[CacheStorage] Pad and bin opaque resource sizes.

content/browser/cache_storage/cache_storage_cache.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/cache_storage/cache_storage_cache.h"
 
 #include <stddef.h>
 #include <algorithm>
+#include <functional>
 #include <limits>
 #include <memory>
 #include <string>
 #include <utility>
 
 #include "base/barrier_closure.h"
 #include "base/bind_helpers.h"
 #include "base/files/file_path.h"
 #include "base/guid.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/cache_storage/cache_storage.pb.h"
 #include "content/browser/cache_storage/cache_storage_blob_to_disk_cache.h"
 #include "content/browser/cache_storage/cache_storage_cache_handle.h"
 #include "content/browser/cache_storage/cache_storage_cache_observer.h"
 #include "content/browser/cache_storage/cache_storage_scheduler.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/referrer.h"
+#include "crypto/hmac.h"
+#include "crypto/symmetric_key.h"
 #include "net/base/completion_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/disk_cache/disk_cache.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "storage/browser/blob/blob_data_builder.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/blob/blob_url_request_job_factory.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
@@ skipping 206 matching lines @@
       metadata.response().status_text(),
       ProtoResponseTypeToWebResponseType(metadata.response().response_type()),
       std::move(headers), "", 0, blink::kWebServiceWorkerResponseErrorUnknown,
       base::Time::FromInternalValue(metadata.response().response_time()),
       true /* is_in_cache_storage */, cache_name,
       base::MakeUnique<ServiceWorkerHeaderList>(
           metadata.response().cors_exposed_header_names().begin(),
           metadata.response().cors_exposed_header_names().end()));
 }
 
+// The size of opaque (non-cors) resource responses are padded in order
+// to obfuscate their actual size.
+bool ShouldPadResourceSize(const ServiceWorkerResponse& response) {
+  switch (response.response_type) {
+    case blink::kWebServiceWorkerResponseTypeBasic:
+    case blink::kWebServiceWorkerResponseTypeCORS:
+    case blink::kWebServiceWorkerResponseTypeDefault:
+    case blink::kWebServiceWorkerResponseTypeError:
+      return false;
+    case blink::kWebServiceWorkerResponseTypeOpaque:
+    case blink::kWebServiceWorkerResponseTypeOpaqueRedirect:
+      return !response.url_list.empty();
+  }
+  NOTREACHED();
+  return false;
+}
+
 }  // namespace
 
 // The state needed to pass between CacheStorageCache::Put callbacks.
 struct CacheStorageCache::PutContext {
   PutContext(std::unique_ptr<ServiceWorkerFetchRequest> request,
              std::unique_ptr<ServiceWorkerResponse> response,
              std::unique_ptr<storage::BlobDataHandle> blob_data_handle,
              const CacheStorageCache::ErrorCallback& callback)
       : request(std::move(request)),
         response(std::move(response)),
@@ skipping 17 matching lines @@
   std::unique_ptr<ServiceWorkerFetchRequest> request;
   std::unique_ptr<ServiceWorkerResponse> response;
   std::unique_ptr<storage::BlobDataHandle> blob_handle;
   disk_cache::ScopedEntryPtr entry;
   base::Time entry_time;
 };
 
 struct CacheStorageCache::QueryCacheContext {
   QueryCacheContext(std::unique_ptr<ServiceWorkerFetchRequest> request,
                     const CacheStorageCacheQueryParams& options,
-                    const QueryCacheCallback& callback)
+                    const QueryCacheCallback& callback,
+                    uint32_t query_types)
       : request(std::move(request)),
         options(options),
         callback(callback),
+        query_types(query_types),
         matches(base::MakeUnique<QueryCacheResults>()) {}
 
   ~QueryCacheContext() {
     // If the CacheStorageCache is deleted before a backend operation to open
     // an entry completes, the callback won't be run and the resulting entry
     // will be leaked unless we close it here.
     if (enumerated_entry) {
       enumerated_entry->Close();
       enumerated_entry = nullptr;
     }
   }
 
   // Input to QueryCache
   std::unique_ptr<ServiceWorkerFetchRequest> request;
   CacheStorageCacheQueryParams options;
   QueryCacheCallback callback;
-  QueryCacheType query_type;
+  uint32_t query_types = 0x0;
   size_t estimated_out_bytes = 0;
 
   // Iteration state
   std::unique_ptr<disk_cache::Backend::Iterator> backend_iterator;
   disk_cache::Entry* enumerated_entry = nullptr;
 
   // Output of QueryCache
   std::unique_ptr<std::vector<QueryCacheResult>> matches;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(QueryCacheContext);
 };
 
