Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 /* | 1 /* |
| 2 * Copyright (C) 2013 Google Inc. All rights reserved. | 2 * Copyright (C) 2013 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
| 6 * met: | 6 * met: |
| 7 * | 7 * |
| 8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
| (...skipping 553 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 564 value->setString("url", url.getString()); | 564 value->setString("url", url.getString()); |
| 565 value->setInteger("priority", priority); | 565 value->setInteger("priority", priority); |
| 566 return value; | 566 return value; |
| 567 } | 567 } |
| 568 | 568 |
| 569 void FrameFetchContext::willStartLoadingResource( | 569 void FrameFetchContext::willStartLoadingResource( |
| 570 unsigned long identifier, | 570 unsigned long identifier, |
| 571 ResourceRequest& request, | 571 ResourceRequest& request, |
| 572 Resource::Type type, | 572 Resource::Type type, |
| 573 const AtomicString& fetchInitiatorName, | 573 const AtomicString& fetchInitiatorName, |
| 574 bool forPreload) { | 574 V8ActivityLoggingPolicy loggingPolicy) { |
| 575 TRACE_EVENT_ASYNC_BEGIN1( | 575 TRACE_EVENT_ASYNC_BEGIN1( |
| 576 "blink.net", "Resource", identifier, "data", | 576 "blink.net", "Resource", identifier, "data", |
| 577 loadResourceTraceData(identifier, request.url(), request.priority())); | 577 loadResourceTraceData(identifier, request.url(), request.priority())); |
| 578 prepareRequest(request); | 578 prepareRequest(request); |
| 579 | 579 |
| 580 if (!m_documentLoader || m_documentLoader->fetcher()->archive() || | 580 if (!m_documentLoader || m_documentLoader->fetcher()->archive() || |
| 581 !request.url().isValid()) | 581 !request.url().isValid()) |
| 582 return; | 582 return; |
| 583 if (type == Resource::MainResource) { | 583 if (type == Resource::MainResource) { |
| 584 m_documentLoader->applicationCacheHost()->willStartLoadingMainResource( | 584 m_documentLoader->applicationCacheHost()->willStartLoadingMainResource( |
| 585 request); | 585 request); |
| 586 } else { | 586 } else { |
| 587 m_documentLoader->applicationCacheHost()->willStartLoadingResource(request); | 587 m_documentLoader->applicationCacheHost()->willStartLoadingResource(request); |
| 588 } | 588 } |
| 589 if (!forPreload) { | 589 if (loggingPolicy == V8ActivityLoggingPolicy::Log) { |
| 590 V8DOMActivityLogger* activityLogger = nullptr; | 590 V8DOMActivityLogger* activityLogger = nullptr; |
| 591 if (fetchInitiatorName == FetchInitiatorTypeNames::xmlhttprequest) { | 591 if (fetchInitiatorName == FetchInitiatorTypeNames::xmlhttprequest) { |
| 592 activityLogger = V8DOMActivityLogger::currentActivityLogger(); | 592 activityLogger = V8DOMActivityLogger::currentActivityLogger(); |
| 593 } else { | 593 } else { |
| 594 activityLogger = | 594 activityLogger = |
| 595 V8DOMActivityLogger::currentActivityLoggerIfIsolatedWorld(); | 595 V8DOMActivityLogger::currentActivityLoggerIfIsolatedWorld(); |
| 596 } | 596 } |
| 597 | 597 |
| 598 if (activityLogger) { | 598 if (activityLogger) { |
| 599 Vector<String> argv; | 599 Vector<String> argv; |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 645 | 645 |
| 646 frame()->document()->addConsoleMessage(ConsoleMessage::create( | 646 frame()->document()->addConsoleMessage(ConsoleMessage::create( |
| 647 SecurityMessageSource, ErrorMessageLevel, message)); | 647 SecurityMessageSource, ErrorMessageLevel, message)); |
