Introduce support for origins that require process isolation.

content/browser/site_instance_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/site_instance_impl.h"
 
+#include "base/macros.h"

[Charlie Reis, 2017/05/25 01:54:37]

Is this still needed?

[alexmos, 2017/05/25 16:58:49]

No - removed.

 #include "base/memory/ptr_util.h"
 #include "content/browser/browsing_instance.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/common/site_isolation_policy.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host_factory.h"
@@ skipping 284 matching lines @@
   // If either URL is invalid, they aren't part of the same site.
   if (!src_url.is_valid() || !dest_url.is_valid())
     return false;
 
   // If the destination url is just a blank page, we treat them as part of the
   // same site.
   GURL blank_page(url::kAboutBlankURL);
   if (dest_url == blank_page)
     return true;
 
+  // If either URL has an isolated origin, compare origins rather than sites.
+  url::Origin src_origin(src_url);
+  url::Origin dest_origin(dest_url);
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  if (policy->IsIsolatedOrigin(src_origin) ||
+      policy->IsIsolatedOrigin(dest_origin))
+    return src_origin == dest_origin;
+
   // If the schemes differ, they aren't part of the same site.
+  //
+  // Note that this happens after the isolated origin check, since blob or
+  // filesystem URLs will fail this check even though they might have the
+  // same origin.

[Charlie Reis, 2017/05/25 01:54:37]

Now that you mention this, is this scheme check ever correct for blob or
filesystem URLs?  If you navigate from foo.com to a blob or filesystem URL on
foo.com, that should presumably be considered same-site even in the common case,
not just for isolated origins, right?

No need to fix that here (at the risk of larger regressions), but maybe this is
a bug we should fix?

[alexmos, 2017/05/25 16:58:49]

Yes, indeed, I think it's a bug and I need to investigate exactly what
consequences it might have.  Nasko and I discussed this some time back - I think
this might cause us to swap processes when we shouldn't, so unlikely to be a
security problem.  I filed https://crbug.com/726370 to follow up on this and
referenced it here.

   if (src_url.scheme() != dest_url.scheme())
     return false;
 
   return net::registry_controlled_domains::SameDomainOrHost(
       src_url,
       dest_url,
       net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
 }
 
 // static
 GURL SiteInstance::GetSiteForURL(BrowserContext* browser_context,
                                  const GURL& real_url) {
   // TODO(fsamuel, creis): For some reason appID is not recognized as a host.
   if (real_url.SchemeIs(kGuestScheme))
     return real_url;
 
   GURL url = SiteInstanceImpl::GetEffectiveURL(browser_context, real_url);
   url::Origin origin(url);
 
+  // Isolated origins should use the full origin as their site URL.
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  if (policy->IsIsolatedOrigin(origin))
+    return origin.GetURL();
+
   // If the url has a host, then determine the site.
   if (!origin.host().empty()) {
     // Only keep the scheme and registered domain of |origin|.
     std::string domain = net::registry_controlled_domains::GetDomainAndRegistry(
         origin.host(),
         net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
     std::string site = origin.scheme();
     site += url::kStandardSchemeSeparator;
     site += domain.empty() ? origin.host() : domain;
     return GURL(site);
   }
 
   // If there is no host but there is a scheme, return the scheme.
   // This is useful for cases like file URLs.
   if (url.has_scheme())
     return GURL(url.scheme() + ":");
 
   // Otherwise the URL should be invalid; return an empty site.
   DCHECK(!url.is_valid());
   return GURL();
 }
 
 // static
 GURL SiteInstanceImpl::GetEffectiveURL(BrowserContext* browser_context,
                                        const GURL& url) {
+  // Don't resolve URLs corresponding to isolated origins, as isolated origins
+  // take precedence over hosted apps.
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  if (policy->IsIsolatedOrigin(url::Origin(url)))
+    return url;
+
   return GetContentClient()->browser()->
       GetEffectiveURL(browser_context, url);
 }
 
 // static
 bool SiteInstanceImpl::DoesSiteRequireDedicatedProcess(
     BrowserContext* browser_context,
     const GURL& url) {
   // If --site-per-process is enabled, site isolation is enabled everywhere.
   if (SiteIsolationPolicy::UseDedicatedProcessesForAllSites())
     return true;
 
+  // For now, always require a dedicated process for isolated origins.
+  // TODO(alexmos): revisit this for Isolate-Me.
+  GURL site_url = GetSiteForURL(browser_context, url);
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  if (policy->IsIsolatedOrigin(url::Origin(site_url)))
+    return true;
+
   // Let the content embedder enable site isolation for specific URLs. Use the
   // canonical site url for this check, so that schemes with nested origins
   // (blob and filesystem) work properly.
-  GURL site_url = GetSiteForURL(browser_context, url);
   if (GetContentClient()->IsSupplementarySiteIsolationModeEnabled() &&
       GetContentClient()->browser()->DoesSiteRequireDedicatedProcess(
           browser_context, site_url)) {
     return true;
   }
 
   return false;
 }
 
 void SiteInstanceImpl::RenderProcessHostDestroyed(RenderProcessHost* host) {
@@ skipping 44 matching lines @@
             browsing_instance_->browser_context(), site_))
       return;
 
     ChildProcessSecurityPolicyImpl* policy =
         ChildProcessSecurityPolicyImpl::GetInstance();
     policy->LockToOrigin(process_->GetID(), site_);
   }
 }
 
 }  // namespace content