OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2013 Google Inc. All rights reserved. | 2 * Copyright (C) 2013 Google Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
6 * met: | 6 * met: |
7 * | 7 * |
8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
(...skipping 139 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
150 | 150 |
151 return disallowFetch; | 151 return disallowFetch; |
152 } | 152 } |
153 | 153 |
154 } // namespace | 154 } // namespace |
155 | 155 |
156 FrameFetchContext::FrameFetchContext(DocumentLoader* loader, Document* document) | 156 FrameFetchContext::FrameFetchContext(DocumentLoader* loader, Document* document) |
157 : m_document(document) | 157 : m_document(document) |
158 , m_documentLoader(loader) | 158 , m_documentLoader(loader) |
159 { | 159 { |
160 ASSERT(frame()); | 160 DCHECK(frame()); |
161 } | 161 } |
162 | 162 |
163 FrameFetchContext::~FrameFetchContext() | 163 FrameFetchContext::~FrameFetchContext() |
164 { | 164 { |
165 m_document = nullptr; | 165 m_document = nullptr; |
166 m_documentLoader = nullptr; | 166 m_documentLoader = nullptr; |
167 } | 167 } |
168 | 168 |
169 LocalFrame* FrameFetchContext::frame() const | 169 LocalFrame* FrameFetchContext::frame() const |
170 { | 170 { |
171 LocalFrame* frame = nullptr; | 171 LocalFrame* frame = nullptr; |
172 if (m_documentLoader) | 172 if (m_documentLoader) |
173 frame = m_documentLoader->frame(); | 173 frame = m_documentLoader->frame(); |
174 else if (m_document && m_document->importsController()) | 174 else if (m_document && m_document->importsController()) |
175 frame = m_document->importsController()->master()->frame(); | 175 frame = m_document->importsController()->master()->frame(); |
176 ASSERT(frame); | 176 DCHECK(frame); |
177 return frame; | 177 return frame; |
178 } | 178 } |
179 | 179 |
180 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) | 180 void FrameFetchContext::addAdditionalRequestHeaders(ResourceRequest& request, Fe
tchResourceType type) |
181 { | 181 { |
182 bool isMainResource = type == FetchMainResource; | 182 bool isMainResource = type == FetchMainResource; |
183 if (!isMainResource) { | 183 if (!isMainResource) { |
184 RefPtr<SecurityOrigin> outgoingOrigin; | 184 RefPtr<SecurityOrigin> outgoingOrigin; |
185 if (!request.didSetHTTPReferrer()) { | 185 if (!request.didSetHTTPReferrer()) { |
186 ASSERT(m_document); | 186 DCHECK(m_document); |
187 outgoingOrigin = m_document->getSecurityOrigin(); | 187 outgoingOrigin = m_document->getSecurityOrigin(); |
188 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>getReferrerPolicy(), request.url(), m_document->outgoingReferrer())); | 188 request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document-
>getReferrerPolicy(), request.url(), m_document->outgoingReferrer())); |
189 } else { | 189 } else { |
190 RELEASE_ASSERT(SecurityPolicy::generateReferrer(request.getReferrerP
olicy(), request.url(), request.httpReferrer()).referrer == request.httpReferrer
()); | 190 CHECK_EQ(SecurityPolicy::generateReferrer(request.getReferrerPolicy(
), request.url(), request.httpReferrer()).referrer, request.httpReferrer()); |
191 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); | 191 outgoingOrigin = SecurityOrigin::createFromString(request.httpReferr
er()); |
192 } | 192 } |
193 | 193 |
194 request.addHTTPOriginIfNeeded(outgoingOrigin.get()); | 194 request.addHTTPOriginIfNeeded(outgoingOrigin.get()); |
195 } | 195 } |
196 | 196 |
197 if (m_document) | 197 if (m_document) |
198 request.setExternalRequestStateFromRequestorAddressSpace(m_document->add
ressSpace()); | 198 request.setExternalRequestStateFromRequestorAddressSpace(m_document->add
ressSpace()); |
199 | 199 |
200 // The remaining modifications are only necessary for HTTP and HTTPS. | 200 // The remaining modifications are only necessary for HTTP and HTTPS. |
(...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
246 return WebCachePolicy::ValidatingCacheData; | 246 return WebCachePolicy::ValidatingCacheData; |