| 648 } | 648 } |
| 649 | 649 |
| 650 ResourceRequestBlockedReason FrameFetchContext::canRequest( | 650 ResourceRequestBlockedReason FrameFetchContext::canRequest( |
| 651 Resource::Type type, | 651 Resource::Type type, |
| 652 const ResourceRequest& resourceRequest, | 652 const ResourceRequest& resourceRequest, |
| 653 const KURL& url, | 653 const KURL& url, |
| 654 const ResourceLoaderOptions& options, | 654 const ResourceLoaderOptions& options, |
| 655 bool forPreload, | 655 ReportingPolicy reportingPolicy, |
| 656 FetchRequest::OriginRestriction originRestriction) const { | 656 FetchRequest::OriginRestriction originRestriction) const { |
| 657 ResourceRequestBlockedReason blockedReason = | 657 ResourceRequestBlockedReason blockedReason = |
| 658 canRequestInternal(type, resourceRequest, url, options, forPreload, | 658 canRequestInternal(type, resourceRequest, url, options, reportingPolicy, |
| 659 originRestriction, resourceRequest.redirectStatus()); | 659 originRestriction, resourceRequest.redirectStatus()); |
| 660 if (blockedReason != ResourceRequestBlockedReason::None && !forPreload) { | 660 if (blockedReason != ResourceRequestBlockedReason::None && |
| 661 reportingPolicy == ReportingPolicy::Report) { | |
| 661 InspectorInstrumentation::didBlockRequest( | 662 InspectorInstrumentation::didBlockRequest( |
| 662 frame(), resourceRequest, masterDocumentLoader(), options.initiatorInfo, | 663 frame(), resourceRequest, masterDocumentLoader(), options.initiatorInfo, |
| 663 blockedReason); | 664 blockedReason); |
| 664 } | 665 } |
| 665 return blockedReason; | 666 return blockedReason; |
| 666 } | 667 } |
| 667 | 668 |
| 668 ResourceRequestBlockedReason FrameFetchContext::allowResponse( | 669 ResourceRequestBlockedReason FrameFetchContext::allowResponse( |
| 669 Resource::Type type, | 670 Resource::Type type, |
| 670 const ResourceRequest& resourceRequest, | 671 const ResourceRequest& resourceRequest, |
| 671 const KURL& url, | 672 const KURL& url, |
| 672 const ResourceLoaderOptions& options) const { | 673 const ResourceLoaderOptions& options) const { |
| 673 ResourceRequestBlockedReason blockedReason = | 674 ResourceRequestBlockedReason blockedReason = canRequestInternal( |
| 674 canRequestInternal(type, resourceRequest, url, options, false, | 675 type, resourceRequest, url, options, ReportingPolicy::Report, |
| 675 FetchRequest::UseDefaultOriginRestrictionForType, | 676 FetchRequest::UseDefaultOriginRestrictionForType, |
| 676 RedirectStatus::FollowedRedirect); | 677 RedirectStatus::FollowedRedirect); |
| 677 if (blockedReason != ResourceRequestBlockedReason::None) { | 678 if (blockedReason != ResourceRequestBlockedReason::None) { |
| 678 InspectorInstrumentation::didBlockRequest( | 679 InspectorInstrumentation::didBlockRequest( |
| 679 frame(), resourceRequest, masterDocumentLoader(), options.initiatorInfo, | 680 frame(), resourceRequest, masterDocumentLoader(), options.initiatorInfo, |
| 680 blockedReason); | 681 blockedReason); |
| 681 } | 682 } |
| 682 return blockedReason; | 683 return blockedReason; |
| 683 } | 684 } |
| 684 | 685 |
| 685 ResourceRequestBlockedReason FrameFetchContext::canRequestInternal( | 686 ResourceRequestBlockedReason FrameFetchContext::canRequestInternal( |
| 686 Resource::Type type, | 687 Resource::Type type, |
| 687 const ResourceRequest& resourceRequest, | 688 const ResourceRequest& resourceRequest, |
