Do not send pings for anchor elements in MHTML pages

third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights
  * reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 19 matching lines @@
 #include "core/frame/LocalFrameClient.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
 #include "core/html/HTMLImageElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/layout/LayoutBox.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/loader/PingLoader.h"
 #include "core/page/ChromeClient.h"
 #include "core/page/Page.h"
+#include "platform/loader/fetch/ResourceFetcher.h"
 #include "platform/network/NetworkHints.h"
 #include "platform/weborigin/SecurityPolicy.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tag_name,
                                      Document& document)
     : HTMLElement(tag_name, document),
@@ skipping 248 matching lines @@
 bool HTMLAnchorElement::IsLiveLink() const {
   return IsLink() && !HasEditableStyle(*this);
 }
 
 void HTMLAnchorElement::SendPings(const KURL& destination_url) const {
   const AtomicString& ping_value = getAttribute(pingAttr);
   if (ping_value.IsNull() || !GetDocument().GetSettings() ||
       !GetDocument().GetSettings()->GetHyperlinkAuditingEnabled())
     return;
 
+  // Pings should not be sent if MHTML page is loaded.
+  if (GetDocument().Fetcher()->Archive())
+    return;

[Mike West, 2017/05/02 07:43:21]

What about other things that go through `PingLoader`? (CSP violations, XSS
Auditor violations, Beacon) I guess you're blocking those as well, but it might
make your checks a little more robust to do them there (e.g. in
`SendBeaconCommon`:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/loader/Pi...).

[jianli, 2017/05/03 21:15:17]

I don't think other types of pings/beacons can be triggered from loaded MHTML:
* "report-uri" in Content-Security-Policy cannot be put in meta tag. Thus CSP
violations will not be sent.
* XSS auditor reports can only be triggered by providing XSS protection header
from server. Thus MHTML will not have this problem.
* Navigator.sendBeacon can only be called from the script. Since the script
execution is disabled in MHTML, this will not be likely.

It seems that we only have problem with anchor pings. So I don't want to
complicate PingLoader logic.

+
   UseCounter::Count(GetDocument(), UseCounter::kHTMLAnchorElementPingAttribute);
 
   SpaceSplitString ping_urls(ping_value, SpaceSplitString::kShouldNotFoldCase);
   for (unsigned i = 0; i < ping_urls.size(); i++)
     PingLoader::SendLinkAuditPing(GetDocument().GetFrame(),
                                   GetDocument().CompleteURL(ping_urls[i]),
                                   destination_url);
 }
 
 void HTMLAnchorElement::HandleClick(Event* event) {
@@ skipping 83 matching lines @@
 
 Node::InsertionNotificationRequest HTMLAnchorElement::InsertedInto(
     ContainerNode* insertion_point) {
   InsertionNotificationRequest request =
       HTMLElement::InsertedInto(insertion_point);
   LogAddElementIfIsolatedWorldAndInDocument("a", hrefAttr);
   return request;
 }
 
 }  // namespace blink