247 if (policy == CachePolicyReload) | 247 if (policy == CachePolicyReload) |
248 return WebCachePolicy::BypassingCache; | 248 return WebCachePolicy::BypassingCache; |
249 if (policy == CachePolicyHistoryBuffer) | 249 if (policy == CachePolicyHistoryBuffer) |
250 return WebCachePolicy::ReturnCacheDataElseLoad; | 250 return WebCachePolicy::ReturnCacheDataElseLoad; |
251 return WebCachePolicy::UseProtocolCachePolicy; | 251 return WebCachePolicy::UseProtocolCachePolicy; |
252 } | 252 } |
253 | 253 |
254 WebCachePolicy FrameFetchContext::resourceRequestCachePolicy(const ResourceReque
st& request, Resource::Type type, FetchRequest::DeferOption defer) const | 254 WebCachePolicy FrameFetchContext::resourceRequestCachePolicy(const ResourceReque
st& request, Resource::Type type, FetchRequest::DeferOption defer) const |
255 { | 255 { |
256 ASSERT(frame()); | 256 DCHECK(frame()); |
257 if (type == Resource::MainResource) { | 257 if (type == Resource::MainResource) { |
258 FrameLoadType frameLoadType = frame()->loader().loadType(); | 258 FrameLoadType frameLoadType = frame()->loader().loadType(); |
259 if (request.httpMethod() == "POST" && frameLoadType == FrameLoadTypeBack
Forward) | 259 if (request.httpMethod() == "POST" && frameLoadType == FrameLoadTypeBack
Forward) |
260 return WebCachePolicy::ReturnCacheDataDontLoad; | 260 return WebCachePolicy::ReturnCacheDataDontLoad; |
261 if (frameLoadType == FrameLoadTypeReloadMainResource || request.isCondit
ional() || request.httpMethod() == "POST") | 261 if (frameLoadType == FrameLoadTypeReloadMainResource || request.isCondit
ional() || request.httpMethod() == "POST") |
262 return WebCachePolicy::ValidatingCacheData; | 262 return WebCachePolicy::ValidatingCacheData; |
263 | 263 |
264 for (Frame* f = frame(); f; f = f->tree().parent()) { | 264 for (Frame* f = frame(); f; f = f->tree().parent()) { |
265 if (!f->isLocalFrame()) | 265 if (!f->isLocalFrame()) |
266 continue; | 266 continue; |
(...skipping 248 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
515 case Resource::Media: | 515 case Resource::Media: |
516 case Resource::Manifest: | 516 case Resource::Manifest: |
517 // By default these types of resources can be loaded from any origin. | 517 // By default these types of resources can be loaded from any origin. |
518 // FIXME: Are we sure about Resource::Font? | 518 // FIXME: Are we sure about Resource::Font? |
519 if (originRestriction == FetchRequest::RestrictToSameOrigin && !security
Origin->canRequest(url)) { | 519 if (originRestriction == FetchRequest::RestrictToSameOrigin && !security
Origin->canRequest(url)) { |
520 printAccessDeniedMessage(url); | 520 printAccessDeniedMessage(url); |
521 return ResourceRequestBlockedReasonOrigin; | 521 return ResourceRequestBlockedReasonOrigin; |
522 } | 522 } |
523 break; | 523 break; |
524 case Resource::XSLStyleSheet: | 524 case Resource::XSLStyleSheet: |
525 ASSERT(RuntimeEnabledFeatures::xsltEnabled()); | 525 DCHECK(RuntimeEnabledFeatures::xsltEnabled()); |
526 case Resource::SVGDocument: | 526 case Resource::SVGDocument: |
527 if (!securityOrigin->canRequest(url)) { | 527 if (!securityOrigin->canRequest(url)) { |
528 printAccessDeniedMessage(url); | 528 printAccessDeniedMessage(url); |
529 return ResourceRequestBlockedReasonOrigin; | 529 return ResourceRequestBlockedReasonOrigin; |
530 } | 530 } |
531 break; | 531 break; |
532 } | 532 } |
533 | 533 |
534 // FIXME: Convert this to check the isolated world's Content Security Policy
once webkit.org/b/104520 is solved. | 534 // FIXME: Convert this to check the isolated world's Content Security Policy
once webkit.org/b/104520 is solved. |
535 bool shouldBypassMainWorldCSP = frame()->script().shouldBypassMainWorldCSP()
|| options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy; | 535 bool shouldBypassMainWorldCSP = frame()->script().shouldBypassMainWorldCSP()
|| options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy; |