 // static
 std::unique_ptr<CacheStorageCache> CacheStorageCache::CreateMemoryCache(
     const GURL& origin,
     const std::string& cache_name,
     CacheStorage* cache_storage,
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     scoped_refptr<storage::QuotaManagerProxy> quota_manager_proxy,
-    base::WeakPtr<storage::BlobStorageContext> blob_context) {
+    base::WeakPtr<storage::BlobStorageContext> blob_context,
+    std::unique_ptr<crypto::SymmetricKey> cache_padding_key) {
   CacheStorageCache* cache = new CacheStorageCache(
       origin, cache_name, base::FilePath(), cache_storage,
       std::move(request_context_getter), std::move(quota_manager_proxy),
-      blob_context, 0 /* cache_size */);
+      blob_context, 0 /* cache_size */, 0 /* cache_padding */,
+      std::move(cache_padding_key));
   cache->SetObserver(cache_storage);
   cache->InitBackend();
   return base::WrapUnique(cache);
 }
 
 // static
 std::unique_ptr<CacheStorageCache> CacheStorageCache::CreatePersistentCache(
     const GURL& origin,
     const std::string& cache_name,
     CacheStorage* cache_storage,
     const base::FilePath& path,
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     scoped_refptr<storage::QuotaManagerProxy> quota_manager_proxy,
     base::WeakPtr<storage::BlobStorageContext> blob_context,
-    int64_t cache_size) {
+    int64_t cache_size,
+    int64_t cache_padding,
+    std::unique_ptr<crypto::SymmetricKey> cache_padding_key) {
   CacheStorageCache* cache = new CacheStorageCache(
       origin, cache_name, path, cache_storage,
       std::move(request_context_getter), std::move(quota_manager_proxy),
-      blob_context, cache_size);
+      blob_context, cache_size, cache_padding, std::move(cache_padding_key));
   cache->SetObserver(cache_storage), cache->InitBackend();
   return base::WrapUnique(cache);
 }
 
 base::WeakPtr<CacheStorageCache> CacheStorageCache::AsWeakPtr() {
   return weak_ptr_factory_.GetWeakPtr();
 }
 
 void CacheStorageCache::Match(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
@@ skipping 211 matching lines @@
 }
 
 CacheStorageCache::CacheStorageCache(
     const GURL& origin,
     const std::string& cache_name,
     const base::FilePath& path,
     CacheStorage* cache_storage,
     scoped_refptr<net::URLRequestContextGetter> request_context_getter,
     scoped_refptr<storage::QuotaManagerProxy> quota_manager_proxy,
     base::WeakPtr<storage::BlobStorageContext> blob_context,
-    int64_t cache_size)
+    int64_t cache_size,
+    int64_t cache_padding,
+    std::unique_ptr<crypto::SymmetricKey> cache_padding_key)
     : origin_(origin),
       cache_name_(cache_name),
       path_(path),
       cache_storage_(cache_storage),
       request_context_getter_(std::move(request_context_getter)),
       quota_manager_proxy_(std::move(quota_manager_proxy)),
       blob_storage_context_(blob_context),
       scheduler_(
           new CacheStorageScheduler(CacheStorageSchedulerClient::CLIENT_CACHE)),
       cache_size_(cache_size),
+      cache_padding_(cache_padding),
+      cache_padding_key_(std::move(cache_padding_key)),
       max_query_size_bytes_(kMaxQueryCacheResultBytes),
       cache_observer_(nullptr),
       memory_only_(path.empty()),
       weak_ptr_factory_(this) {
   DCHECK(!origin_.is_empty());
   DCHECK(quota_manager_proxy_.get());
+  DCHECK(cache_padding_key_.get());
 
   quota_manager_proxy_->NotifyOriginInUse(origin_);
 }
 
 void CacheStorageCache::QueryCache(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& options,
-    QueryCacheType query_type,
+    uint32_t query_types,
     const QueryCacheCallback& callback) {
-  DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
-  if (backend_state_ != BACKEND_OPEN) {
+  DCHECK_NE(
+      QUERY_CACHE_ENTRIES | QUERY_CACHE_RESPONSES_WITH_BODIES,
+      query_types & (QUERY_CACHE_ENTRIES | QUERY_CACHE_RESPONSES_WITH_BODIES));
+  if (backend_state_ == BACKEND_CLOSED) {
     callback.Run(CACHE_STORAGE_ERROR_STORAGE,
                  std::unique_ptr<QueryCacheResults>());
     return;
   }
 
   if (!options.ignore_method && request && !request->method.empty() &&
       request->method != "GET") {
     callback.Run(CACHE_STORAGE_OK, base::MakeUnique<QueryCacheResults>());
     return;
   }
 
