Use Referrer-Policy headers for CSS stylesheets

third_party/WebKit/Source/core/loader/resource/CSSStyleSheetResource.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
     Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 10 matching lines @@
     Boston, MA 02110-1301, USA.
 
     This class provides all functionality needed for loading images, style
     sheets and html pages from the web. It has a memory cache for these objects.
 */
 
 #include "core/loader/resource/CSSStyleSheetResource.h"
 
 #include "core/css/StyleSheetContents.h"
 #include "core/loader/resource/StyleSheetResourceClient.h"
+#include "platform/HTTPNames.h"
 #include "platform/SharedBuffer.h"
 #include "platform/loader/fetch/FetchRequest.h"
 #include "platform/loader/fetch/MemoryCache.h"
 #include "platform/loader/fetch/ResourceClientWalker.h"
 #include "platform/loader/fetch/ResourceFetcher.h"
+#include "platform/weborigin/SecurityPolicy.h"
 #include "wtf/CurrentTime.h"
 
 namespace blink {
 
 CSSStyleSheetResource* CSSStyleSheetResource::fetch(FetchRequest& request,
                                                     ResourceFetcher* fetcher) {
   DCHECK_EQ(request.resourceRequest().frameType(),
             WebURLRequest::FrameTypeNone);
   request.setRequestContext(WebURLRequest::RequestContextStyle);
   CSSStyleSheetResource* resource = toCSSStyleSheetResource(
@@ skipping 46 matching lines @@
   // setCSSStyleSheet() may cause scripts to be executed, which could destroy
   // 'c' if it is an instance of HTMLLinkElement. see the comment of
   // HTMLLinkElement::setCSSStyleSheet.
   Resource::didAddClient(c);
 
   if (hasClient(c) && m_didNotifyFirstData)
     static_cast<StyleSheetResourceClient*>(c)->didAppendFirstData(this);
 
   // |c| might be removed in didAppendFirstData, so ensure it is still a client.
   if (hasClient(c) && !isLoading()) {
+    ReferrerPolicy referrerPolicy = ReferrerPolicyDefault;
+    String referrerPolicyHeader =
+        response().httpHeaderField(HTTPNames::Referrer_Policy);
+    if (!referrerPolicyHeader.isNull()) {
+      SecurityPolicy::referrerPolicyFromHeaderValue(
+          referrerPolicyHeader, DoNotSupportReferrerPolicyLegacyKeywords,
+          &referrerPolicy);
+    }
     static_cast<StyleSheetResourceClient*>(c)->setCSSStyleSheet(
-        resourceRequest().url(), response().url(), encoding(), this);
+        resourceRequest().url(), response().url(), referrerPolicy, encoding(),
+        this);
   }
 }
 
 const String CSSStyleSheetResource::sheetText(
     MIMETypeCheck mimeTypeCheck) const {
   if (!canUseSheet(mimeTypeCheck))
     return String();
 
   // Use cached decoded sheet text when available
   if (!m_decodedSheetText.isNull()) {
@@ skipping 18 matching lines @@
   while (StyleSheetResourceClient* c = w.next())
     c->didAppendFirstData(this);
   m_didNotifyFirstData = true;
 }
 
 void CSSStyleSheetResource::checkNotify() {
   // Decode the data to find out the encoding and cache the decoded sheet text.
   if (data())
     setDecodedSheetText(decodedText());
 
+  ReferrerPolicy referrerPolicy = ReferrerPolicyDefault;
+  String referrerPolicyHeader =
+      response().httpHeaderField(HTTPNames::Referrer_Policy);
+  if (!referrerPolicyHeader.isNull()) {
+    SecurityPolicy::referrerPolicyFromHeaderValue(
+        referrerPolicyHeader, DoNotSupportReferrerPolicyLegacyKeywords,
+        &referrerPolicy);
+  }
+
   ResourceClientWalker<StyleSheetResourceClient> w(clients());
   while (StyleSheetResourceClient* c = w.next()) {
     markClientFinished(c);
-    c->setCSSStyleSheet(resourceRequest().url(), response().url(), encoding(),
-                        this);
+    c->setCSSStyleSheet(resourceRequest().url(), response().url(),
+                        referrerPolicy, encoding(), this);
   }
 
   // Clear raw bytes as now we have the full decoded sheet text.
   // We wait for all LinkStyle::setCSSStyleSheet to run (at least once)
   // as SubresourceIntegrity checks require raw bytes.
   // Note that LinkStyle::setCSSStyleSheet can be called from didAddClient too,
   // but is safe as we should have a cached ResourceIntegrityDisposition.
   clearData();
 }
 
@@ skipping 67 matching lines @@
 }
 
 void CSSStyleSheetResource::updateDecodedSize() {
   size_t decodedSize = m_decodedSheetText.charactersSizeInBytes();
   if (m_parsedStyleSheetCache)
     decodedSize += m_parsedStyleSheetCache->estimatedSizeInBytes();
   setDecodedSize(decodedSize);
 }
 
 }  // namespace blink