536 | 536 |
537 // Don't send CSP messages for preloads, we might never actually display tho
se items. | 537 // Don't send CSP messages for preloads, we might never actually display tho
se items. |
538 ContentSecurityPolicy::ReportingStatus cspReporting = forPreload ? | 538 ContentSecurityPolicy::ReportingStatus cspReporting = forPreload ? |
539 ContentSecurityPolicy::SuppressReport : ContentSecurityPolicy::SendRepor
t; | 539 ContentSecurityPolicy::SuppressReport : ContentSecurityPolicy::SendRepor
t; |
540 | 540 |
541 if (m_document) { | 541 if (m_document) { |
542 DCHECK(m_document->contentSecurityPolicy()); | 542 DCHECK(m_document->contentSecurityPolicy()); |
543 if (!shouldBypassMainWorldCSP && !m_document->contentSecurityPolicy()->a
llowRequest(resourceRequest.requestContext(), url, options.contentSecurityPolicy
Nonce, options.integrityMetadata, redirectStatus, cspReporting)) | 543 if (!shouldBypassMainWorldCSP && !m_document->contentSecurityPolicy()->a
llowRequest(resourceRequest.requestContext(), url, options.contentSecurityPolicy
Nonce, options.integrityMetadata, redirectStatus, cspReporting)) |
544 return ResourceRequestBlockedReasonCSP; | 544 return ResourceRequestBlockedReasonCSP; |
545 } | 545 } |
546 | 546 |
547 if (type == Resource::Script || type == Resource::ImportResource) { | 547 if (type == Resource::Script || type == Resource::ImportResource) { |
548 ASSERT(frame()); | 548 DCHECK(frame()); |
549 if (!frame()->loader().client()->allowScriptFromSource(!frame()->setting
s() || frame()->settings()->scriptEnabled(), url)) { | 549 if (!frame()->loader().client()->allowScriptFromSource(!frame()->setting
s() || frame()->settings()->scriptEnabled(), url)) { |
550 frame()->loader().client()->didNotAllowScript(); | 550 frame()->loader().client()->didNotAllowScript(); |
551 // TODO(estark): Use a different ResourceRequestBlockedReason | 551 // TODO(estark): Use a different ResourceRequestBlockedReason |
552 // here, since this check has nothing to do with | 552 // here, since this check has nothing to do with |
553 // CSP. https://crbug.com/600795 | 553 // CSP. https://crbug.com/600795 |
554 return ResourceRequestBlockedReasonCSP; | 554 return ResourceRequestBlockedReasonCSP; |
555 } | 555 } |
556 } else if (type == Resource::Media || type == Resource::TextTrack) { | 556 } else if (type == Resource::Media || type == Resource::TextTrack) { |
557 ASSERT(frame()); | 557 DCHECK(frame()); |
558 if (!frame()->loader().client()->allowMedia(url)) | 558 if (!frame()->loader().client()->allowMedia(url)) |
559 return ResourceRequestBlockedReasonOther; | 559 return ResourceRequestBlockedReasonOther; |
560 } | 560 } |
561 | 561 |
562 // SVG Images have unique security rules that prevent all subresource reques
ts | 562 // SVG Images have unique security rules that prevent all subresource reques
ts |
563 // except for data urls. | 563 // except for data urls. |
564 if (type != Resource::MainResource && frame()->chromeClient().isSVGImageChro
meClient() && !url.protocolIsData()) | 564 if (type != Resource::MainResource && frame()->chromeClient().isSVGImageChro
meClient() && !url.protocolIsData()) |
565 return ResourceRequestBlockedReasonOrigin; | 565 return ResourceRequestBlockedReasonOrigin; |
566 | 566 |
567 // Measure the number of legacy URL schemes ('ftp://') and the number of emb
edded-credential | 567 // Measure the number of legacy URL schemes ('ftp://') and the number of emb
edded-credential |
568 // ('http://user:password@...') resources embedded as subresources. in the h
opes that we can | 568 // ('http://user:password@...') resources embedded as subresources. in the h
opes that we can |
569 // block them at some point in the future. | 569 // block them at some point in the future. |
570 if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) { | 570 if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) { |
571 ASSERT(frame()->document()); | 571 DCHECK(frame()->document()); |
