Adding Embedding-CSP HTTP header

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 156 matching lines @@
     if (!overrideURL.isEmpty()) {
         request.setURL(overrideURL);
         request.clearHTTPReferrer();
     }
     request.setSkipServiceWorker(frameLoadType == FrameLoadTypeReloadBypassingCache ? WebURLRequest::SkipServiceWorker::All : WebURLRequest::SkipServiceWorker::None);
     return request;
 }
 
 FrameLoader::FrameLoader(LocalFrame* frame)
     : m_frame(frame)
+    , m_requiredCSP(nullAtom)

[Mike West, 2016/10/06 08:00:51]

Nit: I think this is the default, isn't it? You shouldn't need to initialize
this.

     , m_progressTracker(ProgressTracker::create(frame))
     , m_loadType(FrameLoadTypeStandard)
     , m_inStopAllLoaders(false)
     , m_checkTimer(TaskRunnerHelper::get(TaskType::Networking, frame), this, &FrameLoader::checkTimerFired)
     , m_forcedSandboxFlags(SandboxNone)
     , m_dispatchingDidClearWindowObjectInMainWorld(false)
     , m_protectProvisionalLoader(false)
     , m_isNavigationHandledByClient(false)
 {
     TRACE_EVENT_OBJECT_CREATED_WITH_ID("loading", "FrameLoader", this);
@@ skipping 1246 matching lines @@
 void FrameLoader::startLoad(FrameLoadRequest& frameLoadRequest, FrameLoadType type, NavigationPolicy navigationPolicy)
 {
     DCHECK(client()->hasWebView());
     if (m_frame->document()->pageDismissalEventBeingDispatched() != Document::NoDismissal)
         return;
 
     NavigationType navigationType = determineNavigationType(type, frameLoadRequest.resourceRequest().httpBody() || frameLoadRequest.form(), frameLoadRequest.triggeringEvent());
     frameLoadRequest.resourceRequest().setRequestContext(determineRequestContextFromNavigationType(navigationType));
     frameLoadRequest.resourceRequest().setFrameType(m_frame->isMainFrame() ? WebURLRequest::FrameTypeTopLevel : WebURLRequest::FrameTypeNested);
     ResourceRequest& request = frameLoadRequest.resourceRequest();
-    upgradeInsecureRequest(request, nullptr);
+
+    // Record the latest requiredCSP value that will be used when sending this request.
+    recordLatestRequiredCSP();
+    addOutgoingSecurityHeadersAndUpgradeRequest(request, nullptr);
     if (!shouldContinueForNavigationPolicy(request, frameLoadRequest.substituteData(), nullptr, frameLoadRequest.shouldCheckMainWorldContentSecurityPolicy(), navigationType, navigationPolicy, type == FrameLoadTypeReplaceCurrentItem, frameLoadRequest.clientRedirect() == ClientRedirectPolicy::ClientRedirect, frameLoadRequest.form()))
         return;
 
     m_frame->document()->cancelParsing();
     detachDocumentLoader(m_provisionalDocumentLoader);
 
     // beforeunload fired above, and detaching a DocumentLoader can fire
     // events, which can detach this frame.
     if (!m_frame->host())
         return;
@@ skipping 162 matching lines @@
 
     // FIXME: We need a way to propagate insecure requests policy flags to
     // out-of-process frames. For now, we'll always use default behavior.
     if (!parentFrame->isLocalFrame())
         return nullptr;
 
     DCHECK(toLocalFrame(parentFrame)->document());
     return toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
 }
 
-void FrameLoader::upgradeInsecureRequest(ResourceRequest& resourceRequest, Document* document) const
+void FrameLoader::addOutgoingSecurityHeadersAndUpgradeRequest(ResourceRequest& resourceRequest, Document* document) const
 {
+    if (RuntimeEnabledFeatures::embedderCSPEnforcementEnabled() && !requiredCSP().isEmpty())
+        resourceRequest.setHTTPHeaderField(HTTPNames::Embedding_CSP, requiredCSP());

[Mike West, 2016/10/06 08:00:51]

Can you add a DCHECK here that the 'requiredCSP()' value is sane?

[amalika, 2016/10/06 18:54:57]

Not sure if that's what you wanted?

+
     // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational requests, as described in
     // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect
     if (resourceRequest.frameType() != WebURLRequest::FrameTypeNone) {
 
         // Early return if the request has already been upgraded.
         if (resourceRequest.httpHeaderField("Upgrade-Insecure-Requests") == AtomicString("1"))
             return;
 
         resourceRequest.addHTTPHeaderField("Upgrade-Insecure-Requests", "1");
     }
 
+    upgradeInsecureRequest(resourceRequest, document);
+}
+
+void FrameLoader::upgradeInsecureRequest(ResourceRequest& resourceRequest, Document* document) const
+{
     KURL url = resourceRequest.url();
 
     // If we don't yet have an |m_document| (because we're loading an iframe, for instance), check the FrameLoader's policy.
     WebInsecureRequestPolicy relevantPolicy = document ? document->getInsecureRequestPolicy() : getInsecureRequestPolicy();
     SecurityContext::InsecureNavigationsSet* relevantNavigationSet = document ? document->insecureNavigationsToUpgrade() : insecureNavigationsToUpgrade();
 
     if (url.protocolIs("http") && relevantPolicy & kUpgradeInsecureRequests) {
         // We always upgrade requests that meet any of the following criteria:
         //
         // 1. Are for subresources (including nested frames).
         // 2. Are form submissions.
         // 3. Whose hosts are contained in the document's InsecureNavigationSet.
         if (resourceRequest.frameType() == WebURLRequest::FrameTypeNone
             || resourceRequest.frameType() == WebURLRequest::FrameTypeNested
             || resourceRequest.requestContext() == WebURLRequest::RequestContextForm
             || (!url.host().isNull() && relevantNavigationSet->contains(url.host().impl()->hash()))) {
             UseCounter::count(document, UseCounter::UpgradeInsecureRequestsUpgradedRequest);
             url.setProtocol("https");
             if (url.port() == 80)
                 url.setPort(443);
             resourceRequest.setURL(url);
         }
     }
 }
 
+void FrameLoader::recordLatestRequiredCSP()
+{
+    m_requiredCSP = m_frame->owner() ? m_frame->owner()->csp() : nullAtom;
+}
 
 std::unique_ptr<TracedValue> FrameLoader::toTracedValue() const
 {
     std::unique_ptr<TracedValue> tracedValue = TracedValue::create();
     tracedValue->beginDictionary("frame");
     tracedValue->setString("id_ref", String::format("0x%" PRIx64, static_cast<uint64_t>(reinterpret_cast<uintptr_t>(m_frame.get()))));
     tracedValue->endDictionary();
     tracedValue->setBoolean("isLoadingMainFrame", isLoadingMainFrame());
     tracedValue->setString("stateMachine", m_stateMachine.toString());
     tracedValue->setString("provisionalDocumentLoaderURL", m_provisionalDocumentLoader ? m_provisionalDocumentLoader->url() : String());
     tracedValue->setString("documentLoaderURL", m_documentLoader ? m_documentLoader->url() : String());
     return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const
 {
     TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this, toTracedValue());
 }
 
 } // namespace blink