| 688 const KURL& url, | 689 const KURL& url, |
| 689 const ResourceLoaderOptions& options, | 690 const ResourceLoaderOptions& options, |
| 690 bool forPreload, | 691 ReportingPolicy reportingPolicy, |
| 691 FetchRequest::OriginRestriction originRestriction, | 692 FetchRequest::OriginRestriction originRestriction, |
| 692 ResourceRequest::RedirectStatus redirectStatus) const { | 693 ResourceRequest::RedirectStatus redirectStatus) const { |
| 693 if (InspectorInstrumentation::shouldBlockRequest(frame(), resourceRequest)) | 694 if (InspectorInstrumentation::shouldBlockRequest(frame(), resourceRequest)) |
| 694 return ResourceRequestBlockedReason::Inspector; | 695 return ResourceRequestBlockedReason::Inspector; |
| 695 | 696 |
| 696 SecurityOrigin* securityOrigin = options.securityOrigin.get(); | 697 SecurityOrigin* securityOrigin = options.securityOrigin.get(); |
| 697 if (!securityOrigin && m_document) | 698 if (!securityOrigin && m_document) |
| 698 securityOrigin = m_document->getSecurityOrigin(); | 699 securityOrigin = m_document->getSecurityOrigin(); |
| 699 | 700 |
| 700 if (originRestriction != FetchRequest::NoOriginRestriction && | 701 if (originRestriction != FetchRequest::NoOriginRestriction && |
| 701 securityOrigin && !securityOrigin->canDisplay(url)) { | 702 securityOrigin && !securityOrigin->canDisplay(url)) { |
| 702 if (!forPreload) | 703 if (reportingPolicy == ReportingPolicy::Report) |
| 703 FrameLoader::reportLocalLoadFailed(frame(), url.elidedString()); | 704 FrameLoader::reportLocalLoadFailed(frame(), url.elidedString()); |
| 704 RESOURCE_LOADING_DVLOG(1) << "ResourceFetcher::requestResource URL was not " | 705 RESOURCE_LOADING_DVLOG(1) << "ResourceFetcher::requestResource URL was not " |
| 705 "allowed by SecurityOrigin::canDisplay"; | 706 "allowed by SecurityOrigin::canDisplay"; |
| 706 return ResourceRequestBlockedReason::Other; | 707 return ResourceRequestBlockedReason::Other; |
| 707 } | 708 } |
| 708 | 709 |
| 709 // Some types of resources can be loaded only from the same origin. Other | 710 // Some types of resources can be loaded only from the same origin. Other |
| 710 // types of resources, like Images, Scripts, and CSS, can be loaded from | 711 // types of resources, like Images, Scripts, and CSS, can be loaded from |
| 711 // any URL. | 712 // any URL. |
| 712 switch (type) { | 713 switch (type) { |
| (...skipping 26 matching lines...) Expand all Loading... | |
| 739 } | 740 } |
| 740 break; | 741 break; |
| 741 } | 742 } |
| 742 | 743 |
| 743 // FIXME: Convert this to check the isolated world's Content Security Policy | 744 // FIXME: Convert this to check the isolated world's Content Security Policy |
| 744 // once webkit.org/b/104520 is solved. | 745 // once webkit.org/b/104520 is solved. |
| 745 bool shouldBypassMainWorldCSP = | 746 bool shouldBypassMainWorldCSP = |
| 746 frame()->script().shouldBypassMainWorldCSP() || | 747 frame()->script().shouldBypassMainWorldCSP() || |
| 747 options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy; | 748 options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy; |
| 748 | 749 |
| 749 // Don't send CSP messages for preloads, we might never actually display those | 750 // Don't send CSP messages for preloads, we might never actually display those |
|
yhirano
2017/02/07 08:34:06
This comment should be moved to caller now.
