Mitigate the pushState IPC storm DoS.

third_party/WebKit/Source/core/frame/History.cpp

 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 20 matching lines @@
 #include "core/frame/LocalFrame.h"
 #include "core/frame/LocalFrameClient.h"
 #include "core/loader/DocumentLoader.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/HistoryItem.h"
 #include "core/loader/NavigationScheduler.h"
 #include "core/page/Page.h"
 #include "platform/bindings/ScriptState.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityOrigin.h"
+#include "platform/wtf/CurrentTime.h"
+#include "platform/wtf/HashMap.h"
 #include "platform/wtf/text/StringView.h"
 
 namespace blink {
 
 namespace {
 
 bool EqualIgnoringPathQueryAndFragment(const KURL& a, const KURL& b) {
   return StringView(a.GetString(), 0, a.PathStart()) ==
          StringView(b.GetString(), 0, b.PathStart());
 }
@@ skipping 58 matching lines @@
 }
 
 HistoryScrollRestorationType History::ScrollRestorationInternal() const {
   HistoryItem* history_item =
       GetFrame() ? GetFrame()->Loader().GetDocumentLoader()->GetHistoryItem()
                  : nullptr;
   return history_item ? history_item->ScrollRestorationType()
                       : kScrollRestorationAuto;
 }
 
+// TODO(crbug.com/394296): This is not the long-term fix to IPC flooding that we
+// need. However, it does mitigate the immediate concern of |pushState| DoS
+// (assuming the renderer has not been compromised).
+bool History::IsHostFloodingPushState(const String& hostname) const {
+  const int kHostPushStateLimit = 50;
+  const HostLimit& current = host_limits.at(hostname);
+
+  if (current.first > kHostPushStateLimit) {
+    const double kHostPushStateLimitResetSeconds = 10.0;
+    double now = MonotonicallyIncreasingTime();
+    if (now - current.second > kHostPushStateLimitResetSeconds) {
+      host_limits.Set(hostname, HostLimit{0, now});
+    }
+    return true;
+  }
+
+  host_limits.Set(hostname, HostLimit{current.first + 1, current.second});
+  return false;
+}
+
 bool History::stateChanged() const {
   return last_state_object_requested_ != StateInternal();
 }
 
 bool History::IsSameAsCurrentState(SerializedScriptValue* state) const {
   return state == StateInternal();
 }
 
 void History::back(ScriptState* script_state) {
   go(script_state, -1);
@@ skipping 80 matching lines @@
 void History::StateObjectAdded(PassRefPtr<SerializedScriptValue> data,
                                const String& /* title */,
                                const String& url_string,
                                HistoryScrollRestorationType restoration_type,
                                FrameLoadType type,
                                ExceptionState& exception_state) {
   if (!GetFrame() || !GetFrame()->GetPage() ||
       !GetFrame()->Loader().GetDocumentLoader())
     return;
 
+  if (IsHostFloodingPushState(
+          GetFrame()->GetDocument()->GetSecurityOrigin()->Host())) {
+    return;
+  }
+
   KURL full_url = UrlForState(url_string);
   if (!CanChangeToUrl(full_url, GetFrame()->GetDocument()->GetSecurityOrigin(),
                       GetFrame()->GetDocument()->Url())) {
     // We can safely expose the URL to JavaScript, as a) no redirection takes
     // place: JavaScript already had this URL, b) JavaScript can only access a
     // same-origin History object.
     exception_state.ThrowSecurityError(
         "A history state object with URL '" + full_url.ElidedString() +
         "' cannot be created in a document with origin '" +
         GetFrame()->GetDocument()->GetSecurityOrigin()->ToString() +
         "' and URL '" + GetFrame()->GetDocument()->Url().ElidedString() + "'.");
     return;
   }
 
   GetFrame()->Loader().UpdateForSameDocumentNavigation(
       full_url, kSameDocumentNavigationHistoryApi, std::move(data),
       restoration_type, type, GetFrame()->GetDocument());
 }
 
 }  // namespace blink