Use Referrer-Policy headers for CSS stylesheets

third_party/WebKit/Source/core/html/parser/CSSPreloadScanner.cpp

 /*
  * Copyright (C) 2008, 2010 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009 Torch Mobile, Inc. http://www.torchmobile.com/
  * Copyright (C) 2010 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 250 matching lines @@
       m_preloader(preloader),
       m_resource(toCSSStyleSheetResource(resource)) {
   m_resource->addClient(this, Resource::DontMarkAsReferenced);
 }
 
 CSSPreloaderResourceClient::~CSSPreloaderResourceClient() {}
 
 void CSSPreloaderResourceClient::setCSSStyleSheet(
     const String& href,
     const KURL& baseURL,
+    ReferrerPolicy referrerPolicy,
     const String& charset,
     const CSSStyleSheetResource*) {
   clearResource();
 }
 
 // Only attach for one appendData call, as that's where most imports will likely
 // be (according to spec).
 void CSSPreloaderResourceClient::didAppendFirstData(
     const CSSStyleSheetResource* resource) {
   if (m_preloader)
@@ skipping 14 matching lines @@
   // file/line information.
   // TODO(csharrison): If this becomes an issue the CSSPreloadScanner may be
   // augmented to take care of this case without performing an additional
   // copy.
   double startTime = monotonicallyIncreasingTimeMS();
   const String& chunk = resource->sheetText();
   if (chunk.isNull())
     return;
   CSSPreloadScanner cssPreloadScanner;
   PreloadRequestStream preloads;
   cssPreloadScanner.scan(chunk, SegmentedString(), preloads,

[estark, 2017/03/28 11:26:23]

I don't know this code very well, so I might be misunderstanding, but it looks
like these preload requests wouldn't get the Referrer-Policy header applied?

[jochen (gone - plz use gerrit), 2017/03/28 13:08:34]

Excellent catch!

I don't know that code either, so I wrote a test for it

                          resource->response().url());
   DEFINE_STATIC_LOCAL(CustomCountHistogram, cssScanTimeHistogram,
                       ("PreloadScanner.ExternalCSS.ScanTime", 1, 1000000, 50));
   cssScanTimeHistogram.count((monotonicallyIncreasingTimeMS() - startTime) *
                              1000);
   fetchPreloads(preloads);
 }
 
 void CSSPreloaderResourceClient::fetchPreloads(PreloadRequestStream& preloads) {
   if (preloads.size()) {
@@ skipping 30 matching lines @@
   m_resource.clear();
 }
 
 DEFINE_TRACE(CSSPreloaderResourceClient) {
   visitor->trace(m_preloader);
   visitor->trace(m_resource);
   StyleSheetResourceClient::trace(visitor);
 }
 
 }  // namespace blink