572 if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) && !Sch
emeRegistry::shouldTreatURLSchemeAsLegacy(frame()->document()->getSecurityOrigin
()->protocol())) | 572 if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) && !Sch
emeRegistry::shouldTreatURLSchemeAsLegacy(frame()->document()->getSecurityOrigin
()->protocol())) |
573 UseCounter::count(frame()->document(), UseCounter::LegacyProtocolEmb
eddedAsSubresource); | 573 UseCounter::count(frame()->document(), UseCounter::LegacyProtocolEmb
eddedAsSubresource); |
574 if (!url.user().isEmpty() || !url.pass().isEmpty()) | 574 if (!url.user().isEmpty() || !url.pass().isEmpty()) |
575 UseCounter::count(frame()->document(), UseCounter::RequestedSubresou
rceWithEmbeddedCredentials); | 575 UseCounter::count(frame()->document(), UseCounter::RequestedSubresou
rceWithEmbeddedCredentials); |
576 } | 576 } |
577 | 577 |
578 // Check for mixed content. We do this second-to-last so that when folks blo
ck | 578 // Check for mixed content. We do this second-to-last so that when folks blo
ck |
579 // mixed content with a CSP policy, they don't get a warning. They'll still | 579 // mixed content with a CSP policy, they don't get a warning. They'll still |
580 // get a warning in the console about CSP blocking the load. | 580 // get a warning in the console about CSP blocking the load. |
581 MixedContentChecker::ReportingStatus mixedContentReporting = forPreload ? | 581 MixedContentChecker::ReportingStatus mixedContentReporting = forPreload ? |
582 MixedContentChecker::SuppressReport : MixedContentChecker::SendReport; | 582 MixedContentChecker::SuppressReport : MixedContentChecker::SendReport; |
583 if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url, mix
edContentReporting)) | 583 if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url, mix
edContentReporting)) |
584 return ResourceRequestBlockedReasonMixedContent; | 584 return ResourceRequestBlockedReasonMixedContent; |
585 | 585 |
586 // Let the client have the final say into whether or not the load should pro
ceed. | 586 // Let the client have the final say into whether or not the load should pro
ceed. |
587 DocumentLoader* documentLoader = masterDocumentLoader(); | 587 DocumentLoader* documentLoader = masterDocumentLoader(); |
588 if (documentLoader && documentLoader->subresourceFilter() && type != Resourc
e::MainResource && type != Resource::ImportResource && !documentLoader->subresou
rceFilter()->allowLoad(url, resourceRequest.requestContext())) | 588 if (documentLoader && documentLoader->subresourceFilter() && type != Resourc
e::MainResource && type != Resource::ImportResource && !documentLoader->subresou
rceFilter()->allowLoad(url, resourceRequest.requestContext())) |
589 return ResourceRequestBlockedReasonSubresourceFilter; | 589 return ResourceRequestBlockedReasonSubresourceFilter; |
590 | 590 |
591 return ResourceRequestBlockedReasonNone; | 591 return ResourceRequestBlockedReasonNone; |
592 } | 592 } |
593 | 593 |
594 bool FrameFetchContext::isControlledByServiceWorker() const | 594 bool FrameFetchContext::isControlledByServiceWorker() const |
595 { | 595 { |
596 ASSERT(m_documentLoader || frame()->loader().documentLoader()); | 596 DCHECK(m_documentLoader || frame()->loader().documentLoader()); |
597 if (m_documentLoader) | 597 if (m_documentLoader) |
598 return frame()->loader().client()->isControlledByServiceWorker(*m_docume
ntLoader); | 598 return frame()->loader().client()->isControlledByServiceWorker(*m_docume
ntLoader); |
599 // m_documentLoader is null while loading resources from an HTML import. | 599 // m_documentLoader is null while loading resources from an HTML import. |
600 // In such cases whether the request is controlled by ServiceWorker or not | 600 // In such cases whether the request is controlled by ServiceWorker or not |
601 // is determined by the document loader of the frame. | 601 // is determined by the document loader of the frame. |
