nav timing 2 redirect allow opt-in

third_party/WebKit/Source/core/timing/PerformanceBase.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2012 Intel Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 207 matching lines @@
 void PerformanceBase::clearFrameTimings() {
   m_frameTimingBuffer.clear();
 }
 
 void PerformanceBase::setFrameTimingBufferSize(unsigned size) {
   m_frameTimingBufferSize = size;
   if (isFrameTimingBufferFull())
     dispatchEvent(Event::create(EventTypeNames::frametimingbufferfull));
 }
 
-static bool passesTimingAllowCheck(
+bool PerformanceBase::passesTimingAllowCheck(
     const ResourceResponse& response,
     const SecurityOrigin& initiatorSecurityOrigin,
     const AtomicString& originalTimingAllowOrigin,
     ExecutionContext* context) {
   RefPtr<SecurityOrigin> resourceOrigin =
       SecurityOrigin::create(response.url());
   if (resourceOrigin->isSameSchemeHostPort(&initiatorSecurityOrigin))
     return true;
 
   const AtomicString& timingAllowOriginString =
@@ skipping 17 matching lines @@
   else if (timingAllowOrigins.size() == 1)
     UseCounter::count(context, UseCounter::SingleOriginInTimingAllowOrigin);
   for (const String& allowOrigin : timingAllowOrigins) {
     if (allowOrigin == securityOrigin)
       return true;
   }
 
   return false;
 }
 
-static bool allowsTimingRedirect(const Vector<ResourceResponse>& redirectChain,
-                                 const ResourceResponse& finalResponse,
-                                 const SecurityOrigin& initiatorSecurityOrigin,
-                                 ExecutionContext* context) {
+bool PerformanceBase::allowsTimingRedirect(
+    const Vector<ResourceResponse>& redirectChain,
+    const ResourceResponse& finalResponse,
+    const SecurityOrigin& initiatorSecurityOrigin,
+    ExecutionContext* context) {
   if (!passesTimingAllowCheck(finalResponse, initiatorSecurityOrigin,
                               AtomicString(), context))
     return false;
 
   for (const ResourceResponse& response : redirectChain) {
     if (!passesTimingAllowCheck(response, initiatorSecurityOrigin,
                                 AtomicString(), context))
       return false;
   }
 
   return true;
 }
 
+SecurityOrigin* PerformanceBase::getSecurityOrigin() const {

[panicker, 2016/12/07 00:40:52]

Nit: prefer moving to anonymous namespace here as a helper and pass in
getExecutionContext() as an arg

[sunjian, 2016/12/07 20:10:32]

Done.

+  ExecutionContext* context = getExecutionContext();
+  if (context)
+    return context->getSecurityOrigin();
+  return nullptr;
+}
+
 void PerformanceBase::addResourceTiming(const ResourceTimingInfo& info) {
   if (isResourceTimingBufferFull() &&
       !hasObserverFor(PerformanceEntry::Resource))
     return;
-  SecurityOrigin* securityOrigin = nullptr;
   ExecutionContext* context = getExecutionContext();
-  if (context)
-    securityOrigin = context->getSecurityOrigin();
+  SecurityOrigin* securityOrigin = getSecurityOrigin();
   if (!securityOrigin)
     return;
 
   const ResourceResponse& finalResponse = info.finalResponse();
   bool allowTimingDetails =
       passesTimingAllowCheck(finalResponse, *securityOrigin,
                              info.originalTimingAllowOrigin(), context);
   double startTime = info.initialTime();
 
   if (info.redirectChain().isEmpty()) {
@@ skipping 37 matching lines @@
   DCHECK(documentLoader);
 
   const DocumentLoadTiming& documentLoadTiming = documentLoader->timing();
 
   const DocumentTiming* documentTiming =
       frame->document() ? &(frame->document()->timing()) : nullptr;
 
   const ResourceResponse& finalResponse = documentLoader->response();
   ResourceTimingInfo* resourceTimingInfo =
       documentLoader->getMainResourceTimingInfo();
+
   // Don't create navigation timing instance when resourceTimingInfo
   // is null, which could happen when it is an iframe navigation restored
   // from history, since its location may have been changed after initial
   // navigation.
   if (!resourceTimingInfo)
     return;
 
   ResourceLoadTiming* resourceLoadTiming = finalResponse.resourceLoadTiming();
   // Don't create a navigation timing instance when
   // resourceLoadTiming is null, which could happen when visiting non-http sites
   // such as about:blank or in some error cases.
   if (!resourceLoadTiming)
     return;
   double lastRedirectEndTime = documentLoadTiming.redirectEnd();
   double finishTime = documentLoadTiming.loadEventEnd();
 
+  SecurityOrigin* securityOrigin = getSecurityOrigin();
+  if (!securityOrigin)
+    return;
+
+  bool allowRedirectDetails =
+      allowsTimingRedirect(resourceTimingInfo->redirectChain(), finalResponse,
+                           *securityOrigin, getExecutionContext());
+
   unsigned long long transferSize = resourceTimingInfo->transferSize();
   unsigned long long encodedBodyLength = finalResponse.encodedBodyLength();
   unsigned long long decodedBodyLength = finalResponse.decodedBodyLength();
   bool didReuseConnection = finalResponse.connectionReused();
   PerformanceNavigationTiming::NavigationType type =
       getNavigationType(documentLoader->getNavigationType(), frame->document());
 
   m_navigationTiming = new PerformanceNavigationTiming(
       timeOrigin(), documentLoadTiming.unloadEventStart(),
       documentLoadTiming.unloadEventEnd(), documentLoadTiming.loadEventStart(),
       documentLoadTiming.loadEventEnd(), documentLoadTiming.redirectCount(),
       documentTiming ? documentTiming->domInteractive() : 0,
       documentTiming ? documentTiming->domContentLoadedEventStart() : 0,
       documentTiming ? documentTiming->domContentLoadedEventEnd() : 0,
       documentTiming ? documentTiming->domComplete() : 0, type,
       documentLoadTiming.redirectStart(), documentLoadTiming.redirectEnd(),
       documentLoadTiming.fetchStart(), documentLoadTiming.responseEnd(),
-      documentLoadTiming.hasCrossOriginRedirect(),
+      allowRedirectDetails,
       documentLoadTiming.hasSameOriginAsPreviousDocument(), resourceLoadTiming,
       lastRedirectEndTime, finishTime, transferSize, encodedBodyLength,
       decodedBodyLength, didReuseConnection);
   notifyObserversOfEntry(*m_navigationTiming);
 }
 
 void PerformanceBase::addResourceTimingBuffer(PerformanceEntry& entry) {
   m_resourceTimingBuffer.append(&entry);
 
   if (isResourceTimingBufferFull()) {
@@ skipping 170 matching lines @@
   visitor->trace(m_resourceTimingBuffer);
   visitor->trace(m_navigationTiming);
   visitor->trace(m_userTiming);
   visitor->trace(m_observers);
   visitor->trace(m_activeObservers);
   visitor->trace(m_suspendedObservers);
   EventTargetWithInlineData::trace(visitor);
 }
 
 }  // namespace blink