Enable websocket filtering via SubresourceFilter

third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp

Index: third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
diff --git a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
index 089e79056e6db6d4035b8c01e96af14484c6d5a6..a8eea40d3921941e4c5f110f0a5a1e95d677e8fb 100644
--- a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
+++ b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
@@ -33,14 +33,17 @@
 #include <memory>
 #include "core/dom/DOMArrayBuffer.h"
 #include "core/dom/ExecutionContext.h"
+#include "core/dom/TaskRunnerHelper.h"
 #include "core/fileapi/FileReaderLoader.h"
 #include "core/fileapi/FileReaderLoaderClient.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/LocalFrameClient.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/inspector/InspectorInstrumentation.h"
+#include "core/loader/DocumentLoader.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/MixedContentChecker.h"
+#include "core/loader/SubresourceFilter.h"
 #include "core/loader/ThreadableLoadingContext.h"
 #include "modules/websockets/InspectorWebSocketEvents.h"
 #include "modules/websockets/WebSocketChannelClient.h"
@@ -184,6 +187,21 @@ bool DocumentWebSocketChannel::connect(const KURL& url,
     protocol.split(", ", true, protocols);
   }
 
+  // If the connection needs to be filtered, asynchronously fail. Synchronous
+  // failure blocks the worker thread which should be avoided. Note that
+  // returning "true" just indicates that this was not a mixed content error.
+  if (shouldDisallowConnection(url)) {
+    TaskRunnerHelper::get(TaskType::Networking, document())

[engedy, 2017/03/06 16:31:01]

nit: For this, do we need include a subset of {WebTaskRunner.h,
WebTraceLocation.h, Functional.h}?

[Charlie Harrison, 2017/03/06 19:22:12]

Done.

+        ->postTask(
+            BLINK_FROM_HERE,
+            WTF::bind(
+                &DocumentWebSocketChannel::fail, wrapPersistent(this),
+                String("Connection disallowed by the subresource filter"),

[engedy, 2017/03/06 16:31:01]

Phrasing nit: WDYT about "... by subresource filtering rules"?

[engedy, 2017/03/06 17:46:13]

On second thought, let's hold off on printing the console message until we have
the final strings here.

[Charlie Harrison, 2017/03/06 19:22:12]

Done.

+                WarningMessageLevel,

[engedy, 2017/03/06 16:31:01]

Do we print anything else to the console other than this?  I wonder if this
should be a warning or error to be consistent with other failure modes.

[Charlie Harrison, 2017/03/06 19:22:12]

It does make more sense as an error level since we don't even initiate the
connection. I've changed it.

+                WTF::passed(SourceLocation::create(String(), 0, 0, nullptr))));
+    return true;
+  }
+
   // TODO(kinuko): document() should return nullptr if we don't
   // have valid document/frame that returns non-empty interface provider.
   if (document() && document()->frame() &&
@@ -681,6 +699,17 @@ void DocumentWebSocketChannel::didFailLoadingBlob(
   // |this| can be deleted here.
 }
 
+bool DocumentWebSocketChannel::shouldDisallowConnection(const KURL& url) {
+  DCHECK(m_handle);
+  DocumentLoader* loader = document()->loader();
+  if (!loader)
+    return false;
+  SubresourceFilter* subresourceFilter = loader->subresourceFilter();
+  if (!subresourceFilter)
+    return false;
+  return !subresourceFilter->allowWebSocketConnection(url);
+}
+
 DEFINE_TRACE(DocumentWebSocketChannel) {
   visitor->trace(m_blobLoader);
   visitor->trace(m_messages);