602 return frame()->loader().client()->isControlledByServiceWorker(*frame()->loa
der().documentLoader()); | 602 return frame()->loader().client()->isControlledByServiceWorker(*frame()->loa
der().documentLoader()); |
603 } | 603 } |
604 | 604 |
605 int64_t FrameFetchContext::serviceWorkerID() const | 605 int64_t FrameFetchContext::serviceWorkerID() const |
606 { | 606 { |
607 ASSERT(m_documentLoader || frame()->loader().documentLoader()); | 607 DCHECK(m_documentLoader || frame()->loader().documentLoader()); |
608 if (m_documentLoader) | 608 if (m_documentLoader) |
609 return frame()->loader().client()->serviceWorkerID(*m_documentLoader); | 609 return frame()->loader().client()->serviceWorkerID(*m_documentLoader); |
610 // m_documentLoader is null while loading resources from an HTML import. | 610 // m_documentLoader is null while loading resources from an HTML import. |
611 // In such cases a service worker ID could be retrieved from the document | 611 // In such cases a service worker ID could be retrieved from the document |
612 // loader of the frame. | 612 // loader of the frame. |
613 return frame()->loader().client()->serviceWorkerID(*frame()->loader().docume
ntLoader()); | 613 return frame()->loader().client()->serviceWorkerID(*frame()->loader().docume
ntLoader()); |
614 } | 614 } |
615 | 615 |
616 bool FrameFetchContext::isMainFrame() const | 616 bool FrameFetchContext::isMainFrame() const |
617 { | 617 { |
(...skipping 105 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
723 // `isNull()` check. https://crbug.com/625969 | 723 // `isNull()` check. https://crbug.com/625969 |
724 if (request.frameType() == WebURLRequest::FrameTypeNone && request.requestor
Origin()->isUnique()) { | 724 if (request.frameType() == WebURLRequest::FrameTypeNone && request.requestor
Origin()->isUnique()) { |
725 request.setRequestorOrigin(m_document->isSandboxed(SandboxOrigin) | 725 request.setRequestorOrigin(m_document->isSandboxed(SandboxOrigin) |
726 ? SecurityOrigin::create(m_document->url()) | 726 ? SecurityOrigin::create(m_document->url()) |
727 : m_document->getSecurityOrigin()); | 727 : m_document->getSecurityOrigin()); |
728 } | 728 } |
729 } | 729 } |
730 | 730 |
731 MHTMLArchive* FrameFetchContext::archive() const | 731 MHTMLArchive* FrameFetchContext::archive() const |
732 { | 732 { |
733 ASSERT(!isMainFrame()); | 733 DCHECK(!isMainFrame()); |
734 // TODO(nasko): How should this work with OOPIF? | 734 // TODO(nasko): How should this work with OOPIF? |
735 // The MHTMLArchive is parsed as a whole, but can be constructed from | 735 // The MHTMLArchive is parsed as a whole, but can be constructed from |
736 // frames in mutliple processes. In that case, which process should parse | 736 // frames in mutliple processes. In that case, which process should parse |
737 // it and how should the output be spread back across multiple processes? | 737 // it and how should the output be spread back across multiple processes? |
738 if (!frame()->tree().parent()->isLocalFrame()) | 738 if (!frame()->tree().parent()->isLocalFrame()) |
739 return nullptr; | 739 return nullptr; |
740 return toLocalFrame(frame()->tree().parent())->loader().documentLoader()->fe
tcher()->archive(); | 740 return toLocalFrame(frame()->tree().parent())->loader().documentLoader()->fe
tcher()->archive(); |
741 } | 741 } |
742 | 742 |
743 void FrameFetchContext::countClientHintsDPR() | 743 void FrameFetchContext::countClientHintsDPR() |
(...skipping 55 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
799 } | 799 } |
800 | 800 |
801 DEFINE_TRACE(FrameFetchContext) | 801 DEFINE_TRACE(FrameFetchContext) |
802 { | 802 { |
803 visitor->trace(m_document); | 803 visitor->trace(m_document); |
804 visitor->trace(m_documentLoader); | 804 visitor->trace(m_documentLoader); |
805 FetchContext::trace(visitor); | 805 FetchContext::trace(visitor); |
806 } | 806 } |
807 | 807 |
808 } // namespace blink | 808 } // namespace blink |
OLD | NEW |