Split CSP into pre- and post-upgrade checks

third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 668 matching lines @@
       type, resource_request, url, options, reporting_policy,
       origin_restriction, resource_request.GetRedirectStatus());
   if (blocked_reason != ResourceRequestBlockedReason::kNone &&
       reporting_policy == SecurityViolationReportingPolicy::kReport) {
     probe::didBlockRequest(GetFrame(), resource_request, MasterDocumentLoader(),
                            options.initiator_info, blocked_reason);
   }
   return blocked_reason;
 }
 
+ResourceRequestBlockedReason FrameFetchContext::CanFollowRedirect(
+    Resource::Type type,
+    const ResourceRequest& resource_request,
+    const KURL& url,
+    const ResourceLoaderOptions& options,
+    SecurityViolationReportingPolicy reporting_policy,
+    FetchParameters::OriginRestriction origin_restriction) const {
+  // CanRequestInternal checks enforced CSP, so check report-only here to ensure
+  // that violations are sent.
+  CheckCSPForRequest(resource_request, url, options, reporting_policy,
+                     RedirectStatus::kFollowedRedirect,
+                     ContentSecurityPolicy::CheckHeaderType::kCheckReportOnly);
+  return CanRequest(type, resource_request, url, options, reporting_policy,
+                    origin_restriction);
+}
+
 ResourceRequestBlockedReason FrameFetchContext::AllowResponse(
     Resource::Type type,
     const ResourceRequest& resource_request,
     const KURL& url,
     const ResourceLoaderOptions& options) const {
+  // canRequestInternal only checks enforced policies: check report-only here
+  // to ensure violations are sent.
+  CheckCSPForRequest(resource_request, url, options,
+                     SecurityViolationReportingPolicy::kReport,
+                     RedirectStatus::kFollowedRedirect,
+                     ContentSecurityPolicy::CheckHeaderType::kCheckReportOnly);
   ResourceRequestBlockedReason blocked_reason =
       CanRequestInternal(type, resource_request, url, options,
                          SecurityViolationReportingPolicy::kReport,
                          FetchParameters::kUseDefaultOriginRestrictionForType,
                          RedirectStatus::kFollowedRedirect);
   if (blocked_reason != ResourceRequestBlockedReason::kNone) {
     probe::didBlockRequest(GetFrame(), resource_request, MasterDocumentLoader(),
                            options.initiator_info, blocked_reason);
   }
   return blocked_reason;
@@ skipping 53 matching lines @@
     case Resource::kXSLStyleSheet:
       DCHECK(RuntimeEnabledFeatures::xsltEnabled());
     case Resource::kSVGDocument:
       if (!security_origin->CanRequest(url)) {
         PrintAccessDeniedMessage(url);
         return ResourceRequestBlockedReason::kOrigin;
       }
       break;
   }
 
-  // FIXME: Convert this to check the isolated world's Content Security Policy
-  // once webkit.org/b/104520 is solved.
-  bool should_bypass_main_world_csp =
-      GetFrame()->GetScriptController().ShouldBypassMainWorldCSP() ||
-      options.content_security_policy_option ==
-          kDoNotCheckContentSecurityPolicy;
-
-  if (document_) {
-    DCHECK(document_->GetContentSecurityPolicy());
-    if (!should_bypass_main_world_csp &&
-        !document_->GetContentSecurityPolicy()->AllowRequest(
-            resource_request.GetRequestContext(), url,
-            options.content_security_policy_nonce, options.integrity_metadata,
-            options.parser_disposition, redirect_status, reporting_policy))
-      return ResourceRequestBlockedReason::CSP;
+  // We check the 'report-only' headers before upgrading the request (in
+  // populateResourceRequest). We check the enforced headers here to ensure we
+  // block things we ought to block.
+  if (CheckCSPForRequest(
+          resource_request, url, options, reporting_policy, redirect_status,
+          ContentSecurityPolicy::CheckHeaderType::kCheckEnforce) ==
+      ResourceRequestBlockedReason::CSP) {
+    return ResourceRequestBlockedReason::CSP;
   }
 
