| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2013 Google Inc. All rights reserved. | 2 * Copyright (C) 2013 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
| 6 * met: | 6 * met: |
| 7 * | 7 * |
| 8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
| (...skipping 553 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 564 value->setString("url", url.getString()); | 564 value->setString("url", url.getString()); |
| 565 value->setInteger("priority", priority); | 565 value->setInteger("priority", priority); |
| 566 return value; | 566 return value; |
| 567 } | 567 } |
| 568 | 568 |
| 569 void FrameFetchContext::willStartLoadingResource( | 569 void FrameFetchContext::willStartLoadingResource( |
| 570 unsigned long identifier, | 570 unsigned long identifier, |
| 571 ResourceRequest& request, | 571 ResourceRequest& request, |
| 572 Resource::Type type, | 572 Resource::Type type, |
| 573 const AtomicString& fetchInitiatorName, | 573 const AtomicString& fetchInitiatorName, |
| 574 bool forPreload) { | 574 V8ActivityLoggingPolicy loggingPolicy) { |
| 575 TRACE_EVENT_ASYNC_BEGIN1( | 575 TRACE_EVENT_ASYNC_BEGIN1( |
| 576 "blink.net", "Resource", identifier, "data", | 576 "blink.net", "Resource", identifier, "data", |
| 577 loadResourceTraceData(identifier, request.url(), request.priority())); | 577 loadResourceTraceData(identifier, request.url(), request.priority())); |
| 578 prepareRequest(request); | 578 prepareRequest(request); |
| 579 | 579 |
| 580 if (!m_documentLoader || m_documentLoader->fetcher()->archive() || | 580 if (!m_documentLoader || m_documentLoader->fetcher()->archive() || |
| 581 !request.url().isValid()) | 581 !request.url().isValid()) |
| 582 return; | 582 return; |
| 583 if (type == Resource::MainResource) { | 583 if (type == Resource::MainResource) { |
| 584 m_documentLoader->applicationCacheHost()->willStartLoadingMainResource( | 584 m_documentLoader->applicationCacheHost()->willStartLoadingMainResource( |
| 585 request); | 585 request); |
| 586 } else { | 586 } else { |
| 587 m_documentLoader->applicationCacheHost()->willStartLoadingResource(request); | 587 m_documentLoader->applicationCacheHost()->willStartLoadingResource(request); |
| 588 } | 588 } |
| 589 if (!forPreload) { | 589 if (loggingPolicy == V8ActivityLoggingPolicy::Log) { |
| 590 V8DOMActivityLogger* activityLogger = nullptr; | 590 V8DOMActivityLogger* activityLogger = nullptr; |
| 591 if (fetchInitiatorName == FetchInitiatorTypeNames::xmlhttprequest) { | 591 if (fetchInitiatorName == FetchInitiatorTypeNames::xmlhttprequest) { |
| 592 activityLogger = V8DOMActivityLogger::currentActivityLogger(); | 592 activityLogger = V8DOMActivityLogger::currentActivityLogger(); |
| 593 } else { | 593 } else { |
| 594 activityLogger = | 594 activityLogger = |
| 595 V8DOMActivityLogger::currentActivityLoggerIfIsolatedWorld(); | 595 V8DOMActivityLogger::currentActivityLoggerIfIsolatedWorld(); |
| 596 } | 596 } |
| 597 | 597 |
| 598 if (activityLogger) { | 598 if (activityLogger) { |
| 599 Vector<String> argv; | 599 Vector<String> argv; |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 645 | 645 |
| 646 frame()->document()->addConsoleMessage(ConsoleMessage::create( | 646 frame()->document()->addConsoleMessage(ConsoleMessage::create( |
| 647 SecurityMessageSource, ErrorMessageLevel, message)); | 647 SecurityMessageSource, ErrorMessageLevel, message)); |
| 648 } | 648 } |
| 649 | 649 |
| 650 ResourceRequestBlockedReason FrameFetchContext::canRequest( | 650 ResourceRequestBlockedReason FrameFetchContext::canRequest( |