   ServiceWorkerFetchRequest* request_ptr = request.get();
-  std::unique_ptr<QueryCacheContext> query_cache_context(
-      new QueryCacheContext(std::move(request), options, callback));
-  query_cache_context->query_type = query_type;
+  std::unique_ptr<QueryCacheContext> query_cache_context(new QueryCacheContext(
+      std::move(request), options, callback, query_types));
 
   if (query_cache_context->request &&
       !query_cache_context->request->url.is_empty() && !options.ignore_search) {
     // There is no need to scan the entire backend, just open the exact
     // URL.
     disk_cache::Entry** entry_ptr = &query_cache_context->enumerated_entry;
     net::CompletionCallback open_entry_callback =
         base::Bind(&CacheStorageCache::QueryCacheDidOpenFastPath,
                    weak_ptr_factory_.GetWeakPtr(),
                    base::Passed(std::move(query_cache_context)));
@@ skipping 60 matching lines @@
   if (rv < 0) {
     QueryCacheCallback callback = query_cache_context->callback;
     callback.Run(CACHE_STORAGE_ERROR_STORAGE,
                  std::move(query_cache_context->matches));
     return;
   }
 
   disk_cache::ScopedEntryPtr entry(query_cache_context->enumerated_entry);
   query_cache_context->enumerated_entry = nullptr;
 
-  if (backend_state_ != BACKEND_OPEN) {
+  if (backend_state_ == BACKEND_CLOSED) {
     QueryCacheCallback callback = query_cache_context->callback;
     callback.Run(CACHE_STORAGE_ERROR_NOT_FOUND,
                  std::move(query_cache_context->matches));
     return;
   }
 
   if (query_cache_context->request &&
       !query_cache_context->request->url.is_empty()) {
     GURL requestURL = query_cache_context->request->url;
     GURL cachedURL = GURL(entry->GetKey());
@@ skipping 41 matching lines @@
 
   if (query_cache_context->request &&
       !query_cache_context->options.ignore_vary &&
       !VaryMatches(query_cache_context->request->headers,
                    match->request->headers, match->response->headers)) {
     query_cache_context->matches->pop_back();
     QueryCacheOpenNextEntry(std::move(query_cache_context));
     return;
   }
 
-  if (query_cache_context->query_type == QueryCacheType::CACHE_ENTRIES) {
+  if (query_cache_context->query_types & QUERY_CACHE_ENTRIES)
+    match->entry = std::move(entry);
+
+  if (query_cache_context->query_types & QUERY_CACHE_REQUESTS) {
+    query_cache_context->estimated_out_bytes +=
+        match->request->EstimatedStructSize();
+    if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
+      query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
+                                        std::unique_ptr<QueryCacheResults>());
+      return;
+    }
+  } else {
     match->request.reset();
-    match->response.reset();
-    match->entry = std::move(entry);
-    QueryCacheOpenNextEntry(std::move(query_cache_context));
-    return;
   }
 
-  query_cache_context->estimated_out_bytes +=
-      match->request->EstimatedStructSize();
-  if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
-    query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
-                                      std::unique_ptr<QueryCacheResults>());
-    return;
+  if (query_cache_context->query_types & QUERY_CACHE_RESPONSES_WITH_BODIES) {
+    query_cache_context->estimated_out_bytes +=
+        match->response->EstimatedStructSize();
+    if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
+      query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
+                                        std::unique_ptr<QueryCacheResults>());
+      return;
+    }
+    if (entry->GetDataSize(INDEX_RESPONSE_BODY) == 0) {
+      QueryCacheOpenNextEntry(std::move(query_cache_context));
+      return;
+    }
+
+    if (!blob_storage_context_) {
+      query_cache_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE,
+                                        std::unique_ptr<QueryCacheResults>());
+      return;
+    }
+
+    std::unique_ptr<storage::BlobDataHandle> blob_data_handle =
+        PopulateResponseBody(std::move(entry), match->response.get());
+    match->blob_handle = std::move(blob_data_handle);
+  } else if (!(query_cache_context->query_types &
+               QUERY_CACHE_RESPONSES_NO_BODIES)) {
+    match->response.reset();
   }
 
-  if (query_cache_context->query_type == QueryCacheType::REQUESTS) {
-    match->response.reset();
-    QueryCacheOpenNextEntry(std::move(query_cache_context));
-    return;
-  }
-
-  DCHECK_EQ(QueryCacheType::REQUESTS_AND_RESPONSES,
-            query_cache_context->query_type);
-
-  query_cache_context->estimated_out_bytes +=
-      match->response->EstimatedStructSize();
-  if (query_cache_context->estimated_out_bytes > max_query_size_bytes_) {
-    query_cache_context->callback.Run(CACHE_STORAGE_ERROR_QUERY_TOO_LARGE,
-                                      std::unique_ptr<QueryCacheResults>());
-    return;
-  }
-
-  if (entry->GetDataSize(INDEX_RESPONSE_BODY) == 0) {
-    QueryCacheOpenNextEntry(std::move(query_cache_context));
-    return;
-  }
-
-  if (!blob_storage_context_) {
-    query_cache_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE,
-                                      base::MakeUnique<QueryCacheResults>());
-    return;
-  }
-
-  std::unique_ptr<storage::BlobDataHandle> blob_data_handle =
-      PopulateResponseBody(std::move(entry), match->response.get());
-  match->blob_handle = std::move(blob_data_handle);
-
   QueryCacheOpenNextEntry(std::move(query_cache_context));
 }
 
