Use Referrer-Policy headers for CSS stylesheets

third_party/WebKit/Source/core/html/parser/CSSPreloadScanner.cpp

 /*
  * Copyright (C) 2008, 2010 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009 Torch Mobile, Inc. http://www.torchmobile.com/
  * Copyright (C) 2010 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "core/html/parser/CSSPreloadScanner.h"
 
+#include <memory>
 #include "core/dom/Document.h"
 #include "core/frame/Settings.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/html/parser/HTMLResourcePreloader.h"
 #include "core/loader/DocumentLoader.h"
 #include "core/loader/resource/CSSStyleSheetResource.h"
+#include "platform/HTTPNames.h"
 #include "platform/Histogram.h"
 #include "platform/loader/fetch/FetchInitiatorTypeNames.h"
 #include "platform/text/SegmentedString.h"
-#include <memory>
+#include "platform/weborigin/SecurityPolicy.h"
 
 namespace blink {
 
 CSSPreloadScanner::CSSPreloadScanner() {}
 
 CSSPreloadScanner::~CSSPreloadScanner() {}
 
 void CSSPreloadScanner::reset() {
   m_state = Initial;
   m_rule.clear();
@@ skipping 211 matching lines @@
       m_preloader(preloader),
       m_resource(toCSSStyleSheetResource(resource)) {
   m_resource->addClient(this, Resource::DontMarkAsReferenced);
 }
 
 CSSPreloaderResourceClient::~CSSPreloaderResourceClient() {}
 
 void CSSPreloaderResourceClient::setCSSStyleSheet(
     const String& href,
     const KURL& baseURL,
+    ReferrerPolicy referrerPolicy,
     const String& charset,
     const CSSStyleSheetResource*) {
   clearResource();
 }
 
 // Only attach for one appendData call, as that's where most imports will likely
 // be (according to spec).
 void CSSPreloaderResourceClient::didAppendFirstData(
     const CSSStyleSheetResource* resource) {
   if (m_preloader)
@@ skipping 13 matching lines @@
   // Passing an empty SegmentedString here results in PreloadRequest with no
   // file/line information.
   // TODO(csharrison): If this becomes an issue the CSSPreloadScanner may be
   // augmented to take care of this case without performing an additional
   // copy.
   double startTime = monotonicallyIncreasingTimeMS();
   const String& chunk = resource->sheetText();
   if (chunk.isNull())
     return;
   CSSPreloadScanner cssPreloadScanner;
+
+  ReferrerPolicy referrerPolicy = ReferrerPolicyDefault;
+  String referrerPolicyHeader =
+      resource->response().httpHeaderField(HTTPNames::Referrer_Policy);
+  if (!referrerPolicyHeader.isNull()) {
+    SecurityPolicy::referrerPolicyFromHeaderValue(
+        referrerPolicyHeader, DoNotSupportReferrerPolicyLegacyKeywords,
+        &referrerPolicy);
+  }
+  cssPreloadScanner.setReferrerPolicy(referrerPolicy);

[estark, 2017/03/28 18:17:21]

Hmmm... I think this will end up using the document's URL as the referrer URL:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/html/pars...

Maybe the preload scanner needs a setReferrerURL() in addition to
setReferrerPolicy()?

[jochen (gone - plz use gerrit), 2017/03/28 18:49:37]

I changed that code (see two files down)

[estark, 2017/03/28 18:59:53]

Doh, sorry!

   PreloadRequestStream preloads;
   cssPreloadScanner.scan(chunk, SegmentedString(), preloads,
                          resource->response().url());
   DEFINE_STATIC_LOCAL(CustomCountHistogram, cssScanTimeHistogram,
                       ("PreloadScanner.ExternalCSS.ScanTime", 1, 1000000, 50));
   cssScanTimeHistogram.count((monotonicallyIncreasingTimeMS() - startTime) *
                              1000);
   fetchPreloads(preloads);
 }
 
@@ skipping 32 matching lines @@
   m_resource.clear();
 }
 
 DEFINE_TRACE(CSSPreloaderResourceClient) {
   visitor->trace(m_preloader);
   visitor->trace(m_resource);
   StyleSheetResourceClient::trace(visitor);
 }
 
 }  // namespace blink