| 651 Resource::Type type, | 651 Resource::Type type, |
| 652 const ResourceRequest& resourceRequest, | 652 const ResourceRequest& resourceRequest, |
| 653 const KURL& url, | 653 const KURL& url, |
| 654 const ResourceLoaderOptions& options, | 654 const ResourceLoaderOptions& options, |
| 655 bool forPreload, | 655 SecurityViolationReportingPolicy reportingPolicy, |
| 656 FetchRequest::OriginRestriction originRestriction) const { | 656 FetchRequest::OriginRestriction originRestriction) const { |
| 657 ResourceRequestBlockedReason blockedReason = | 657 ResourceRequestBlockedReason blockedReason = |
| 658 canRequestInternal(type, resourceRequest, url, options, forPreload, | 658 canRequestInternal(type, resourceRequest, url, options, reportingPolicy, |
| 659 originRestriction, resourceRequest.redirectStatus()); | 659 originRestriction, resourceRequest.redirectStatus()); |
| 660 if (blockedReason != ResourceRequestBlockedReason::None && !forPreload) { | 660 if (blockedReason != ResourceRequestBlockedReason::None && |
| 661 reportingPolicy == SecurityViolationReportingPolicy::Report) { |
| 661 InspectorInstrumentation::didBlockRequest( | 662 InspectorInstrumentation::didBlockRequest( |
| 662 frame(), resourceRequest, masterDocumentLoader(), options.initiatorInfo, | 663 frame(), resourceRequest, masterDocumentLoader(), options.initiatorInfo, |
| 663 blockedReason); | 664 blockedReason); |
| 664 } | 665 } |
| 665 return blockedReason; | 666 return blockedReason; |
| 666 } | 667 } |
| 667 | 668 |
| 668 ResourceRequestBlockedReason FrameFetchContext::allowResponse( | 669 ResourceRequestBlockedReason FrameFetchContext::allowResponse( |
| 669 Resource::Type type, | 670 Resource::Type type, |
| 670 const ResourceRequest& resourceRequest, | 671 const ResourceRequest& resourceRequest, |
| 671 const KURL& url, | 672 const KURL& url, |
| 672 const ResourceLoaderOptions& options) const { | 673 const ResourceLoaderOptions& options) const { |
| 673 ResourceRequestBlockedReason blockedReason = | 674 ResourceRequestBlockedReason blockedReason = |
| 674 canRequestInternal(type, resourceRequest, url, options, false, | 675 canRequestInternal(type, resourceRequest, url, options, |
| 676 SecurityViolationReportingPolicy::Report, |
| 675 FetchRequest::UseDefaultOriginRestrictionForType, | 677 FetchRequest::UseDefaultOriginRestrictionForType, |
| 676 RedirectStatus::FollowedRedirect); | 678 RedirectStatus::FollowedRedirect); |
| 677 if (blockedReason != ResourceRequestBlockedReason::None) { | 679 if (blockedReason != ResourceRequestBlockedReason::None) { |
| 678 InspectorInstrumentation::didBlockRequest( | 680 InspectorInstrumentation::didBlockRequest( |
| 679 frame(), resourceRequest, masterDocumentLoader(), options.initiatorInfo, | 681 frame(), resourceRequest, masterDocumentLoader(), options.initiatorInfo, |
| 680 blockedReason); | 682 blockedReason); |
| 681 } | 683 } |
| 682 return blockedReason; | 684 return blockedReason; |
| 683 } | 685 } |
| 684 | 686 |
| 685 ResourceRequestBlockedReason FrameFetchContext::canRequestInternal( | 687 ResourceRequestBlockedReason FrameFetchContext::canRequestInternal( |
| 686 Resource::Type type, | 688 Resource::Type type, |
| 687 const ResourceRequest& resourceRequest, | 689 const ResourceRequest& resourceRequest, |
| 688 const KURL& url, | 690 const KURL& url, |
| 689 const ResourceLoaderOptions& options, | 691 const ResourceLoaderOptions& options, |
| 690 bool forPreload, | 692 SecurityViolationReportingPolicy reportingPolicy, |
