Enable websocket filtering via SubresourceFilter

third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 16 matching lines @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "modules/websockets/DocumentWebSocketChannel.h"
 
 #include <memory>
 #include "core/dom/DOMArrayBuffer.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContext.h"
+#include "core/dom/TaskRunnerHelper.h"
 #include "core/fileapi/FileReaderLoader.h"
 #include "core/fileapi/FileReaderLoaderClient.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/LocalFrameClient.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/inspector/InspectorInstrumentation.h"
+#include "core/loader/DocumentLoader.h"
+#include "core/loader/SubresourceFilter.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/MixedContentChecker.h"
 #include "modules/websockets/InspectorWebSocketEvents.h"
 #include "modules/websockets/WebSocketChannelClient.h"
 #include "modules/websockets/WebSocketFrame.h"
 #include "modules/websockets/WebSocketHandleImpl.h"
 #include "platform/WebFrameScheduler.h"
 #include "platform/loader/fetch/UniqueIdentifier.h"
 #include "platform/network/NetworkLog.h"
 #include "platform/network/WebSocketHandshakeRequest.h"
@@ skipping 121 matching lines @@
   m_url = url;
   Vector<String> protocols;
   // Avoid placing an empty token in the Vector when the protocol string is
   // empty.
   if (!protocol.isEmpty()) {
     // Since protocol is already verified and escaped, we can simply split
     // it.
     protocol.split(", ", true, protocols);
   }
 
+  // If the connection needs to be filtered, asynchronously fail. Note that
+  // returning "true" just indicates that this was not synchronous security
+  // error.
+  if (shouldFilterConnection(url)) {
+    // TODO(csharrison): Include a reason string here.

[pkalinnikov, 2017/03/02 12:33:53]

Could this be done in this CL? E.g., "Connection blocked|disallowed by
subresource_filter.".

[Charlie Harrison, 2017/03/02 14:48:01]

OK. This is a little hard to understand but it is better than nothing. We'll
have better devtools strings in notifyLoad later.

+    TaskRunnerHelper::get(TaskType::Networking, document())
+        ->postTask(
+            BLINK_FROM_HERE,
+            WTF::bind(
+                &DocumentWebSocketChannel::failWithClosureCode,
+                wrapPersistent(this), CloseEventCodePolicyViolation, String(""),
+                WarningMessageLevel,
+                WTF::passed(SourceLocation::create(String(), 0, 0, nullptr))));
+    return true;
+  }
+
   if (document()->frame() &&
       document()->frame()->interfaceProvider() !=
           InterfaceProvider::getEmptyInterfaceProvider()) {
     // Initialize the WebSocketHandle with the frame's InterfaceProvider to
     // provide the WebSocket implementation with context about this frame.
     // This is important so that the browser can show UI associated with
     // the WebSocket (e.g., for certificate errors).
     m_handle->initialize(document()->frame()->interfaceProvider());
   } else {
     m_handle->initialize(Platform::current()->interfaceProvider());
@@ skipping 90 matching lines @@
   DCHECK(m_handle);
   unsigned short codeToSend = static_cast<unsigned short>(
       code == CloseEventCodeNotSpecified ? CloseEventCodeNoStatusRcvd : code);
   m_messages.append(new Message(codeToSend, reason));
   processSendQueue();
 }
 
 void DocumentWebSocketChannel::fail(const String& reason,
                                     MessageLevel level,
                                     std::unique_ptr<SourceLocation> location) {
+  return failWithClosureCode(CloseEventCodeAbnormalClosure, reason, level,
+                             std::move(location));
+}
+
+void DocumentWebSocketChannel::failWithClosureCode(
+    unsigned short code,
+    const String& reason,
+    MessageLevel level,
+    std::unique_ptr<SourceLocation> location) {
   NETWORK_DVLOG(1) << this << " fail(" << reason << ")";
   // m_handle and m_client can be null here.
 
   connection_handle_for_scheduler_.reset();
 
   InspectorInstrumentation::didReceiveWebSocketFrameError(document(),
                                                           m_identifier, reason);
   const String message = "WebSocket connection to '" + m_url.elidedString() +
                          "' failed: " + reason;
   document()->addConsoleMessage(ConsoleMessage::create(
       JSMessageSource, level, message, std::move(location)));
 
   if (m_client)
     m_client->didError();
   // |reason| is only for logging and should not be provided for scripts,
   // hence close reason must be empty.
-  handleDidClose(false, CloseEventCodeAbnormalClosure, String());
+  handleDidClose(false, code, String());
   // handleDidClose may delete this object.
 }
 
 void DocumentWebSocketChannel::disconnect() {
   NETWORK_DVLOG(1) << this << " disconnect()";
   if (m_identifier) {
     TRACE_EVENT_INSTANT1(
         "devtools.timeline", "WebSocketDestroy", TRACE_EVENT_SCOPE_THREAD,
         "data", InspectorWebSocketEvent::data(document(), m_identifier));
     InspectorInstrumentation::didCloseWebSocket(document(), m_identifier);
@@ skipping 334 matching lines @@
   m_blobLoader.clear();
   if (errorCode == FileError::kAbortErr) {
     // The error is caused by cancel().
     return;
   }
   // FIXME: Generate human-friendly reason message.
   failAsError("Failed to load Blob: error code = " + String::number(errorCode));
   // |this| can be deleted here.
 }
 
+bool DocumentWebSocketChannel::shouldFilterConnection(const KURL& url) {

[pkalinnikov, 2017/03/02 12:33:53]

nit: How about should(Disallow|Block)Connection?

[Charlie Harrison, 2017/03/02 14:48:01]

Changed to Disallow.

+  if (!m_handle)
+    return false;
+  DocumentLoader* loader = document()->loader();
+  if (!loader)
+    return false;
+  SubresourceFilter* subresourceFilter = loader->subresourceFilter();
+  if (!subresourceFilter)
+    return false;
+  return !subresourceFilter->allowWebSocketConnection(url);
+}
+
 DEFINE_TRACE(DocumentWebSocketChannel) {
   visitor->trace(m_blobLoader);
   visitor->trace(m_messages);
   visitor->trace(m_client);
   visitor->trace(m_document);
   WebSocketChannel::trace(visitor);
 }
 
 std::ostream& operator<<(std::ostream& ostream,
                          const DocumentWebSocketChannel* channel) {
   return ostream << "DocumentWebSocketChannel "
                  << static_cast<const void*>(channel);
 }
 
 }  // namespace blink