Block renderer-initiated main frame navigations to data URLs

content/browser/frame_host/data_url_navigation_throttle.cc

Index: content/browser/frame_host/data_url_navigation_throttle.cc
diff --git a/content/browser/frame_host/data_url_navigation_throttle.cc b/content/browser/frame_host/data_url_navigation_throttle.cc
new file mode 100644
index 0000000000000000000000000000000000000000..93ba2ff1bc93a4da148cd50bdbe2cbdc121ed4d6
--- /dev/null
+++ b/content/browser/frame_host/data_url_navigation_throttle.cc
@@ -0,0 +1,62 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/frame_host/data_url_navigation_throttle.h"
+
+#include "base/feature_list.h"
+#include "base/memory/ptr_util.h"
+#include "base/strings/stringprintf.h"
+#include "content/browser/frame_host/frame_tree.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/common/console_message_level.h"
+#include "content/public/common/content_features.h"
+#include "url/url_constants.h"
+
+namespace content {
+
+namespace {
+const char kConsoleError[] =
+    "Not allowed to top-level navigate to resource: %s";
+}
+
+DataUrlNavigationThrottle::DataUrlNavigationThrottle(
+    NavigationHandle* navigation_handle)
+    : NavigationThrottle(navigation_handle) {}
+
+DataUrlNavigationThrottle::~DataUrlNavigationThrottle() {}
+
+NavigationThrottle::ThrottleCheckResult
+DataUrlNavigationThrottle::WillProcessResponse() {
+  NavigationHandleImpl* handle =
+      static_cast<NavigationHandleImpl*>(navigation_handle());
+  if (!handle->is_download()) {

[nasko, 2017/04/05 23:55:19]

Let's avoid a level of indentation and use:

if (handle->is_download())
  return PROCEED;

... the rest of the code. It also fails closed, which is always a nice way to do
security checks ;).

[meacer, 2017/04/06 01:25:42]

Sure, looks nicer :)

+    RenderFrameHost* top_frame =
+        handle->frame_tree_node()->frame_tree()->root()->current_frame_host();
+    top_frame->AddMessageToConsole(
+        CONSOLE_MESSAGE_LEVEL_ERROR,
+        base::StringPrintf(kConsoleError, handle->GetURL().spec().c_str()));
+    return CANCEL;
+  }
+  return PROCEED;
+}
+
+// static
+std::unique_ptr<NavigationThrottle>
+DataUrlNavigationThrottle::CreateThrottleForNavigation(
+    NavigationHandle* navigation_handle) {
+  if (navigation_handle->GetURL().SchemeIs(url::kDataScheme) &&
+      navigation_handle->IsInMainFrame() &&
+      navigation_handle->IsRendererInitiated() &&
+      !navigation_handle->IsSameDocument() &&
+      !base::FeatureList::IsEnabled(
+          features::kAllowInsecureDataUrlNavigations)) {
+    return base::WrapUnique(new DataUrlNavigationThrottle(navigation_handle));
+  }
+  return nullptr;
+}
+
+}  // namespace content