| 691 FetchRequest::OriginRestriction originRestriction, | 693 FetchRequest::OriginRestriction originRestriction, |
| 692 ResourceRequest::RedirectStatus redirectStatus) const { | 694 ResourceRequest::RedirectStatus redirectStatus) const { |
| 693 if (InspectorInstrumentation::shouldBlockRequest(frame(), resourceRequest)) | 695 if (InspectorInstrumentation::shouldBlockRequest(frame(), resourceRequest)) |
| 694 return ResourceRequestBlockedReason::Inspector; | 696 return ResourceRequestBlockedReason::Inspector; |
| 695 | 697 |
| 696 SecurityOrigin* securityOrigin = options.securityOrigin.get(); | 698 SecurityOrigin* securityOrigin = options.securityOrigin.get(); |
| 697 if (!securityOrigin && m_document) | 699 if (!securityOrigin && m_document) |
| 698 securityOrigin = m_document->getSecurityOrigin(); | 700 securityOrigin = m_document->getSecurityOrigin(); |
| 699 | 701 |
| 700 if (originRestriction != FetchRequest::NoOriginRestriction && | 702 if (originRestriction != FetchRequest::NoOriginRestriction && |
| 701 securityOrigin && !securityOrigin->canDisplay(url)) { | 703 securityOrigin && !securityOrigin->canDisplay(url)) { |
| 702 if (!forPreload) | 704 if (reportingPolicy == SecurityViolationReportingPolicy::Report) |
| 703 FrameLoader::reportLocalLoadFailed(frame(), url.elidedString()); | 705 FrameLoader::reportLocalLoadFailed(frame(), url.elidedString()); |
| 704 RESOURCE_LOADING_DVLOG(1) << "ResourceFetcher::requestResource URL was not " | 706 RESOURCE_LOADING_DVLOG(1) << "ResourceFetcher::requestResource URL was not " |
| 705 "allowed by SecurityOrigin::canDisplay"; | 707 "allowed by SecurityOrigin::canDisplay"; |
| 706 return ResourceRequestBlockedReason::Other; | 708 return ResourceRequestBlockedReason::Other; |
| 707 } | 709 } |
| 708 | 710 |
| 709 // Some types of resources can be loaded only from the same origin. Other | 711 // Some types of resources can be loaded only from the same origin. Other |
| 710 // types of resources, like Images, Scripts, and CSS, can be loaded from | 712 // types of resources, like Images, Scripts, and CSS, can be loaded from |
| 711 // any URL. | 713 // any URL. |
| 712 switch (type) { | 714 switch (type) { |
| (...skipping 26 matching lines...) Expand all Loading... |
| 739 } | 741 } |
| 740 break; | 742 break; |
| 741 } | 743 } |
| 742 | 744 |
| 743 // FIXME: Convert this to check the isolated world's Content Security Policy | 745 // FIXME: Convert this to check the isolated world's Content Security Policy |
| 744 // once webkit.org/b/104520 is solved. | 746 // once webkit.org/b/104520 is solved. |
| 745 bool shouldBypassMainWorldCSP = | 747 bool shouldBypassMainWorldCSP = |
| 746 frame()->script().shouldBypassMainWorldCSP() || | 748 frame()->script().shouldBypassMainWorldCSP() || |
| 747 options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy; | 749 options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy; |
| 748 | 750 |
| 749 // Don't send CSP messages for preloads, we might never actually display those | |
| 750 // items. | |
| 751 ContentSecurityPolicy::ReportingStatus cspReporting = | 751 ContentSecurityPolicy::ReportingStatus cspReporting = |
| 752 forPreload ? ContentSecurityPolicy::SuppressReport | 752 (reportingPolicy == SecurityViolationReportingPolicy::SuppressReporting) |
| 753 : ContentSecurityPolicy::SendReport; | 753 ? ContentSecurityPolicy::SuppressReport |
| 754 : ContentSecurityPolicy::SendReport; |
| 754 | 755 |
| 755 if (m_document) { | 756 if (m_document) { |
| 756 DCHECK(m_document->contentSecurityPolicy()); | 757 DCHECK(m_document->contentSecurityPolicy()); |