 // static
 bool CacheStorageCache::QueryCacheResultCompare(const QueryCacheResult& lhs,
                                                 const QueryCacheResult& rhs) {
   return lhs.entry_time < rhs.entry_time;
 }
 
+// static
+int64_t CacheStorageCache::CalculateResponsePadding(
+    const ServiceWorkerResponse& response,
+    const crypto::SymmetricKey* padding_key) {
+  const uint64_t kPaddingRange = 400 * 1024;
+
+  if (!ShouldPadResourceSize(response))
+    return 0;
+
+  const std::string& url = response.url_list.back().spec();
+  crypto::HMAC hmac(crypto::HMAC::SHA256);
+  std::vector<uint8_t> digest(hmac.DigestLength());
+  if (!hmac.Init(padding_key) || !hmac.Sign(url, &digest[0], digest.size())) {
+    LOG(FATAL) << "Failed to calculate HMAC.";
+  }
+  uint64_t val = *(reinterpret_cast<uint64_t*>(&digest[0]));
+  return val % kPaddingRange;
+}
+
 void CacheStorageCache::MatchImpl(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& match_params,
     const ResponseCallback& callback) {
   MatchAllImpl(std::move(request), match_params,
                base::Bind(&CacheStorageCache::MatchDidMatchAll,
                           weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void CacheStorageCache::MatchDidMatchAll(
@@ skipping 26 matching lines @@
     const CacheStorageCacheQueryParams& options,
     const ResponsesCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
   if (backend_state_ != BACKEND_OPEN) {
     callback.Run(CACHE_STORAGE_ERROR_STORAGE, std::unique_ptr<Responses>(),
                  std::unique_ptr<BlobDataHandles>());
     return;
   }
 
   QueryCache(std::move(request), options,
-             QueryCacheType::REQUESTS_AND_RESPONSES,
+             QUERY_CACHE_REQUESTS | QUERY_CACHE_RESPONSES_WITH_BODIES,
              base::Bind(&CacheStorageCache::MatchAllDidQueryCache,
                         weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void CacheStorageCache::MatchAllDidQueryCache(
     const ResponsesCallback& callback,
     CacheStorageError error,
     std::unique_ptr<QueryCacheResults> query_cache_results) {
   if (error != CACHE_STORAGE_OK) {
     callback.Run(error, std::unique_ptr<Responses>(),
@@ skipping 168 matching lines @@
                  base::Passed(std::move(put_context))));
 }
 
 void CacheStorageCache::PutImpl(std::unique_ptr<PutContext> put_context) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
   if (backend_state_ != BACKEND_OPEN) {
     put_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
-  std::string key = put_context->request->url.spec();
+  // Explicitly delete the incumbent resource (which may not exist). This is
+  // only done so that it's padding will be decremented from the calculated
+  // cache padding.
+  auto delete_request = base::MakeUnique<ServiceWorkerFetchRequest>(
+      put_context->request->url, "", ServiceWorkerHeaderMap(), Referrer(),
+      false);
 
-  net::CompletionCallback callback = base::Bind(
-      &CacheStorageCache::PutDidDoomEntry, weak_ptr_factory_.GetWeakPtr(),
-      base::Passed(std::move(put_context)));
-
-  int rv = backend_->DoomEntry(key, callback);
-  if (rv != net::ERR_IO_PENDING)
-    callback.Run(rv);
+  CacheStorageCacheQueryParams query_options;
+  query_options.ignore_method = true;
+  query_options.ignore_vary = true;
+  DeleteImpl(std::move(delete_request), query_options,

[jkarlin, 2017/06/15 16:08:35]

It hurts to call DeleteImpl here, as it's going to seriously slow down put
operations, but so be it. Can you add a TODO to see if we can find a faster way?

For instance, something that morlovich@ is working on is adding a few bits to
the backend's index that we can put whatever we want in and access
synchronously. We might use a bit to signal that the resource is opaque.

[cmumford, 2017/06/20 18:22:04]

Done. Unfortunately morlovich's abandoned his index change.

+             base::Bind(&CacheStorageCache::PutDidDeleteEntry,
+                        weak_ptr_factory_.GetWeakPtr(),
+                        base::Passed(std::move(put_context))));
 }
 
-void CacheStorageCache::PutDidDoomEntry(std::unique_ptr<PutContext> put_context,
-                                        int rv) {
+void CacheStorageCache::PutDidDeleteEntry(
+    std::unique_ptr<PutContext> put_context,
+    CacheStorageError error,
+    std::unique_ptr<QueryCacheResults> query_results) {
   if (backend_state_ != BACKEND_OPEN) {
     put_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
-  // |rv| is ignored as doom entry can fail if the entry doesn't exist.
+  if (error != CACHE_STORAGE_OK && error != CACHE_STORAGE_ERROR_NOT_FOUND) {
+    cache_padding_ -= CalculateResponsePadding(*put_context->response,

[jkarlin, 2017/06/15 16:08:35]

Hmm, shouldn't delete take care of removing the cache_padding in case of error?

