 733 DCHECK(!isMainFrame()); |
| 734 // TODO(nasko): How should this work with OOPIF? | 734 // TODO(nasko): How should this work with OOPIF? |
| 735 // The MHTMLArchive is parsed as a whole, but can be constructed from | 735 // The MHTMLArchive is parsed as a whole, but can be constructed from |
| 736 // frames in mutliple processes. In that case, which process should parse | 736 // frames in mutliple processes. In that case, which process should parse |
| 737 // it and how should the output be spread back across multiple processes? | 737 // it and how should the output be spread back across multiple processes? |
| 738 if (!frame()->tree().parent()->isLocalFrame()) | 738 if (!frame()->tree().parent()->isLocalFrame()) |
| 739 return nullptr; | 739 return nullptr; |
| 740 return toLocalFrame(frame()->tree().parent())->loader().documentLoader()->fe
tcher()->archive(); | 740 return toLocalFrame(frame()->tree().parent())->loader().documentLoader()->fe
tcher()->archive(); |
| 741 } | 741 } |
| 742 | 742 |
| 743 void FrameFetchContext::countClientHintsDPR() | 743 void FrameFetchContext::countClientHintsDPR() |
| (...skipping 55 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 799 } | 799 } |
| 800 | 800 |
| 801 DEFINE_TRACE(FrameFetchContext) | 801 DEFINE_TRACE(FrameFetchContext) |
| 802 { | 802 { |
| 803 visitor->trace(m_document); | 803 visitor->trace(m_document); |
| 804 visitor->trace(m_documentLoader); | 804 visitor->trace(m_documentLoader); |
| 805 FetchContext::trace(visitor); | 805 FetchContext::trace(visitor); |
| 806 } | 806 } |
| 807 | 807 |
| 808 } // namespace blink | 808 } // namespace blink |
| OLD | NEW |