CrossOriginAccessControl: separate access checks and error message generation

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 535 matching lines @@
     return false;
   }
 
   --m_corsRedirectLimit;
 
   InspectorInstrumentation::didReceiveCORSRedirectResponse(
       document().frame(), resource->identifier(),
       document().frame()->loader().documentLoader(), redirectResponse,
       resource);
 
-  bool allowRedirect = false;
   String accessControlErrorDescription;
 
-  if (!CrossOriginAccessControl::isLegalRedirectLocation(
-          request.url(), accessControlErrorDescription)) {
-    accessControlErrorDescription =
-        "Redirect from '" + redirectResponse.url().getString() +
-        "' has been blocked by CORS policy: " + accessControlErrorDescription;
-  } else if (!m_sameOriginRequest &&
-             !passesAccessControlCheck(
-                 redirectResponse, effectiveAllowCredentials(),
-                 getSecurityOrigin(), accessControlErrorDescription,
-                 m_requestContext)) {
+  CrossOriginAccessControl::RedirectStatus redirectStatus =
+      CrossOriginAccessControl::checkRedirectLocation(request.url());
+  bool allowRedirect =
+      redirectStatus == CrossOriginAccessControl::kRedirectSuccess;
+  if (!allowRedirect) {
+    StringBuilder builder;
+    builder.append("Redirect from '");
+    builder.append(redirectResponse.url().getString());
+    builder.append("' has been blocked by CORS policy: ");
+    CrossOriginAccessControl::redirectErrorString(builder, redirectStatus,
+                                                  request.url());
+    accessControlErrorDescription = builder.toString();
+  } else if (!m_sameOriginRequest) {
     // The redirect response must pass the access control check if the original
     // request was not same-origin.
-    accessControlErrorDescription =
-        "Redirect from '" + redirectResponse.url().getString() + "' to '" +
-        request.url().getString() + "' has been blocked by CORS policy: " +
-        accessControlErrorDescription;
-  } else {
-    allowRedirect = true;
+    CrossOriginAccessControl::AccessStatus corsStatus =
+        CrossOriginAccessControl::checkAccess(
+            redirectResponse, effectiveAllowCredentials(), getSecurityOrigin());
+    allowRedirect = corsStatus == CrossOriginAccessControl::kAccessAllowed;
+    if (!allowRedirect) {
+      StringBuilder builder;
+      builder.append("Redirect from '");
+      builder.append(redirectResponse.url().getString());
+      builder.append("' to '");
+      builder.append(request.url().getString());
+      builder.append("' has been blocked by CORS policy: ");
+      CrossOriginAccessControl::accessControlErrorString(
+          builder, corsStatus, redirectResponse, getSecurityOrigin(),
+          m_requestContext);
+      accessControlErrorDescription = builder.toString();
+    }
   }
 
   if (!allowRedirect) {
     dispatchDidFailAccessControlCheck(ResourceError(
         errorDomainBlinkInternal, 0, redirectResponse.url().getString(),
         accessControlErrorDescription));
     return false;
   }
 
   m_client->didReceiveRedirectTo(request.url());
@@ skipping 99 matching lines @@
   if (handle)
     m_isUsingDataConsumerHandle = true;
 
   handleResponse(resource->identifier(), response, std::move(handle));
 }
 
 void DocumentThreadableLoader::handlePreflightResponse(
     const ResourceResponse& response) {
   String accessControlErrorDescription;
 
-  if (!passesAccessControlCheck(
-          response, effectiveAllowCredentials(), getSecurityOrigin(),
-          accessControlErrorDescription, m_requestContext)) {
-    handlePreflightFailure(
-        response.url().getString(),
-        "Response to preflight request doesn't pass access control check: " +
-            accessControlErrorDescription);
+  CrossOriginAccessControl::AccessStatus corsStatus =
+      CrossOriginAccessControl::checkAccess(
+          response, effectiveAllowCredentials(), getSecurityOrigin());
+  if (corsStatus != CrossOriginAccessControl::kAccessAllowed) {
+    StringBuilder builder;
+    builder.append(
+        "Response to preflight request doesn't pass access "
+        "control check: ");
+    CrossOriginAccessControl::accessControlErrorString(
+        builder, corsStatus, response, getSecurityOrigin(), m_requestContext);
+    handlePreflightFailure(response.url().getString(), builder.toString());
     return;
   }
 