[cmumford, 2017/06/20 18:22:04]

This is the read of the old cache entry that must currently be done to know if
it's there, and even opaque. I don't believe it's possible to get an error and
also get response. That being said, I moved this outside of the check as it
doesn't impact performance and is less confusing.

Also, I should have been using the query_result's response instead of the one
from put_context.

+                                               cache_padding_key_.get());
+    put_context->callback.Run(error);
+    return;
+  }
 
   std::unique_ptr<disk_cache::Entry*> scoped_entry_ptr(
       new disk_cache::Entry*());
   disk_cache::Entry** entry_ptr = scoped_entry_ptr.get();
   ServiceWorkerFetchRequest* request_ptr = put_context->request.get();
   disk_cache::Backend* backend_ptr = backend_.get();
 
   net::CompletionCallback create_entry_callback = base::Bind(
       &CacheStorageCache::PutDidCreateEntry, weak_ptr_factory_.GetWeakPtr(),
       base::Passed(std::move(scoped_entry_ptr)),
       base::Passed(std::move(put_context)));
 
-  int create_rv = backend_ptr->CreateEntry(request_ptr->url.spec(), entry_ptr,
-                                           create_entry_callback);
+  int rv = backend_ptr->CreateEntry(request_ptr->url.spec(), entry_ptr,
+                                    create_entry_callback);
 
-  if (create_rv != net::ERR_IO_PENDING)
-    create_entry_callback.Run(create_rv);
+  if (rv != net::ERR_IO_PENDING)
+    create_entry_callback.Run(rv);
 }
 
 void CacheStorageCache::PutDidCreateEntry(
     std::unique_ptr<disk_cache::Entry*> entry_ptr,
     std::unique_ptr<PutContext> put_context,
     int rv) {
   put_context->cache_entry.reset(*entry_ptr);
 
   if (rv != net::OK) {
     put_context->callback.Run(CACHE_STORAGE_ERROR_EXISTS);
@@ skipping 64 matching lines @@
     int expected_bytes,
     int rv) {
   if (rv != expected_bytes) {
     put_context->cache_entry->Doom();
     put_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
   if (rv > 0)
     storage::RecordBytesWritten(kRecordBytesLabel, rv);
+  cache_padding_ += CalculateResponsePadding(*put_context->response,

[jkarlin, 2017/06/15 16:08:35]

Ah, there is another place that we need to bump the cache_padding_, and that's
when side data (e.g., compiled javascript) is written to the cache such as in
WriteSideDataDidWrite. I need to think more about this, but perhaps for metadata
we could add HMAC(private_key, URL + "METADATA") so that it has a different (but
also consistent for the url) pad. WDYT?

We could not count the side data against the cache's quota, but implementing
that would be tricky since we rely on the backend's CalculateSizeOfAllEntries to
get the size quickly and that includes the side data size.

[cmumford, 2017/06/20 18:22:04]

A few thoughts.

1. If we did ignore the side data, as we do now, what are the security
implications of that?

2. If we pad the side data then we'd also need to decrement it in
PutDidDeleteEntry. I don't believe that data comes back in QueryCacheResult, so
it would be another call to DiskCache::GetDataSize() in order to determine if
we've cached compiled JavaScript.

Or am I missing something obvious in #2?

[jkarlin, 2017/06/26 17:59:19]

We'd leak the size of whatever side-data is stored. I'm aware of compiled
javascript being stored, I'm not sure if there are other consumers. So if the
attacker knows the size of the compiled javascript for a resource, then they
know what the original script is. That doesn't seem terrible, but it's enough to
make me uncomfortable. Especially since we don't know what other consumers may
come in the future.
Yes, we'd need to call GetDataSize. That's synchronous and fast, no concerns
there.

