Mitigate the pushState IPC storm DoS.

third_party/WebKit/Source/core/frame/History.h

Index: third_party/WebKit/Source/core/frame/History.h
diff --git a/third_party/WebKit/Source/core/frame/History.h b/third_party/WebKit/Source/core/frame/History.h
index fb7fc5ea80e861f79ba6018f86a012daf1056201..45d50059d6e2b16aa95eb6975236ae53c36fe795 100644
--- a/third_party/WebKit/Source/core/frame/History.h
+++ b/third_party/WebKit/Source/core/frame/History.h
@@ -26,6 +26,8 @@
 #ifndef History_h
 #define History_h
 
+#include <utility>
+
 #include "base/gtest_prod_util.h"
 #include "bindings/core/v8/serialization/SerializedScriptValue.h"
 #include "core/dom/ContextLifecycleObserver.h"
@@ -33,6 +35,7 @@
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/heap/Handle.h"
 #include "platform/wtf/Forward.h"
+#include "platform/wtf/HashMap.h"
 
 namespace blink {
 
@@ -102,7 +105,13 @@ class CORE_EXPORT History final : public GarbageCollectedFinalized<History>,
   SerializedScriptValue* StateInternal() const;
   HistoryScrollRestorationType ScrollRestorationInternal() const;
 
+  bool IsHostFloodingPushState(const String& hostname) const;
+
   RefPtr<SerializedScriptValue> last_state_object_requested_;
+
+  using HostLimit = std::pair<int, double>;
+  using HostLimits = HashMap<String, HostLimit>;
+  mutable HostLimits host_limits;

[dcheng, 2017/07/06 23:03:40]

As history is tied to the Window object, shall we just store a counter +
WTF::TimeTicks? A navigation will naturally reset this, and we don't have to
worry about purging old entries in the map.

(It's a bit counterintuitive since the constructor takes a LocalFrame*... but
that's just how it is.)

[palmer, 2017/07/06 23:53:06]

Do you mean we don't need to keep track of the hostname, and we can have just:

  mutable int state_update_count;
  mutable TimeTicks last_udpate;

that would apply for all hostnames? I'm a little concerned about host A eating
up the available budget and hurting well-behaved host B. Does that make sense?

 };
 
 }  // namespace blink