| 757 if (!shouldBypassMainWorldCSP && | 758 if (!shouldBypassMainWorldCSP && |
| 758 !m_document->contentSecurityPolicy()->allowRequest( | 759 !m_document->contentSecurityPolicy()->allowRequest( |
| 759 resourceRequest.requestContext(), url, | 760 resourceRequest.requestContext(), url, |
| 760 options.contentSecurityPolicyNonce, options.integrityMetadata, | 761 options.contentSecurityPolicyNonce, options.integrityMetadata, |
| 761 options.parserDisposition, redirectStatus, cspReporting)) | 762 options.parserDisposition, redirectStatus, cspReporting)) |
| 762 return ResourceRequestBlockedReason::CSP; | 763 return ResourceRequestBlockedReason::CSP; |
| 763 } | 764 } |
| (...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 800 Deprecation::countDeprecation( | 801 Deprecation::countDeprecation( |
| 801 frame()->document(), | 802 frame()->document(), |
| 802 UseCounter::RequestedSubresourceWithEmbeddedCredentials); | 803 UseCounter::RequestedSubresourceWithEmbeddedCredentials); |
| 803 } | 804 } |
| 804 } | 805 } |
| 805 | 806 |
| 806 // Check for mixed content. We do this second-to-last so that when folks block | 807 // Check for mixed content. We do this second-to-last so that when folks block |
| 807 // mixed content with a CSP policy, they don't get a warning. They'll still | 808 // mixed content with a CSP policy, they don't get a warning. They'll still |
| 808 // get a warning in the console about CSP blocking the load. | 809 // get a warning in the console about CSP blocking the load. |
| 809 MixedContentChecker::ReportingStatus mixedContentReporting = | 810 MixedContentChecker::ReportingStatus mixedContentReporting = |
| 810 forPreload ? MixedContentChecker::SuppressReport | 811 (reportingPolicy == SecurityViolationReportingPolicy::SuppressReporting) |
| 811 : MixedContentChecker::SendReport; | 812 ? MixedContentChecker::SuppressReport |
| 813 : MixedContentChecker::SendReport; |
| 812 if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url, | 814 if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url, |
| 813 mixedContentReporting)) | 815 mixedContentReporting)) |
| 814 return ResourceRequestBlockedReason::MixedContent; | 816 return ResourceRequestBlockedReason::MixedContent; |
| 815 | 817 |
| 816 // Let the client have the final say into whether or not the load should | 818 // Let the client have the final say into whether or not the load should |
| 817 // proceed. | 819 // proceed. |
| 818 DocumentLoader* documentLoader = masterDocumentLoader(); | 820 DocumentLoader* documentLoader = masterDocumentLoader(); |
| 819 if (documentLoader && documentLoader->subresourceFilter() && | 821 if (documentLoader && documentLoader->subresourceFilter() && |
| 820 type != Resource::MainResource && type != Resource::ImportResource && | 822 type != Resource::MainResource && type != Resource::ImportResource && |
| 821 !documentLoader->subresourceFilter()->allowLoad( | 823 !documentLoader->subresourceFilter()->allowLoad( |
| (...skipping 265 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1087 response); | 1089 response); |
| 1088 } | 1090 } |
| 1089 | 1091 |
| 1090 DEFINE_TRACE(FrameFetchContext) { | 1092 DEFINE_TRACE(FrameFetchContext) { |
| 1091 visitor->trace(m_document); | 1093 visitor->trace(m_document); |
| 1092 visitor->trace(m_documentLoader); | 1094 visitor->trace(m_documentLoader); |
| 1093 FetchContext::trace(visitor); | 1095 FetchContext::trace(visitor); |
| 1094 } | 1096 } |
| 1095 | 1097 |
| 1096 } // namespace blink | 1098 } // namespace blink |
| OLD | NEW |