Yoav Weiss
2017/02/07 09:10:27
agreed
| |
| 750 // items. | 751 // items. |
|
kinuko
2017/02/07 08:20:26
nit: update the comment?
| |
| 751 ContentSecurityPolicy::ReportingStatus cspReporting = | 752 ContentSecurityPolicy::ReportingStatus cspReporting = |
| 752 forPreload ? ContentSecurityPolicy::SuppressReport | 753 (reportingPolicy == ReportingPolicy::SuppressReporting) |
| 753 : ContentSecurityPolicy::SendReport; | 754 ? ContentSecurityPolicy::SuppressReport |
| 755 : ContentSecurityPolicy::SendReport; | |
| 754 | 756 |
| 755 if (m_document) { | 757 if (m_document) { |
| 756 DCHECK(m_document->contentSecurityPolicy()); | 758 DCHECK(m_document->contentSecurityPolicy()); |
| 757 if (!shouldBypassMainWorldCSP && | 759 if (!shouldBypassMainWorldCSP && |
| 758 !m_document->contentSecurityPolicy()->allowRequest( | 760 !m_document->contentSecurityPolicy()->allowRequest( |
| 759 resourceRequest.requestContext(), url, | 761 resourceRequest.requestContext(), url, |
| 760 options.contentSecurityPolicyNonce, options.integrityMetadata, | 762 options.contentSecurityPolicyNonce, options.integrityMetadata, |
| 761 options.parserDisposition, redirectStatus, cspReporting)) | 763 options.parserDisposition, redirectStatus, cspReporting)) |
| 762 return ResourceRequestBlockedReason::CSP; | 764 return ResourceRequestBlockedReason::CSP; |
| 763 } | 765 } |
| (...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 800 Deprecation::countDeprecation( | 802 Deprecation::countDeprecation( |
| 801 frame()->document(), | 803 frame()->document(), |
| 802 UseCounter::RequestedSubresourceWithEmbeddedCredentials); | 804 UseCounter::RequestedSubresourceWithEmbeddedCredentials); |
| 803 } | 805 } |
| 804 } | 806 } |
| 805 | 807 |
| 806 // Check for mixed content. We do this second-to-last so that when folks block | 808 // Check for mixed content. We do this second-to-last so that when folks block |
| 807 // mixed content with a CSP policy, they don't get a warning. They'll still | 809 // mixed content with a CSP policy, they don't get a warning. They'll still |
| 808 // get a warning in the console about CSP blocking the load. | 810 // get a warning in the console about CSP blocking the load. |
| 809 MixedContentChecker::ReportingStatus mixedContentReporting = | 811 MixedContentChecker::ReportingStatus mixedContentReporting = |
| 810 forPreload ? MixedContentChecker::SuppressReport | 812 (reportingPolicy == ReportingPolicy::SuppressReporting) |
| 811 : MixedContentChecker::SendReport; | 813 ? MixedContentChecker::SuppressReport |
| 814 : MixedContentChecker::SendReport; | |
| 812 if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url, | 815 if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url, |
| 813 mixedContentReporting)) | 816 mixedContentReporting)) |
| 814 return ResourceRequestBlockedReason::MixedContent; | 817 return ResourceRequestBlockedReason::MixedContent; |
| 815 | 818 |
| 816 // Let the client have the final say into whether or not the load should | 819 // Let the client have the final say into whether or not the load should |
| 817 // proceed. | 820 // proceed. |
| 818 DocumentLoader* documentLoader = masterDocumentLoader(); | 821 DocumentLoader* documentLoader = masterDocumentLoader(); |
| 819 if (documentLoader && documentLoader->subresourceFilter() && | 822 if (documentLoader && documentLoader->subresourceFilter() && |
| 820 type != Resource::MainResource && type != Resource::ImportResource && | 823 type != Resource::MainResource && type != Resource::ImportResource && |
| 821 !documentLoader->subresourceFilter()->allowLoad( | 824 !documentLoader->subresourceFilter()->allowLoad( |
| (...skipping 265 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1087 response); | 1090 response); |
| 1088 } | 1091 } |
| 1089 | 1092 |
| 1090 DEFINE_TRACE(FrameFetchContext) { | 1093 DEFINE_TRACE(FrameFetchContext) { |
| 1091 visitor->trace(m_document); | 1094 visitor->trace(m_document); |
| 1092 visitor->trace(m_documentLoader); | 1095 visitor->trace(m_documentLoader); |
| 1093 FetchContext::trace(visitor); | 1096 FetchContext::trace(visitor); |
| 1094 } | 1097 } |
| 1095 | 1098 |
| 1096 } // namespace blink | 1099 } // namespace blink |
| OLD | NEW |