Block renderer-initiated main frame navigations to data URLs

content/browser/frame_host/navigation_handle_impl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_handle_impl.h"
 
 #include <iterator>
 
 #include "base/logging.h"
 #include "content/browser/appcache/appcache_navigation_handle.h"
 #include "content/browser/appcache/appcache_service_impl.h"
 #include "content/browser/browsing_data/clear_site_data_throttle.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 #include "content/browser/frame_host/ancestor_throttle.h"
+#include "content/browser/frame_host/data_url_navigation_throttle.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/mixed_content_navigation_throttle.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/navigator_delegate.h"
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/service_worker/service_worker_navigation_handle.h"
@@ skipping 249 matching lines @@
 
 net::HttpResponseInfo::ConnectionInfo
 NavigationHandleImpl::GetConnectionInfo() {
   return connection_info_;
 }
 
 bool NavigationHandleImpl::HasCommitted() {
   return state_ == DID_COMMIT || state_ == DID_COMMIT_ERROR_PAGE;
 }
 
+bool NavigationHandleImpl::IsDownload() {
+  return is_download_;
+}
+
 bool NavigationHandleImpl::IsErrorPage() {
   return state_ == DID_COMMIT_ERROR_PAGE;
 }
 
 bool NavigationHandleImpl::DidReplaceEntry() {
   DCHECK(state_ == DID_COMMIT || state_ == DID_COMMIT_ERROR_PAGE);
   return did_replace_entry_;
 }
 
 bool NavigationHandleImpl::ShouldUpdateHistory() {
@@ skipping 358 matching lines @@
   navigation_type_ = navigation_type;
 
   // If an error page reloads, net_error_code might be 200 but we still want to
   // count it as an error page.
   if (params.base_url.spec() == kUnreachableWebDataURL ||
       net_error_code_ != net::OK) {
     state_ = DID_COMMIT_ERROR_PAGE;
   } else {
     state_ = DID_COMMIT;
   }
-
-  if (url_.SchemeIs(url::kDataScheme) && IsInMainFrame() &&
-      IsRendererInitiated()) {
-    GetRenderFrameHost()->AddMessageToConsole(
-        CONSOLE_MESSAGE_LEVEL_WARNING,
-        "Upcoming versions will block content-initiated top frame navigations "
-        "to data: URLs. For more information, see https://goo.gl/BaZAea.");
-  }
 }
 
 void NavigationHandleImpl::Transfer() {
   DCHECK(!IsBrowserSideNavigationEnabled());
   // This is an actual transfer. Inform the NavigationResourceThrottle. This
   // will allow to mark the URLRequest as transferring. When it is marked as
   // transferring, the URLRequest can no longer be cancelled by its original
   // RenderFrame. Instead it will persist until being picked up by the transfer
   // RenderFrame, even if the original RenderFrame is destroyed.
   // Note: |transfer_callback_| can be null in unit tests.
@@ skipping 239 matching lines @@
   std::unique_ptr<NavigationThrottle> clear_site_data_throttle =
       ClearSiteDataThrottle::CreateThrottleForNavigation(this);
   if (clear_site_data_throttle)
     throttles_to_register.push_back(std::move(clear_site_data_throttle));
 
   std::unique_ptr<content::NavigationThrottle> ancestor_throttle =
       content::AncestorThrottle::MaybeCreateThrottleFor(this);
   if (ancestor_throttle)
     throttles_.push_back(std::move(ancestor_throttle));
 
+  throttles_to_register.push_back(
+      DataUrlNavigationThrottle::CreateThrottleForNavigation(this));

[nasko, 2017/03/28 19:58:01]

Do we want this to be run after mixed content and CSP checks? If there is a good
reason for being placed last, might be a good thing to add a comment why.

[meacer, 2017/03/30 20:43:55]

Didn't really think about that as I was just appending to the list. Moved it to
the top (I'm assuming AncestorThrottle is the CSP check).

+
   throttles_.insert(throttles_.begin(),
                     std::make_move_iterator(throttles_to_register.begin()),
                     std::make_move_iterator(throttles_to_register.end()));
 }
 
 bool NavigationHandleImpl::IsSelfReferentialURL() {
   // about: URLs should be exempted since they are reserved for other purposes
   // and cannot be the source of infinite recursion. See
   // https://crbug.com/341858 .
   if (url_.SchemeIs("about"))
@@ skipping 11 matching lines @@
     if (node->current_url().EqualsIgnoringRef(url_)) {
       if (found_self_reference)
         return true;
       found_self_reference = true;
     }
   }
   return false;
 }
 
 }  // namespace content