+                                             cache_padding_key_.get());
 
   // The metadata is written, now for the response content. The data is streamed
   // from the blob into the cache entry.
 
   if (put_context->response->blob_uuid.empty()) {
     UpdateCacheSize(base::Bind(put_context->callback, CACHE_STORAGE_OK));
     return;
   }
 
   DCHECK(put_context->blob_data_handle);
@@ skipping 29 matching lines @@
 
   if (!success) {
     put_context->cache_entry->Doom();
     put_context->callback.Run(CACHE_STORAGE_ERROR_STORAGE);
     return;
   }
 
   UpdateCacheSize(base::Bind(put_context->callback, CACHE_STORAGE_OK));
 }
 
+void CacheStorageCache::CalculateCacheSizePadding(
+    const SizePaddingCallback& got_sizes_callback) {
+  net::CompletionCallback got_size_callback =
+      base::Bind(&CacheStorageCache::CalculateCacheSizePaddingGotSize,
+                 weak_ptr_factory_.GetWeakPtr(), std::move(got_sizes_callback));
+
+  int rv = backend_->CalculateSizeOfAllEntries(got_size_callback);
+  if (rv != net::ERR_IO_PENDING)
+    got_size_callback.Run(rv);
+}
+
+void CacheStorageCache::CalculateCacheSizePaddingGotSize(
+    const SizePaddingCallback& callback,
+    int cache_size) {
+  // Enumerating entries is only done during cache initialization.
+  DCHECK_EQ(backend_state_, BACKEND_UNINITIALIZED);
+  std::unique_ptr<ServiceWorkerFetchRequest> request;
+  CacheStorageCacheQueryParams options;
+  options.ignore_search = true;
+  QueryCache(std::move(request), options,
+             QUERY_CACHE_REQUESTS | QUERY_CACHE_RESPONSES_WITH_BODIES,

[jkarlin, 2017/06/15 16:08:35]

You want QUERY_CACHE_RESPONSES_NO_BODIES here I think as you just need the URL
and response type right? I don't think you need QUERY_CACHE_REQUESTS either.

[cmumford, 2017/06/20 18:22:04]

Yes, that was unnecessary - thx.

+             base::Bind(&CacheStorageCache::PaddingDidQueryCache,
+                        weak_ptr_factory_.GetWeakPtr(), std::move(callback),
+                        cache_size));
+}
+
+void CacheStorageCache::PaddingDidQueryCache(
+    const SizePaddingCallback& callback,
+    int cache_size,
+    CacheStorageError error,
+    std::unique_ptr<QueryCacheResults> query_cache_results) {
+  int64_t cache_padding = 0;
+  if (error == CACHE_STORAGE_OK) {
+    for (const auto& result : *query_cache_results)
+      cache_padding +=
+          CalculateResponsePadding(*result.response, cache_padding_key_.get());
+  }
+
+  callback.Run(cache_size, cache_padding);
+}
+
+void CacheStorageCache::CalculateCacheSize(
+    const net::CompletionCallback& callback) {
+  int rv = backend_->CalculateSizeOfAllEntries(callback);
+  if (rv != net::ERR_IO_PENDING)
+    callback.Run(rv);
+}
+
 void CacheStorageCache::UpdateCacheSize(const base::Closure& callback) {
   if (backend_state_ != BACKEND_OPEN)
     return;
 
   // Note that the callback holds a cache handle to keep the cache alive during
   // the operation since this UpdateCacheSize is often run after an operation
   // completes and runs its callback.
-  int rv = backend_->CalculateSizeOfAllEntries(
-      base::Bind(&CacheStorageCache::UpdateCacheSizeGotSize,
-                 weak_ptr_factory_.GetWeakPtr(),
-                 base::Passed(CreateCacheHandle()), callback));
-
-  if (rv != net::ERR_IO_PENDING)
-    UpdateCacheSizeGotSize(CreateCacheHandle(), callback, rv);
+  CalculateCacheSize(base::Bind(&CacheStorageCache::UpdateCacheSizeGotSize,
+                                weak_ptr_factory_.GetWeakPtr(),
+                                base::Passed(CreateCacheHandle()), callback));
 }
 
 void CacheStorageCache::UpdateCacheSizeGotSize(
     std::unique_ptr<CacheStorageCacheHandle> cache_handle,
     const base::Closure& callback,
     int current_cache_size) {
   DCHECK_NE(current_cache_size, CacheStorage::kSizeUnknown);
-  int64_t old_cache_size = cache_size_;
   cache_size_ = current_cache_size;
-
-  int64_t size_delta = current_cache_size - old_cache_size;
+  int64_t size_delta = PaddedCacheSize() - last_reported_size_;
+  last_reported_size_ = PaddedCacheSize();
 
   quota_manager_proxy_->NotifyStorageModified(
       storage::QuotaClient::kServiceWorkerCache, origin_,
       storage::kStorageTypeTemporary, size_delta);
 
   if (cache_observer_)
-    cache_observer_->CacheSizeUpdated(this, current_cache_size);
+    cache_observer_->CacheSizeUpdated(this, PaddedCacheSize());
 
   callback.Run();
 }
 
 void CacheStorageCache::Delete(const CacheStorageBatchOperation& operation,
                                const ErrorCallback& callback) {
   DCHECK(BACKEND_OPEN == backend_state_ || initializing_);
   DCHECK_EQ(CACHE_STORAGE_CACHE_OPERATION_TYPE_DELETE,
             operation.operation_type);
 
   std::unique_ptr<ServiceWorkerFetchRequest> request(
       new ServiceWorkerFetchRequest(
           operation.request.url, operation.request.method,
           operation.request.headers, operation.request.referrer,
           operation.request.is_reload));
 
