Introducing the OffDomainInclusionDetector to analyze resource requests for suspicious activity.

chrome/browser/safe_browsing/incident_reporting/off_domain_inclusion_detector.h

Index: chrome/browser/safe_browsing/incident_reporting/off_domain_inclusion_detector.h
diff --git a/chrome/browser/safe_browsing/incident_reporting/off_domain_inclusion_detector.h b/chrome/browser/safe_browsing/incident_reporting/off_domain_inclusion_detector.h
new file mode 100644
index 0000000000000000000000000000000000000000..2b18d84a20c3ea4cbc20a189ff95804fca19d78c
--- /dev/null
+++ b/chrome/browser/safe_browsing/incident_reporting/off_domain_inclusion_detector.h
@@ -0,0 +1,54 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SAFE_BROWSING_INCIDENT_REPORTING_OFF_DOMAIN_INCLUSION_DETECTOR_H_
+#define CHROME_BROWSER_SAFE_BROWSING_INCIDENT_REPORTING_OFF_DOMAIN_INCLUSION_DETECTOR_H_
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "content/public/common/resource_type.h"
+
+namespace net {
+class URLRequest;
+}
+
+namespace safe_browsing {
+
+// Observes network requests and reports suspicious activity.
+class OffDomainInclusionDetector {
+ public:
+  enum class AnalysisEvent {
+    NO_EVENT,
+    EMPTY_MAIN_FRAME_URL,
+    INVALID_MAIN_FRAME_URL,
+    OFF_DOMAIN_INCLUSION_DETECTED,
+  };
+
+  // TODO(gab): Hook the OffDomainInclusionDetector to the
+  // IncidentReportingService and use an AddIncidentCallback instead of this
+  // custom callback type.
+  typedef base::Callback<void(AnalysisEvent event)> ReportAnalysisEventCallback;
+
+  OffDomainInclusionDetector();
+
+  // Constructs an OffDomainInclusionDetector with a ReportAnalysisEventCallback
+  // to get feedback from detection events, used only in tests.
+  explicit OffDomainInclusionDetector(
+      const ReportAnalysisEventCallback& report_analysis_event_callback);
+
+  ~OffDomainInclusionDetector();
+
+  // Analyzes the |request| and reports via UMA if an AnalysisEvent is triggered
+  // (and via |report_analysis_event_callback_| if it is set).
+  void OnResourceRequest(const net::URLRequest* request);

[grt (UTC plus 2), 2014/11/19 18:28:59]

why not const ref?

[gab, 2014/11/19 21:29:09]

Because everything works off of pointers with net::URLRequest, e.g., the call to
content::ResourceRequestInfo::ForRequest in the .cc file would not work with a
ref as it would get a stack pointer wouldn't it (or maybe not since it's a
reference, but since everything works with pointers I just kept the train
going).

+
+ private:
+  const ReportAnalysisEventCallback report_analysis_event_callback_;
+
+  DISALLOW_COPY_AND_ASSIGN(OffDomainInclusionDetector);
+};
+
+}  // namespace safe_browsing
+
+#endif  // CHROME_BROWSER_SAFE_BROWSING_INCIDENT_REPORTING_OFF_DOMAIN_INCLUSION_DETECTOR_H_