Upgrade-Insecure-Requests: Split CSP checks into pre-upgrade and post-upgrade.

third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 576 matching lines @@
     return false;
   }
   return true;
 }
 
 bool FrameFetchContext::allowResponse(
     Resource::Type type,
     const ResourceRequest& resourceRequest,
     const KURL& url,
     const ResourceLoaderOptions& options) const {
+  // canRequestInternal only checks enforced policies: check report-only here
+  // to ensure violations are sent.
+  checkCSPForRequest(resourceRequest, url, options, false,
+                     RedirectStatus::FollowedRedirect,
+                     ContentSecurityPolicyHeaderTypeReport);
   ResourceRequestBlockedReason reason =
       canRequestInternal(type, resourceRequest, url, options, false,
                          FetchRequest::UseDefaultOriginRestrictionForType,
                          RedirectStatus::FollowedRedirect);
   if (reason != ResourceRequestBlockedReasonNone) {
     InspectorInstrumentation::didBlockRequest(frame(), resourceRequest,
                                               masterDocumentLoader(),
                                               options.initiatorInfo, reason);
     return false;
   }
   return true;
 }
 
+ResourceRequestBlockedReason FrameFetchContext::checkCSPForRequest(
+    const ResourceRequest& resourceRequest,
+    const KURL& url,
+    const ResourceLoaderOptions& options,
+    bool forPreload,
+    ResourceRequest::RedirectStatus redirectStatus,
+    ContentSecurityPolicyHeaderType headerType) const {
+  if (frame()->script().shouldBypassMainWorldCSP() ||
+      options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy) {
+    return ResourceRequestBlockedReasonNone;
+  }
+
+  // Don't send CSP messages for preloads, we might never actually display those
+  // items.
+  ContentSecurityPolicy::ReportingStatus cspReporting =
+      forPreload ? ContentSecurityPolicy::SuppressReport
+                 : ContentSecurityPolicy::SendReport;
+
+  if (m_document) {
+    DCHECK(m_document->contentSecurityPolicy());
+    if (!m_document->contentSecurityPolicy()->allowRequest(
+            resourceRequest.requestContext(), url,
+            options.contentSecurityPolicyNonce, options.integrityMetadata,
+            options.parserDisposition, redirectStatus, cspReporting,
+            headerType))
+      return ResourceRequestBlockedReasonCSP;
+  }
+  return ResourceRequestBlockedReasonNone;
+}
+
 ResourceRequestBlockedReason FrameFetchContext::canRequestInternal(
     Resource::Type type,
     const ResourceRequest& resourceRequest,
     const KURL& url,
     const ResourceLoaderOptions& options,
     bool forPreload,
     FetchRequest::OriginRestriction originRestriction,
     ResourceRequest::RedirectStatus redirectStatus) const {
   if (InspectorInstrumentation::shouldBlockRequest(frame(), resourceRequest))
     return ResourceRequestBlockedReasonInspector;
@@ skipping 37 matching lines @@
     case Resource::XSLStyleSheet:
       DCHECK(RuntimeEnabledFeatures::xsltEnabled());
     case Resource::SVGDocument:
       if (!securityOrigin->canRequest(url)) {
         printAccessDeniedMessage(url);
         return ResourceRequestBlockedReasonOrigin;
       }
       break;
   }
 
-  // FIXME: Convert this to check the isolated world's Content Security Policy
-  // once webkit.org/b/104520 is solved.
-  bool shouldBypassMainWorldCSP =
-      frame()->script().shouldBypassMainWorldCSP() ||
-      options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy;
-
-  // Don't send CSP messages for preloads, we might never actually display those
-  // items.
-  ContentSecurityPolicy::ReportingStatus cspReporting =
-      forPreload ? ContentSecurityPolicy::SuppressReport
-                 : ContentSecurityPolicy::SendReport;
-
-  if (m_document) {
-    DCHECK(m_document->contentSecurityPolicy());
-    if (!shouldBypassMainWorldCSP &&
-        !m_document->contentSecurityPolicy()->allowRequest(
-            resourceRequest.requestContext(), url,
-            options.contentSecurityPolicyNonce, options.integrityMetadata,
-            options.parserDisposition, redirectStatus, cspReporting))
-      return ResourceRequestBlockedReasonCSP;
+  // We check the 'report-only' headers before upgrading the request (in
+  // 'modifyRequestForCSP'). We check the enforced headers here to ensure we
+  // block things we ought to block.
+  if (checkCSPForRequest(resourceRequest, url, options, forPreload,
+                         redirectStatus,
+                         ContentSecurityPolicyHeaderTypeEnforce) ==
+      ResourceRequestBlockedReasonCSP) {
+    return ResourceRequestBlockedReasonCSP;
   }
 
   if (type == Resource::Script || type == Resource::ImportResource) {
     DCHECK(frame());
     if (!frame()->loader().client()->allowScriptFromSource(
             !frame()->settings() || frame()->settings()->scriptEnabled(),
             url)) {
       frame()->loader().client()->didNotAllowScript();
       // TODO(estark): Use a different ResourceRequestBlockedReason here, since
       // this check has nothing to do with CSP. https://crbug.com/600795
@@ skipping 309 matching lines @@
                                                     response);
 }
 
 DEFINE_TRACE(FrameFetchContext) {
   visitor->trace(m_document);
   visitor->trace(m_documentLoader);
   FetchContext::trace(visitor);
 }
 
 }  // namespace blink