+  QueryCacheCallback delete_callback =
+      base::Bind(&CacheStorageCache::DeleteDidDelete,
+                 weak_ptr_factory_.GetWeakPtr(), callback);
+
   scheduler_->ScheduleOperation(
       base::Bind(&CacheStorageCache::DeleteImpl, weak_ptr_factory_.GetWeakPtr(),
                  base::Passed(std::move(request)), operation.match_params,
-                 scheduler_->WrapCallbackToRunNext(callback)));
+                 scheduler_->WrapCallbackToRunNext(delete_callback)));
+}
+
+void CacheStorageCache::DeleteDidDelete(
+    const ErrorCallback& callback,
+    CacheStorageError error,
+    std::unique_ptr<QueryCacheResults> query_results) {
+  callback.Run(error);
 }
 
 void CacheStorageCache::DeleteImpl(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& match_params,
-    const ErrorCallback& callback) {
+    const QueryCacheCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
   if (backend_state_ != BACKEND_OPEN) {
-    callback.Run(CACHE_STORAGE_ERROR_STORAGE);
+    callback.Run(CACHE_STORAGE_ERROR_STORAGE,
+                 base::MakeUnique<QueryCacheResults>());
     return;
   }
 
-  QueryCache(std::move(request), match_params, QueryCacheType::CACHE_ENTRIES,
+  QueryCache(std::move(request), match_params,
+             QUERY_CACHE_ENTRIES | QUERY_CACHE_RESPONSES_NO_BODIES,
              base::Bind(&CacheStorageCache::DeleteDidQueryCache,
                         weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void CacheStorageCache::DeleteDidQueryCache(
-    const ErrorCallback& callback,
+    const QueryCacheCallback& callback,
     CacheStorageError error,
     std::unique_ptr<QueryCacheResults> query_cache_results) {
   if (error != CACHE_STORAGE_OK) {
-    callback.Run(error);
+    callback.Run(error, std::move(query_cache_results));
     return;
   }
 
   if (query_cache_results->empty()) {
-    callback.Run(CACHE_STORAGE_ERROR_NOT_FOUND);
+    callback.Run(CACHE_STORAGE_ERROR_NOT_FOUND, std::move(query_cache_results));
     return;
   }
 
   for (auto& result : *query_cache_results) {
     disk_cache::ScopedEntryPtr entry = std::move(result.entry);
+    cache_padding_ -=
+        CalculateResponsePadding(*result.response, cache_padding_key_.get());
     entry->Doom();
   }
 
-  UpdateCacheSize(base::Bind(callback, CACHE_STORAGE_OK));
+  UpdateCacheSize(base::Bind(callback, CACHE_STORAGE_OK,
+                             base::Passed(std::move(query_cache_results))));
 }
 
 void CacheStorageCache::KeysImpl(
     std::unique_ptr<ServiceWorkerFetchRequest> request,
     const CacheStorageCacheQueryParams& options,
     const RequestsCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
   if (backend_state_ != BACKEND_OPEN) {
     callback.Run(CACHE_STORAGE_ERROR_STORAGE, std::unique_ptr<Requests>());
     return;
   }
 
-  QueryCache(std::move(request), options, QueryCacheType::REQUESTS,
+  QueryCache(std::move(request), options, QUERY_CACHE_REQUESTS,
              base::Bind(&CacheStorageCache::KeysDidQueryCache,
                         weak_ptr_factory_.GetWeakPtr(), callback));
 }
 
 void CacheStorageCache::KeysDidQueryCache(
     const RequestsCallback& callback,
     CacheStorageError error,
     std::unique_ptr<QueryCacheResults> query_cache_results) {
   if (error != CACHE_STORAGE_OK) {
     callback.Run(error, std::unique_ptr<Requests>());
@@ skipping 12 matching lines @@
   DCHECK_NE(BACKEND_CLOSED, backend_state_);
 
   backend_state_ = BACKEND_CLOSED;
   backend_.reset();
   callback.Run();
 }
 
 void CacheStorageCache::SizeImpl(const SizeCallback& callback) {
   DCHECK_NE(BACKEND_UNINITIALIZED, backend_state_);
 
