PlzNavigate: Enforce 'form-action' CSP on the browser-side.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 6292 matching lines @@
 
   int load_flags = GetLoadFlagsForWebURLRequest(info.urlRequest);
 
   // Requests initiated via devtools can have caching disabled.
   if (info.isCacheDisabled) {
     // Turn off all caching related flags and set LOAD_BYPASS_CACHE.
     load_flags &= ~(net::LOAD_VALIDATE_CACHE | net::LOAD_SKIP_CACHE_VALIDATION |
                     net::LOAD_ONLY_FROM_CACHE | net::LOAD_DISABLE_CACHE);
     load_flags |= net::LOAD_BYPASS_CACHE;
   }
+
+  bool is_form_submission =
+      info.navigationType == blink::WebNavigationTypeFormSubmitted ||
+      info.navigationType == blink::WebNavigationTypeFormSubmitted;

[Mike West, 2017/02/22 15:36:08]

This seems like you pasted the same thing twice. Did you mean Resubmitted? We
apparently don't have any tests that cover the difference here: can you add one?

[arthursonzogni, 2017/02/22 17:15:23]

Oops, thanks!
Ack for the test. I assume that a form resubmission happens when the current
page is the result of a form submission and it gets reloaded. right? But if the
first navigation was blocked by the 'form-action', it can't be reloaded since it
wasn't loaded. It's probably for this reason that we don't have any test for
this.
Is it what you had in mind? Do you want to test something else?

[alexmos, 2017/02/28 02:48:46]

Again, can't speak for Mike, but there's a Blink unittest,
ParameterizedWebFrameTest.ReloadPost, that shows how to get the Resubmitted
navigation type, which indeed just seems to be a reload (or back-forward) of a
page resulting from a form submit.  The original bug presumably would've
prevented the throttle from being created for the resubmission.  So perhaps you
can have a test where the form submission succeeds (not blocked by form-action),
and then reload the resulting page and ensure that the reload has a correct
is_form_submission() bit?

I'm also a bit confused by how a form resubmission is supposed to interact with
CSP form-action, namely which frame's CSP is supposed to be checked for the
resubmission.  Presumably the old frame's CSP is gone after the first form
submit loads, but it doesn't seem like the new doc's (the result of first
submit) CSP should apply for the resubmit.  The Blink check in
FrameLoader::shouldContinueForNavigationPolicy checks for both regular form
submits and resubmissions, but I'm not sure whether a CSP form-action can allow
a form submission but then later block the resubmission (which is what you might
also want in a test for this).

[arthursonzogni, 2017/03/07 16:25:51]

I will add a test with an allowed form submission to a page that disallow form
submission. Then I reload the page to see what happens.

I think I will not get the right behavior with my CL and maybe not with the
current architecture too.

+
   BeginNavigationParams begin_navigation_params(
       GetWebURLRequestHeaders(info.urlRequest), load_flags,
       info.urlRequest.hasUserGesture(),
       info.urlRequest.skipServiceWorker() !=
           blink::WebURLRequest::SkipServiceWorker::None,
       GetRequestContextTypeForWebURLRequest(info.urlRequest),
       GetMixedContentContextTypeForWebURLRequest(info.urlRequest),
-      initiator_origin);
+      is_form_submission, initiator_origin);
 
   if (!info.form.isNull()) {
     WebSearchableFormData web_searchable_form_data(info.form);
     begin_navigation_params.searchable_form_url =
         web_searchable_form_data.url();
     begin_navigation_params.searchable_form_encoding =
         web_searchable_form_data.encoding().utf8();
   }
 
   if (info.isClientRedirect)
@@ skipping 547 matching lines @@
   // event target. Potentially a Pepper plugin will receive the event.
   // In order to tell whether a plugin gets the last mouse event and which it
   // is, we set |pepper_last_mouse_event_target_| to null here. If a plugin gets
   // the event, it will notify us via DidReceiveMouseEvent() and set itself as
   // |pepper_last_mouse_event_target_|.
   pepper_last_mouse_event_target_ = nullptr;
 #endif
 }
 
 }  // namespace content