OLD | NEW |
---|---|
1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/browser/frame_host/ancestor_throttle.h" | 5 #include "content/browser/frame_host/ancestor_throttle.h" |
6 | 6 |
7 #include "base/metrics/histogram_macros.h" | 7 #include "base/metrics/histogram_macros.h" |
8 #include "base/strings/string_split.h" | 8 #include "base/strings/string_split.h" |
9 #include "base/strings/string_util.h" | 9 #include "base/strings/string_util.h" |
10 #include "base/strings/stringprintf.h" | 10 #include "base/strings/stringprintf.h" |
11 #include "content/browser/frame_host/frame_tree.h" | 11 #include "content/browser/frame_host/frame_tree.h" |
12 #include "content/browser/frame_host/frame_tree_node.h" | 12 #include "content/browser/frame_host/frame_tree_node.h" |
13 #include "content/browser/frame_host/navigation_handle_impl.h" | 13 #include "content/browser/frame_host/navigation_handle_impl.h" |
14 #include "content/browser/frame_host/navigation_request.h" | |
14 #include "content/public/browser/browser_thread.h" | 15 #include "content/public/browser/browser_thread.h" |
15 #include "content/public/browser/navigation_handle.h" | 16 #include "content/public/browser/navigation_handle.h" |
16 #include "content/public/browser/navigation_throttle.h" | 17 #include "content/public/browser/navigation_throttle.h" |
18 #include "content/public/common/browser_side_navigation_policy.h" | |
17 #include "content/public/common/console_message_level.h" | 19 #include "content/public/common/console_message_level.h" |
18 #include "net/http/http_response_headers.h" | 20 #include "net/http/http_response_headers.h" |
19 #include "url/origin.h" | 21 #include "url/origin.h" |
20 | 22 |
21 namespace content { | 23 namespace content { |
22 | 24 |
23 namespace { | 25 namespace { |
24 const char kXFrameOptionsSameOriginHistogram[] = "Security.XFrameOptions"; | 26 const char kXFrameOptionsSameOriginHistogram[] = "Security.XFrameOptions"; |
25 | 27 |
26 // This enum is used for UMA metrics. Keep these enums up to date with | 28 // This enum is used for UMA metrics. Keep these enums up to date with |
(...skipping 131 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
158 RecordXFrameOptionsUsage(BYPASS); | 160 RecordXFrameOptionsUsage(BYPASS); |
159 return NavigationThrottle::PROCEED; | 161 return NavigationThrottle::PROCEED; |
160 case HeaderDisposition::ALLOWALL: | 162 case HeaderDisposition::ALLOWALL: |
161 RecordXFrameOptionsUsage(ALLOWALL); | 163 RecordXFrameOptionsUsage(ALLOWALL); |
162 return NavigationThrottle::PROCEED; | 164 return NavigationThrottle::PROCEED; |
163 } | 165 } |
164 NOTREACHED(); | 166 NOTREACHED(); |
165 return NavigationThrottle::BLOCK_RESPONSE; | 167 return NavigationThrottle::BLOCK_RESPONSE; |
166 } | 168 } |
167 | 169 |
170 NavigationThrottle::ThrottleCheckResult | |
171 AncestorThrottle::CheckContentSecurityPolicyFrameSrc(bool is_redirect) { | |
172 // If PlzNavigate is enabled, "frame-src" is enforced on the browser-side, | |
alexmos
2017/02/24 06:40:27
nit: "browser side", "renderer side" (no -). Same
arthursonzogni
2017/02/24 16:13:29
Done.
| |
173 // else on the renderer-side. | |
174 if (!IsBrowserSideNavigationEnabled()) | |
175 return NavigationThrottle::PROCEED; | |
176 | |
177 const GURL& url = navigation_handle()->GetURL(); | |
178 if (url.SchemeIs(url::kAboutScheme)) | |
179 return NavigationThrottle::PROCEED; | |
180 | |
181 NavigationHandleImpl* handle = | |
182 static_cast<NavigationHandleImpl*>(navigation_handle()); | |
183 | |
184 // Allow the request when it bypasses the CSP. | |
185 if (handle->should_bypass_main_world_csp()) | |
186 return NavigationThrottle::PROCEED; | |
187 | |
188 FrameTreeNode* parent_ftn = handle->frame_tree_node()->parent(); | |
189 DCHECK(parent_ftn); | |
190 RenderFrameHostImpl* parent = parent_ftn->current_frame_host(); | |
191 DCHECK(parent); | |
192 | |
193 if (!parent->csp_context()->Allow(parent->content_security_policies(), | |
194 CSPDirective::FrameSrc, url, is_redirect)) | |
195 return NavigationThrottle::BLOCK_REQUEST; | |
196 | |
197 return NavigationThrottle::PROCEED; | |
198 } | |
199 | |
200 NavigationThrottle::ThrottleCheckResult AncestorThrottle::WillStartRequest() { | |
201 return CheckContentSecurityPolicyFrameSrc(false); | |
202 } | |
203 | |
204 NavigationThrottle::ThrottleCheckResult | |
205 AncestorThrottle::WillRedirectRequest() { | |
206 return CheckContentSecurityPolicyFrameSrc(true); | |
207 } | |
208 | |
168 AncestorThrottle::AncestorThrottle(NavigationHandle* handle) | 209 AncestorThrottle::AncestorThrottle(NavigationHandle* handle) |
169 : NavigationThrottle(handle) {} | 210 : NavigationThrottle(handle) {} |
170 | 211 |
171 void AncestorThrottle::ParseError(const std::string& value, | 212 void AncestorThrottle::ParseError(const std::string& value, |
172 HeaderDisposition disposition) { | 213 HeaderDisposition disposition) { |
173 DCHECK(disposition == HeaderDisposition::CONFLICT || | 214 DCHECK(disposition == HeaderDisposition::CONFLICT || |
174 disposition == HeaderDisposition::INVALID); | 215 disposition == HeaderDisposition::INVALID); |
175 if (!navigation_handle()->GetRenderFrameHost()) | 216 if (!navigation_handle()->GetRenderFrameHost()) |
176 return; // Some responses won't have a RFH (i.e. 204/205s or downloads). | 217 return; // Some responses won't have a RFH (i.e. 204/205s or downloads). |
177 | 218 |
(...skipping 82 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
260 HeadersContainFrameAncestorsCSP(headers)) { | 301 HeadersContainFrameAncestorsCSP(headers)) { |
261 // TODO(mkwst): 'frame-ancestors' is currently handled in Blink. We should | 302 // TODO(mkwst): 'frame-ancestors' is currently handled in Blink. We should |
262 // handle it here instead. Until then, don't block the request, and let | 303 // handle it here instead. Until then, don't block the request, and let |
263 // Blink handle it. https://crbug.com/555418 | 304 // Blink handle it. https://crbug.com/555418 |
264 return HeaderDisposition::BYPASS; | 305 return HeaderDisposition::BYPASS; |
265 } | 306 } |
266 return result; | 307 return result; |
267 } | 308 } |
268 | 309 |
269 } // namespace content | 310 } // namespace content |
OLD | NEW |