-  int64_t size = backend_state_ == BACKEND_OPEN ? cache_size_ : 0;
+  // TODO(cmumford): Can CacheStorage::kSizeUnknown be returned instead of zero?
+  if (backend_state_ != BACKEND_OPEN) {
+    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
+                                                  base::Bind(callback, 0));
+    return;
+  }
+
+  int64_t size = backend_state_ == BACKEND_OPEN ? PaddedCacheSize() : 0;
   base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
                                                 base::Bind(callback, size));
 }
 
 void CacheStorageCache::GetSizeThenCloseDidGetSize(const SizeCallback& callback,
                                                    int64_t cache_size) {
   CloseImpl(base::Bind(callback, cache_size));
 }
 
 void CacheStorageCache::CreateBackend(const ErrorCallback& callback) {
@@ skipping 72 matching lines @@
   // Now that we know the cache size either 1) the cache size should be unknown
   // (which is why the size was calculated), or 2) it must match the current
   // size. If the sizes aren't equal then there is a bug in how the cache size
   // is saved in the store's index.
   if (cache_size_ != CacheStorage::kSizeUnknown) {
     LOG_IF(ERROR, cache_size_ != cache_size)
         << "Cache size: " << cache_size
         << " does not match size from index: " << cache_size_;
     UMA_HISTOGRAM_COUNTS_10M("ServiceWorkerCache.IndexSizeDifference",
                              std::abs(cache_size_ - cache_size));
-    // Disabled for crbug.com/681900.
-    // DCHECK_EQ(cache_size_, cache_size);
+    if (cache_size_ != cache_size) {
+      // If the actual size doesn't match the cached size, then assume the
+      // cached padding is also incorrect and recalculate.
+      CalculateCacheSizePaddingGotSize(
+          base::Bind(&CacheStorageCache::InitGotCacheSizeAndPadding,
+                     weak_ptr_factory_.GetWeakPtr(), callback,
+                     cache_create_error),
+          cache_size);
+      return;
+    }
   }
+
+  if (cache_padding_ == CacheStorage::kSizeUnknown || cache_padding_ < 0) {

[jkarlin, 2017/06/15 16:08:35]

Can you add a comment somewhere around here that we're assuming that if
cache_size_ matches cache_size then we also assume that the padding is correct
since it's stored at the same time.

[cmumford, 2017/06/20 18:22:04]

The comment above on line 1589 is almost the inverse of your requested comment.
I'll invert the comment, but leave it at that location. Let me know if you want
it moved.

+    CalculateCacheSizePaddingGotSize(
+        base::Bind(&CacheStorageCache::InitGotCacheSizeAndPadding,
+                   weak_ptr_factory_.GetWeakPtr(), callback,
+                   cache_create_error),
+        cache_size);
+    return;
+  }
+
+  // If cached size matches actual size then assume cached padding is still
+  // correct.
+  InitGotCacheSizeAndPadding(callback, cache_create_error, cache_size,
+                             cache_padding_);
+}
+
+void CacheStorageCache::InitGotCacheSizeAndPadding(
+    const base::Closure& callback,
+    CacheStorageError cache_create_error,
+    int64_t cache_size,
+    int64_t cache_padding) {
   cache_size_ = cache_size;
+  cache_padding_ = cache_padding;
+
   initializing_ = false;
   backend_state_ = (cache_create_error == CACHE_STORAGE_OK && backend_ &&
                     backend_state_ == BACKEND_UNINITIALIZED)
                        ? BACKEND_OPEN
                        : BACKEND_CLOSED;
 
   UMA_HISTOGRAM_ENUMERATION("ServiceWorkerCache.InitBackendResult",
                             cache_create_error, CACHE_STORAGE_ERROR_LAST + 1);
 
   if (cache_observer_)
-    cache_observer_->CacheSizeUpdated(this, cache_size_);
+    cache_observer_->CacheSizeUpdated(this, PaddedCacheSize());
 
   callback.Run();
 }
 
 std::unique_ptr<storage::BlobDataHandle>
 CacheStorageCache::PopulateResponseBody(disk_cache::ScopedEntryPtr entry,
                                         ServiceWorkerResponse* response) {
   DCHECK(blob_storage_context_);
 
   // Create a blob with the response body data.
   response->blob_size = entry->GetDataSize(INDEX_RESPONSE_BODY);
   response->blob_uuid = base::GenerateGUID();
   storage::BlobDataBuilder blob_data(response->blob_uuid);
 
   disk_cache::Entry* temp_entry = entry.get();
   blob_data.AppendDiskCacheEntryWithSideData(
       new CacheStorageCacheDataHandle(CreateCacheHandle(), std::move(entry)),
       temp_entry, INDEX_RESPONSE_BODY, INDEX_SIDE_DATA);
   return blob_storage_context_->AddFinishedBlob(&blob_data);
 }
 
 std::unique_ptr<CacheStorageCacheHandle>
 CacheStorageCache::CreateCacheHandle() {
   return cache_storage_->CreateCacheHandle(this);
 }
 
+int64_t CacheStorageCache::PaddedCacheSize() const {
+  if (cache_size_ == CacheStorage::kSizeUnknown ||
+      cache_padding_ == CacheStorage::kSizeUnknown) {
+    return CacheStorage::kSizeUnknown;
+  }
+  return cache_size_ + cache_padding_;
+}
+
 }  // namespace content