1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
6 #define CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
11 #include "base/gtest_prod_util.h"
12 #include "content/common/content_export.h"
13 #include "third_party/WebKit/public/platform/WebURLRequest.h"
14 #include "third_party/WebKit/public/platform/WebURLResponse.h"
15 #include "third_party/WebKit/public/web/WebFrame.h"
16 #include "webkit/common/resource_response_info.h"
17 #include "webkit/common/resource_type.h"
21 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP)
22 // for Site Isolation. XSDP will monitor network responses to a renderer and
23 // block illegal responses so that a compromised renderer cannot steal private
24 // information from other sites. For now SiteIsolationPolicy monitors responses
25 // to gather various UMA stats to see the compatibility impact of actual
26 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers
29 // SiteIsolation.AllResponses : # of all network responses.
30 // SiteIsolation.XSD.DataLength : the length of the first packet of a response.
31 // SiteIsolation.XSD.MimeType (enum):
32 // # of responses from other sites, tagged with a document mime type.
33 // 0:HTML, 1:XML, 2:JSON, 3:Plain, 4:Others
34 // SiteIsolation.XSD.[%MIMETYPE].Blocked :
35 // blocked # of cross-site document responses grouped by sniffed MIME type.
36 // SiteIsolation.XSD.[%MIMETYPE].Blocked.RenderableStatusCode :
37 // # of responses with renderable status code,
38 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
39 // SiteIsolation.XSD.[%MIMETYPE].Blocked.NonRenderableStatusCode :
40 // # of responses with non-renderable status code,
41 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
42 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.RenderableStatusCode :
43 // # of responses failed to be sniffed for its MIME type, but blocked by
44 // "X-Content-Type-Options: nosniff" header, and with renderable status code
45 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
46 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode :
47 // # of responses failed to be sniffed for its MIME type, but blocked by
48 // "X-Content-Type-Options: nosniff" header, and with non-renderable status
49 // code out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
50 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked :
51 // # of responses, but not blocked due to failure of mime sniffing.
52 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS :
53 // # of responses that are plausibly sniffed to be JavaScript.
55 class CONTENT_EXPORT SiteIsolationPolicy
{
58 // Records the bookkeeping data about the HTTP header information for the
59 // request identified by |request_id|. The bookkeeping data is used by
60 // ShouldBlockResponse. We have to make sure to call OnRequestComplete to free
61 // the bookkeeping data.
62 static void OnReceivedResponse(int request_id
,
65 ResourceType::Type resource_type
,
66 const webkit_glue::ResourceResponseInfo
& info
);
68 // Examines the first network packet in case response_url is registered as a
69 // cross-site document by DidReceiveResponse(). In case that this response is
70 // blocked, it returns an alternative data to be sent to the renderer in
71 // |alternative_data|. This records various kinds of UMA data stats. This
72 // function is called only if the length of received data is non-zero.
73 static bool ShouldBlockResponse(int request_id
,
76 std::string
* alternative_data
);
78 // Clean up booking data registered by OnReceiveResponse and OnReceivedData.
79 static void OnRequestComplete(int request_id
);
81 struct ResponseMetaData
{
83 enum CanonicalMimeType
{
94 std::string frame_origin
;
96 ResourceType::Type resource_type
;
97 CanonicalMimeType canonical_mime_type
;
102 typedef std::map
<int, ResponseMetaData
> RequestIdToMetaDataMap
;
103 typedef std::map
<int, bool> RequestIdToResultMap
;
106 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest
, IsBlockableScheme
);
107 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest
, IsSameSite
);
108 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest
, IsValidCorsHeaderSet
);
109 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest
, SniffForHTML
);
110 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest
, SniffForXML
);
111 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest
, SniffForJSON
);
112 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest
, SniffForJS
);
114 // Returns the representative mime type enum value of the mime type of
115 // response. For example, this returns the same value for all text/xml mime
116 // type families such as application/xml, application/rss+xml.
117 static ResponseMetaData::CanonicalMimeType
GetCanonicalMimeType(
118 const std::string
& mime_type
);
120 // Returns whether this scheme is a target of cross-site document
121 // policy(XSDP). This returns true only for http://* and https://* urls.
122 static bool IsBlockableScheme(const GURL
& frame_origin
);
124 // Returns whether the two urls belong to the same sites.
125 static bool IsSameSite(const GURL
& frame_origin
, const GURL
& response_url
);
127 // Returns whether there's a valid CORS header for frame_origin. This is
128 // simliar to CrossOriginAccessControl::passesAccessControlCheck(), but we use
129 // sites as our security domain, not origins.
130 // TODO(dsjang): this must be improved to be more accurate to the actual CORS
131 // specification. For now, this works conservatively, allowing XSDs that are
132 // not allowed by actual CORS rules by ignoring 1) credentials and 2)
133 // methods. Preflight requests don't matter here since they are not used to
134 // decide whether to block a document or not on the client side.
135 static bool IsValidCorsHeaderSet(GURL
& frame_origin
,
136 GURL
& website_origin
,
137 std::string access_control_origin
);
139 // Returns whether the given frame is navigating. When this is true, the frame
140 // is requesting is a web page to be loaded.
141 static bool IsFrameNavigating(WebKit::WebFrame
* frame
);
143 static bool SniffForHTML(const char* data
, size_t length
);
144 static bool SniffForXML(const char* data
, size_t length
);
145 static bool SniffForJSON(const char* data
, size_t length
);
147 static bool MatchesSignature(const char* data
,
149 const char* signatures
[],
152 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted
153 // when this class is used for actual blocking.
154 static bool SniffForJS(const char* data
, size_t length
);
156 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted
157 // when this class is used for actual blocking.
158 static bool IsRenderableStatusCodeForDocument(int status_code
);
160 // Maintain the bookkeeping data between OnReceivedResponse and
161 // OnReceivedData. The key is a request id maintained by ResourceDispatcher.
162 static RequestIdToMetaDataMap
* GetRequestIdToMetaDataMap();
164 // Maintain the bookkeeping data for OnReceivedData. Blocking decision is made
165 // when OnReceivedData is called for the first time for a request, and the
166 // decision will remain the same for following data. This map maintains the
167 // decision. The key is a request id maintained by ResourceDispatcher.
168 static RequestIdToResultMap
* GetRequestIdToResultMap();
170 // Never needs to be constructed/destructed.
171 SiteIsolationPolicy() {}
172 ~SiteIsolationPolicy() {}
174 DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy
);
177 } // namespace content
179 #endif // CONTENT_CHILD_SITE_ISOLATION_POLICY_H_