Block renderer-initiated main frame navigations to data URLs

content/browser/frame_host/navigation_handle_impl.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_handle_impl.h"
 
 #include <iterator>
 
 #include "base/logging.h"
 #include "content/browser/appcache/appcache_navigation_handle.h"
 #include "content/browser/appcache/appcache_service_impl.h"
 #include "content/browser/browsing_data/clear_site_data_throttle.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 #include "content/browser/frame_host/ancestor_throttle.h"
+#include "content/browser/frame_host/data_url_navigation_throttle.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/form_submission_throttle.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/mixed_content_navigation_throttle.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/navigator_delegate.h"
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
@@ skipping 257 matching lines @@
 
 net::HttpResponseInfo::ConnectionInfo
 NavigationHandleImpl::GetConnectionInfo() {
   return connection_info_;
 }
 
 bool NavigationHandleImpl::HasCommitted() {
   return state_ == DID_COMMIT || state_ == DID_COMMIT_ERROR_PAGE;
 }
 
+bool NavigationHandleImpl::IsDownload() {
+  return is_download_;
+}
+
 bool NavigationHandleImpl::IsErrorPage() {
   return state_ == DID_COMMIT_ERROR_PAGE;
 }
 
 bool NavigationHandleImpl::HasSubframeNavigationEntryCommitted() {
   DCHECK(!IsInMainFrame());
   DCHECK(state_ == DID_COMMIT || state_ == DID_COMMIT_ERROR_PAGE);
   return subframe_entry_committed_;
 }
 
@@ skipping 370 matching lines @@
   subframe_entry_committed_ = navigation_entry_committed;
 
   // If an error page reloads, net_error_code might be 200 but we still want to
   // count it as an error page.
   if (params.base_url.spec() == kUnreachableWebDataURL ||
       net_error_code_ != net::OK) {
     state_ = DID_COMMIT_ERROR_PAGE;
   } else {
     state_ = DID_COMMIT;
   }
-
-  if (url_.SchemeIs(url::kDataScheme) && IsInMainFrame() &&
-      IsRendererInitiated()) {
-    GetRenderFrameHost()->AddMessageToConsole(
-        CONSOLE_MESSAGE_LEVEL_WARNING,
-        "Upcoming versions will block content-initiated top frame navigations "
-        "to data: URLs. For more information, see https://goo.gl/BaZAea.");
-  }
 }
 
 void NavigationHandleImpl::Transfer() {
   DCHECK(!IsBrowserSideNavigationEnabled());
   // This is an actual transfer. Inform the NavigationResourceThrottle. This
   // will allow to mark the URLRequest as transferring. When it is marked as
   // transferring, the URLRequest can no longer be cancelled by its original
   // RenderFrame. Instead it will persist until being picked up by the transfer
   // RenderFrame, even if the original RenderFrame is destroyed.
   // Note: |transfer_callback_| can be null in unit tests.
@@ skipping 221 matching lines @@
   // Register the navigation throttles. The vector returned by
   // CreateThrottlesForNavigation is not assigned to throttles_ directly because
   // it would overwrite any throttles previously added with
   // RegisterThrottleForTesting.
   // TODO(carlosk, arthursonzogni): should simplify this to either use
   // |throttles_| directly (except for the case described above) or
   // |throttles_to_register| for registering all throttles.
   std::vector<std::unique_ptr<NavigationThrottle>> throttles_to_register =
       GetDelegate()->CreateThrottlesForNavigation(this);
 
+  // Check for top-frame, content-initiated navigations to data URLs. This is

[nasko, 2017/03/30 23:15:45]

nit: s/content-initiated/renderer-initiated/, s/top-frame/main frame/

[meacer, 2017/04/05 22:33:28]

Done.

+  // done first as it may block the top frame navigation altogether.
+  std::unique_ptr<NavigationThrottle> data_url_navigation_throttle =
+      DataUrlNavigationThrottle::CreateThrottleForNavigation(this);
+  if (data_url_navigation_throttle)
+    throttles_to_register.push_back(std::move(data_url_navigation_throttle));
+
   std::unique_ptr<content::NavigationThrottle> ancestor_throttle =
       content::AncestorThrottle::MaybeCreateThrottleFor(this);
   if (ancestor_throttle)
     throttles_.push_back(std::move(ancestor_throttle));
 
   std::unique_ptr<content::NavigationThrottle> form_submission_throttle =
       content::FormSubmissionThrottle::MaybeCreateThrottleFor(this);
   if (form_submission_throttle)
     throttles_.push_back(std::move(form_submission_throttle));
 
@@ skipping 40 matching lines @@
     if (node->current_url().EqualsIgnoringRef(url_)) {
       if (found_self_reference)
         return true;
       found_self_reference = true;
     }
   }
   return false;
 }
 
 }  // namespace content