Download web payment manifests.

components/payments/payment_manifest_downloader.cc

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/payments/payment_manifest_downloader.h"
+
+#include <unordered_map>
+#include <utility>
+
+#include "base/bind.h"
+#include "components/data_use_measurement/core/data_use_user_data.h"
+#include "components/link_header_util/link_header_util.h"
+#include "net/base/load_flags.h"
+#include "net/http/http_response_headers.h"
+#include "net/url_request/url_request_context_getter.h"
+
+namespace payments {
+
+PaymentManifestDownloader::PaymentManifestDownloader(
+    const scoped_refptr<net::URLRequestContextGetter>& context,
+    const std::string& method_name,
+    Delegate* delegate)
+    : context_(context),
+      method_name_(method_name),
+      delegate_(delegate),
+      is_downloading_http_link_header_(true) {}
+
+PaymentManifestDownloader::~PaymentManifestDownloader() {}
+
+void PaymentManifestDownloader::Download() {
+  InitiateDownload(method_name_, net::URLFetcher::HEAD);
+}
+
+void PaymentManifestDownloader::InitiateDownload(
+    const std::string& url,
+    net::URLFetcher::RequestType request_type) {
+  fetcher_ = net::URLFetcher::Create(0 /* id */, GURL(url), request_type, this);

[palmer, 2017/01/27 00:11:47]

I'd like to see a single point of validation, which validates at least the
following thingies:

* is it really a URL at all
* is it HTTPS
* is it to 1 of the handful of whitelisted hosts we trust payment manifests from

I have not yet read all the code in this CL; is there such a centralized
validation point?

[please use gerrit instead, 2017/02/23 19:57:50]

AndroidPaymentAppFactory.java:115
AndroidPaymentAppFactory.java:112
I've moved the parser into the renderer with extensive unit test coverage. Is
this sufficient to alleviate your concerns? Standards bodies generally frown
upon whitelisting.

+  data_use_measurement::DataUseUserData::AttachToFetcher(
+      fetcher_.get(), data_use_measurement::DataUseUserData::PAYMENTS);
+  fetcher_->SetLoadFlags(net::LOAD_DO_NOT_SEND_COOKIES |
+                         net::LOAD_DO_NOT_SAVE_COOKIES);
+  fetcher_->SetRequestContext(context_.get());
+  fetcher_->Start();
+}
+
+void PaymentManifestDownloader::OnURLFetchComplete(
+    const net::URLFetcher* source) {
+  if (source->GetResponseCode() != 200) {

[palmer, 2017/01/27 00:11:47]

Have 3xx redirects already been followed, at this point? (Apologies if so;
URLFetcher seems to depend on SetStopOnRedirect to learn what it should do; it
might be a good idea to set it explicitly just so you know for sure. Although
keep in mind that any URL validation requirements should apply to the new
redirected locations, too.)

[please use gerrit instead, 2017/02/23 19:57:50]

I've prohibited 3xx redirects in the latest patch. See
payment_manifest_downloader.cc:58.

+    delegate_->OnManifestDownloadFailure();
+    return;
+  }
+
+  if (is_downloading_http_link_header_) {
+    is_downloading_http_link_header_ = false;
+    std::string link_header;
+    source->GetResponseHeaders()->GetNormalizedHeader("link", &link_header);
+    if (!link_header.empty()) {
+      std::string url;
+      std::unordered_map<std::string, base::Optional<std::string>> params;
+      for (const auto& value : link_header_util::SplitLinkHeader(link_header)) {
+        if (!link_header_util::ParseLinkHeaderValue(value.first, value.second,
+                                                    &url, &params)) {
+          break;
+        }
+
+        auto rel = params.find("rel");
+        if (rel != params.end() &&
+            rel->second.value_or("") == "payment-method-manifest") {
+          if (url.find("https://") != 0)
+            url = method_name_ + "/" + url;
+          InitiateDownload(url, net::URLFetcher::GET);
+          return;
+        }
+      }
+    }
+  } else {
+    std::string content;
+    if (source->GetResponseAsString(&content)) {
+      delegate_->OnManifestDownloadSuccess(content);
+      return;
+    }
+  }
+
+  delegate_->OnManifestDownloadFailure();
+}
+
+}  // namespace payments