Enable websocket filtering via SubresourceFilter

third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp

Index: third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
diff --git a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
index 743f06d89a4c106ab6e7fe419c23c658ca828319..6a3c3cc3cc33c4915e380309e7ba2d395d86ee76 100644
--- a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
+++ b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
@@ -34,12 +34,15 @@
 #include "core/dom/DOMArrayBuffer.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContext.h"
+#include "core/dom/TaskRunnerHelper.h"
 #include "core/fileapi/FileReaderLoader.h"
 #include "core/fileapi/FileReaderLoaderClient.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/LocalFrameClient.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/inspector/InspectorInstrumentation.h"
+#include "core/loader/DocumentLoader.h"
+#include "core/loader/DocumentSubresourceFilterClient.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/MixedContentChecker.h"
 #include "modules/websockets/InspectorWebSocketEvents.h"
@@ -192,6 +195,19 @@ bool DocumentWebSocketChannel::connect(const KURL& url,
   } else {
     m_handle->initialize(Platform::current()->interfaceProvider());
   }
+
+  // If the connection needs to be filtered, asynchronously fail. Note that
+  // returning "true" just indicates that this was not synchronous security
+  // error.
+  if (shouldFilterConnection(url)) {
+    TaskRunnerHelper::get(TaskType::Networking, document())
+        ->postTask(BLINK_FROM_HERE,
+                   WTF::bind(&DocumentWebSocketChannel::handleDidClose,

[yhirano, 2017/03/01 03:40:42]

Thank you!

I found we need some more operations such as clearing
|connection_handle_for_scheduler_|, calling didError, etc. I think the following
would be the easiest.

1. Define DocumentWebSocketChannel::failWithClosureCode which has |code|
parameter. The implementation is mostly same as DocumentWebSocketChannel::fail.
2. Make DocumentWebSocketChannel::fail call failWithClosureCode with 1006.
3. Call failWithClosureCode asynchronously here.

Sorry for another roundtrip...

[Charlie Harrison, 2017/03/01 03:58:51]

Done, how does this look to you?

+                             wrapPersistent(this), false,
+                             CloseEventCodePolicyViolation, String("")));
+    return true;
+  }
+
   m_handle->connect(url, protocols, document()->getSecurityOrigin(),
                     document()->firstPartyForCookies(), document()->userAgent(),
                     this);
@@ -662,6 +678,19 @@ void DocumentWebSocketChannel::didFailLoadingBlob(
   // |this| can be deleted here.
 }
 
+bool DocumentWebSocketChannel::shouldFilterConnection(const KURL& url) {
+  if (!m_handle)
+    return false;
+  DocumentLoader* loader = document()->loader();
+  if (!loader)
+    return false;
+  DocumentSubresourceFilterClient* subresourceFilter =
+      loader->subresourceFilter();
+  if (!subresourceFilter)
+    return false;
+  return !subresourceFilter->allowWebSocketConnection(url);
+}
+
 DEFINE_TRACE(DocumentWebSocketChannel) {
   visitor->trace(m_blobLoader);
   visitor->trace(m_messages);