service worker: Implement NavigationPreloadManager.setHeaderValue

content/common/service_worker/service_worker_messages.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Message definition file, included multiple times, hence no include guard.
 
 #include <stdint.h>
 
 #include <string>
 #include <vector>
@@ skipping 39 matching lines @@
                           content::SERVICE_WORKER_PROVIDER_TYPE_LAST)
 
 IPC_ENUM_TRAITS_MAX_VALUE(content::ServiceWorkerFetchType,
                           content::ServiceWorkerFetchType::LAST)
 
 IPC_STRUCT_TRAITS_BEGIN(content::ExtendableMessageEventSource)
   IPC_STRUCT_TRAITS_MEMBER(client_info)
   IPC_STRUCT_TRAITS_MEMBER(service_worker_info)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(content::NavigationPreloadState)
+  IPC_STRUCT_TRAITS_MEMBER(enabled)
+  IPC_STRUCT_TRAITS_MEMBER(header)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(content::ServiceWorkerFetchRequest)
   IPC_STRUCT_TRAITS_MEMBER(mode)
   IPC_STRUCT_TRAITS_MEMBER(is_main_resource_load)
   IPC_STRUCT_TRAITS_MEMBER(request_context_type)
   IPC_STRUCT_TRAITS_MEMBER(frame_type)
   IPC_STRUCT_TRAITS_MEMBER(url)
   IPC_STRUCT_TRAITS_MEMBER(method)
   IPC_STRUCT_TRAITS_MEMBER(headers)
   IPC_STRUCT_TRAITS_MEMBER(blob_uuid)
   IPC_STRUCT_TRAITS_MEMBER(blob_size)
@@ skipping 125 matching lines @@
                      int64_t /* registration_id */,
                      bool /* enable */)
 
 // Asks the browser to get navigation preload state for a registration.
 IPC_MESSAGE_CONTROL4(ServiceWorkerHostMsg_GetNavigationPreloadState,
                      int /* thread_id */,
                      int /* request_id */,
                      int /* provider_id */,
                      int64_t /* registration_id */)
 
+// Asks the browser to set navigation preload header value for a registration.
+IPC_MESSAGE_CONTROL5(ServiceWorkerHostMsg_SetNavigationPreloadHeader,
+                     int /* thread_id */,
+                     int /* request_id */,
+                     int /* provider_id */,
+                     int64_t /* registration_id */,
+                     std::string /* header_value */)

[Tom Sepez, 2016/10/31 20:09:49]

Are there any constraints on the values that can be supplied that need to be
validated browser-side? 

For example, what happens if the value contains unexpected punctuation,
newlines, etc. -- can we get in a situation where a compromised renderer might
be able to inject unrelated headers?

[falken, 2016/11/01 00:35:28]

Good question. Yes, the current patchset calls net::HttpUtil::IsValidHeaderValue
in ServiceWorkerDispatcherHost to reject strings that contain CR or LF or \0,
which is important since HTTP header fields are delimited by CRLF. As noted in
the comment, this is more lenient than the Blink-side check of
blink::isValidHTTPHeaderValue, which further restricts the string to
latin1-only. Ideally the checks would match perfectly but rolling our own
isValidHTTPHeaderValue just for this seems like overkill since there's already
one in net::HttpUtil, and filtering out CRLF and \0 seems enough to stop
injection of bad headers.

Actually I think renderers can already send arbitrary headers via
content::ResourceRequest, and these are also validated by
net::HttpUtil::IsValidHeaderValue via ResourceDispatcherHostImpl::BeginRequest
calling HttpRequestHeaders::AddHeadersFromString.

+
 // Sends ExtendableMessageEvent to a service worker (renderer->browser).
 IPC_MESSAGE_CONTROL5(
     ServiceWorkerHostMsg_PostMessageToWorker,
     int /* handle_id */,
     int /* provider_id */,
     base::string16 /* message */,
     url::Origin /* source_origin */,
     std::vector<int> /* sent_message_ports */)
 
 // Informs the browser of a new ServiceWorkerProvider in the child process,
@@ skipping 279 matching lines @@
                      int /* thread_id */,
                      int /* request_id */)
 IPC_MESSAGE_CONTROL4(ServiceWorkerMsg_EnableNavigationPreloadError,
                      int /* thread_id */,
                      int /* request_id */,
                      blink::WebServiceWorkerError::ErrorType /* code */,
                      std::string /* message */)
 IPC_MESSAGE_CONTROL3(ServiceWorkerMsg_DidGetNavigationPreloadState,
                      int /* thread_id */,
                      int /* request_id */,
-                     bool /* enabled */)
+                     content::NavigationPreloadState /* state */)
 IPC_MESSAGE_CONTROL4(ServiceWorkerMsg_GetNavigationPreloadStateError,
                      int /* thread_id */,
                      int /* request_id */,
                      blink::WebServiceWorkerError::ErrorType /* code */,
                      std::string /* message */)
+IPC_MESSAGE_CONTROL2(ServiceWorkerMsg_DidSetNavigationPreloadHeader,
+                     int /* thread_id */,
+                     int /* request_id */)
+IPC_MESSAGE_CONTROL4(ServiceWorkerMsg_SetNavigationPreloadHeaderError,
+                     int /* thread_id */,
+                     int /* request_id */,
+                     blink::WebServiceWorkerError::ErrorType /* code */,
+                     std::string /* message */)
 
 // Sends MessageEvent to a client document (browser->renderer).
 IPC_MESSAGE_CONTROL1(ServiceWorkerMsg_MessageToDocument,
                      ServiceWorkerMsg_MessageToDocument_Params)
 
 // Sent via EmbeddedWorker to dispatch events.
 IPC_MESSAGE_CONTROL1(ServiceWorkerMsg_InstallEvent,
                      int /* request_id */)
 IPC_MESSAGE_CONTROL1(ServiceWorkerMsg_ActivateEvent,
                      int /* request_id */)
@@ skipping 53 matching lines @@
 
 // Sent via EmbeddedWorker as a response of NavigateClient.
 IPC_MESSAGE_CONTROL2(ServiceWorkerMsg_NavigateClientResponse,
                      int /* request_id */,
                      content::ServiceWorkerClientInfo /* client */)
 
 // Sent via EmbeddedWorker as an error response of NavigateClient.
 IPC_MESSAGE_CONTROL2(ServiceWorkerMsg_NavigateClientError,
                      int /* request_id */,
                      GURL /* url */)