-  if (!passesPreflightStatusCheck(response, accessControlErrorDescription)) {
-    handlePreflightFailure(response.url().getString(),
-                           accessControlErrorDescription);
+  CrossOriginAccessControl::PreflightStatus preflightStatus =
+      CrossOriginAccessControl::checkPreflight(response);
+  if (preflightStatus != CrossOriginAccessControl::kPreflightSuccess) {
+    StringBuilder builder;
+    CrossOriginAccessControl::preflightErrorString(builder, preflightStatus,
+                                                   response);
+    handlePreflightFailure(response.url().getString(), builder.toString());
     return;
   }
 
-  if (m_actualRequest.isExternalRequest() &&
-      !passesExternalPreflightCheck(response, accessControlErrorDescription)) {
-    handlePreflightFailure(response.url().getString(),
-                           accessControlErrorDescription);
-    return;
+  if (m_actualRequest.isExternalRequest()) {
+    CrossOriginAccessControl::PreflightStatus externalPreflightStatus =
+        CrossOriginAccessControl::checkExternalPreflight(response);
+    if (externalPreflightStatus !=
+        CrossOriginAccessControl::kPreflightSuccess) {
+      StringBuilder builder;
+      CrossOriginAccessControl::preflightErrorString(
+          builder, externalPreflightStatus, response);
+      handlePreflightFailure(response.url().getString(), builder.toString());
+      return;
+    }
   }
 
   std::unique_ptr<CrossOriginPreflightResultCacheItem> preflightResult =
       WTF::wrapUnique(
           new CrossOriginPreflightResultCacheItem(effectiveAllowCredentials()));
   if (!preflightResult->parse(response, accessControlErrorDescription) ||
       !preflightResult->allowsCrossOriginMethod(
           m_actualRequest.httpMethod(), accessControlErrorDescription) ||
       !preflightResult->allowsCrossOriginHeaders(
           m_actualRequest.httpHeaderFields(), accessControlErrorDescription)) {
@@ skipping 64 matching lines @@
   // loadFallbackRequestForServiceWorker().
   // FIXME: We should use |m_sameOriginRequest| when we will support Suborigins
   // (crbug.com/336894) for Service Worker.
   DCHECK(
       m_fallbackRequestForServiceWorker.isNull() ||
       getSecurityOrigin()->canRequest(m_fallbackRequestForServiceWorker.url()));
   m_fallbackRequestForServiceWorker = ResourceRequest();
 
   if (!m_sameOriginRequest &&
       m_options.crossOriginRequestPolicy == UseAccessControl) {
-    String accessControlErrorDescription;
-    if (!passesAccessControlCheck(
-            response, effectiveAllowCredentials(), getSecurityOrigin(),
-            accessControlErrorDescription, m_requestContext)) {
+    CrossOriginAccessControl::AccessStatus corsStatus =
+        CrossOriginAccessControl::checkAccess(
+            response, effectiveAllowCredentials(), getSecurityOrigin());
+    if (corsStatus != CrossOriginAccessControl::kAccessAllowed) {
       reportResponseReceived(identifier, response);
-
+      StringBuilder builder;
+      CrossOriginAccessControl::accessControlErrorString(
+          builder, corsStatus, response, getSecurityOrigin(), m_requestContext);
       dispatchDidFailAccessControlCheck(
           ResourceError(errorDomainBlinkInternal, 0, response.url().getString(),
-                        accessControlErrorDescription));
+                        builder.toString()));
       return;
     }
   }
 
   m_client->didReceiveResponse(identifier, response, std::move(handle));
 }
 
 void DocumentThreadableLoader::setSerializedCachedMetadata(Resource*,
                                                            const char* data,
                                                            size_t size) {
@@ skipping 298 matching lines @@
 }
 
 DEFINE_TRACE(DocumentThreadableLoader) {
   visitor->trace(m_resource);
   visitor->trace(m_document);
   ThreadableLoader::trace(visitor);
   RawResourceClient::trace(visitor);
 }
 
 }  // namespace blink