Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(898)

Unified Diff: components/subresource_filter/content/browser/subresource_filter_safe_browsing_client.h

Issue 2834543003: [subresource_filter] SB throttle can send multiple speculative requests. (Closed)
Patch Set: Remove UAF Created 3 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: components/subresource_filter/content/browser/subresource_filter_safe_browsing_client.h
diff --git a/components/subresource_filter/content/browser/subresource_filter_safe_browsing_client.h b/components/subresource_filter/content/browser/subresource_filter_safe_browsing_client.h
new file mode 100644
index 0000000000000000000000000000000000000000..19ae4321658475046fb461a4d43f02c3ffcff1c3
--- /dev/null
+++ b/components/subresource_filter/content/browser/subresource_filter_safe_browsing_client.h
@@ -0,0 +1,118 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_SUBRESOURCE_FILTER_CONTENT_BROWSER_SUBRESOURCE_FILTER_SAFE_BROWSING_CLIENT_H_
+#define COMPONENTS_SUBRESOURCE_FILTER_CONTENT_BROWSER_SUBRESOURCE_FILTER_SAFE_BROWSING_CLIENT_H_
+
+#include <memory>
+
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/weak_ptr.h"
+#include "components/safe_browsing_db/v4_local_database_manager.h"
+#include "url/gurl.h"
+
+namespace base {
+class SingleThreadTaskRunner;
+class Timer;
+} // namespace base
+
+namespace subresource_filter {
+
+class SubresourceFilterSafeBrowsingActivationThrottle;
+class SubresourceFilterSafeBrowsingClientRequest;
+
+// Created on the UI thread but used on the IO thread to communicate with the
+// safe browsing service.
+//
+// The class is expected to accompany a single navigation. If a check request
+// comes in for URL B while URL A is in flight, we cancel the check to URL A.
+//
+// Consumers of the class need some way of determining the order of requests, so
+// they send in request_ids which are paired with each check.
+class SubresourceFilterSafeBrowsingClient {
+ public:
+ SubresourceFilterSafeBrowsingClient(
+ std::unique_ptr<base::Timer> timer,
+ scoped_refptr<safe_browsing::SafeBrowsingDatabaseManager>
+ database_manager,
+ const base::WeakPtr<SubresourceFilterSafeBrowsingActivationThrottle>&
+ throttle,
+ scoped_refptr<base::SingleThreadTaskRunner> io_task_runner);
+
+ ~SubresourceFilterSafeBrowsingClient();
+
+ void CheckUrlOnIO(const GURL& url, int request_id);
+
+ void OnCheckBrowseUrlResult(
+ SubresourceFilterSafeBrowsingClientRequest* request,
+ safe_browsing::SBThreatType threat_type,
+ const safe_browsing::ThreatMetadata& metadata);
+
+ private:
+ // Only set from the default for testing.
+ std::unique_ptr<base::Timer> timer_;
+ std::unique_ptr<SubresourceFilterSafeBrowsingClientRequest> current_request_;
+
+ scoped_refptr<safe_browsing::SafeBrowsingDatabaseManager> database_manager_;
+
+ base::WeakPtr<SubresourceFilterSafeBrowsingActivationThrottle> throttle_;
+ scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner_;
+
+ DISALLOW_COPY_AND_ASSIGN(SubresourceFilterSafeBrowsingClient);
+};
+
+// This class is scoped to a single database check, and it lives on the IO
+// thread exclusively.
+class SubresourceFilterSafeBrowsingClientRequest
+ : public safe_browsing::SafeBrowsingDatabaseManager::Client {
+ public:
+ SubresourceFilterSafeBrowsingClientRequest(
+ base::Timer* timer,
+ const GURL& url,
+ int request_id,
+ scoped_refptr<safe_browsing::SafeBrowsingDatabaseManager>
+ database_manager,
+ SubresourceFilterSafeBrowsingClient* client);
+ ~SubresourceFilterSafeBrowsingClientRequest() override;
+
+ void Start();
+
+ void OnCheckBrowseUrlResult(
+ const GURL& url,
+ safe_browsing::SBThreatType threat_type,
+ const safe_browsing::ThreatMetadata& metadata) override;
+
+ const GURL& url() const { return url_; }
+
+ int request_id() const { return request_id_; }
+
+ // Maximum time in milliseconds to wait for the Safe Browsing service to
+ // verify a URL. After this amount of time the outstanding check will be
+ // aborted, and the URL will be treated as if it didn't belong to the
+ // Subresource Filter only list.
+ static constexpr base::TimeDelta kCheckURLTimeout =
+ base::TimeDelta::FromSeconds(5);
+
+ private:
+ // Callback for when the safe browsing check has taken longer than
+ // kCheckURLTimeout.
+ void OnCheckUrlTimeout();
+
+ const GURL url_;
+ const int request_id_;
+
+ scoped_refptr<safe_browsing::SafeBrowsingDatabaseManager> database_manager_;
+ SubresourceFilterSafeBrowsingClient* client_ = nullptr;
+
+ // Timer to abort the safe browsing check if it takes too long. Must outlive
+ // this class.
+ base::Timer* timer_;
+
+ DISALLOW_COPY_AND_ASSIGN(SubresourceFilterSafeBrowsingClientRequest);
+};
+
+} // namespace subresource_filter
+
+#endif // COMPONENTS_SUBRESOURCE_FILTER_CONTENT_BROWSER_SUBRESOURCE_FILTER_SAFE_BROWSING_CLIENT_H_

Powered by Google App Engine
This is Rietveld 408576698