   if (type == Resource::kScript || type == Resource::kImportResource) {
     DCHECK(GetFrame());
     if (!GetContentSettingsClient()->AllowScriptFromSource(
             !GetFrame()->GetSettings() ||
                 GetFrame()->GetSettings()->GetScriptEnabled(),
             url)) {
       GetContentSettingsClient()->DidNotAllowScript();
       // TODO(estark): Use a different ResourceRequestBlockedReason here, since
@@ skipping 67 matching lines @@
       type != Resource::kMainResource && type != Resource::kImportResource) {
     if (!document_loader->GetSubresourceFilter()->AllowLoad(
             url, resource_request.GetRequestContext(), reporting_policy)) {
       return ResourceRequestBlockedReason::kSubresourceFilter;
     }
   }
 
   return ResourceRequestBlockedReason::kNone;
 }
 
+ResourceRequestBlockedReason FrameFetchContext::CheckCSPForRequest(
+    const ResourceRequest& resource_request,
+    const KURL& url,
+    const ResourceLoaderOptions& options,
+    SecurityViolationReportingPolicy reporting_policy,
+    ResourceRequest::RedirectStatus redirect_status,
+    ContentSecurityPolicy::CheckHeaderType check_header_type) const {
+  if (GetFrame()->GetScriptController().ShouldBypassMainWorldCSP() ||
+      options.content_security_policy_option ==
+          kDoNotCheckContentSecurityPolicy) {
+    return ResourceRequestBlockedReason::kNone;
+  }
+
+  if (document_) {
+    DCHECK(document_->GetContentSecurityPolicy());
+    if (!document_->GetContentSecurityPolicy()->AllowRequest(
+            resource_request.GetRequestContext(), url,
+            options.content_security_policy_nonce, options.integrity_metadata,
+            options.parser_disposition, redirect_status, reporting_policy,
+            check_header_type))
+      return ResourceRequestBlockedReason::CSP;
+  }
+  return ResourceRequestBlockedReason::kNone;
+}
+
 bool FrameFetchContext::IsControlledByServiceWorker() const {
   DCHECK(MasterDocumentLoader());
 
   // Service workers are bypassed by suborigins (see
   // https://w3c.github.io/webappsec-suborigins/). Since service worker
   // controllers are assigned based on physical origin, without knowledge of
   // whether the context is in a suborigin, it is necessary to explicitly bypass
   // service workers on a per-request basis. Additionally, it is necessary to
   // explicitly return |false| here so that it is clear that the SW will be
   // bypassed. In particular, this is important for
@@ skipping 120 matching lines @@
                                                 ResourceRequest& request) {
   if (!document_)
     return;
 
   const ContentSecurityPolicy* csp = document_->GetContentSecurityPolicy();
   if (csp->ShouldSendCSPHeader(type))
     request.AddHTTPHeaderField("CSP", "active");
 }
 
 void FrameFetchContext::PopulateResourceRequest(
+    const KURL& url,
     Resource::Type type,
     const ClientHintsPreferences& hints_preferences,
     const FetchParameters::ResourceWidth& resource_width,
+    const ResourceLoaderOptions& options,
+    SecurityViolationReportingPolicy reporting_policy,
     ResourceRequest& request) {
   SetFirstPartyCookieAndRequestorOrigin(request);
+
+  // Before modifying the request for CSP, evaluate report-only headers. This
+  // allows site owners to learn about requests that are being modified
+  // (e.g. mixed content that is being upgraded by upgrade-insecure-requests).
+  CheckCSPForRequest(request, url, options, reporting_policy,
+                     request.GetRedirectStatus(),
+                     ContentSecurityPolicy::CheckHeaderType::kCheckReportOnly);
+
   ModifyRequestForCSP(request);
   AddClientHintsIfNecessary(hints_preferences, resource_width, request);
   AddCSPHeaderIfNecessary(type, request);
 }
 
 void FrameFetchContext::SetFirstPartyCookieAndRequestorOrigin(
     ResourceRequest& request) {
   if (!document_)
     return;
 
@@ skipping 51 matching lines @@
   return GetFrame()->FrameScheduler()->LoadingTaskRunner();
 }
 
 DEFINE_TRACE(FrameFetchContext) {
   visitor->Trace(document_);
   visitor->Trace(document_loader_);
   FetchContext::Trace(visitor);
 }
 
 }  // namespace blink