content/child/site_isolation_policy.h

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
   6 #define CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
   7
   8 #include <map>
   9 #include <utility>
  10
  11 #include "base/gtest_prod_util.h"
  12 #include "base/memory/linked_ptr.h"
  13 #include "base/strings/string_piece.h"
  14 #include "content/common/content_export.h"
  15 #include "webkit/common/resource_type.h"
  16
  17 class GURL;
  18
  19 namespace webkit_glue {
  20 struct ResourceResponseInfo;
  21 }
  22
  23 namespace content {
  24
  25 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP)
  26 // for Site Isolation. XSDP will monitor network responses to a renderer and
  27 // block illegal responses so that a compromised renderer cannot steal private
  28 // information from other sites. For now SiteIsolationPolicy monitors responses
  29 // to gather various UMA stats to see the compatibility impact of actual
  30 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers
  31 // are as follows:
  32 //
  33 // SiteIsolation.AllResponses : # of all network responses.
  34 // SiteIsolation.XSD.DataLength : the length of the first packet of a response.
  35 // SiteIsolation.XSD.MimeType (enum):
  36 //   # of responses from other sites, tagged with a document mime type.
  37 //   0:HTML, 1:XML, 2:JSON, 3:Plain, 4:Others
  38 // SiteIsolation.XSD.[%MIMETYPE].Blocked :
  39 //   blocked # of cross-site document responses grouped by sniffed MIME type.
  40 // SiteIsolation.XSD.[%MIMETYPE].Blocked.RenderableStatusCode :
  41 //   # of responses with renderable status code,
  42 //   out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
  43 // SiteIsolation.XSD.[%MIMETYPE].Blocked.NonRenderableStatusCode :
  44 //   # of responses with non-renderable status code,
  45 //   out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
  46 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.RenderableStatusCode :
  47 //   # of responses failed to be sniffed for its MIME type, but blocked by
  48 //   "X-Content-Type-Options: nosniff" header, and with renderable status code
  49 //   out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
  50 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode :
  51 //   # of responses failed to be sniffed for its MIME type, but blocked by
  52 //   "X-Content-Type-Options: nosniff" header, and with non-renderable status
  53 //   code out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
  54 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked :
  55 //   # of responses, but not blocked due to failure of mime sniffing.
  56 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS :
  57 //   # of responses that are plausibly sniffed to be JavaScript.
  58
  59 struct SiteIsolationResponseMetaData {
  60
  61   enum CanonicalMimeType {
  62     HTML = 0,
  63     XML = 1,
  64     JSON = 2,
  65     Plain = 3,
  66     Others = 4,
  67     MaxCanonicalMimeType,
  68   };
  69
  70   SiteIsolationResponseMetaData();
  71
  72   std::string frame_origin;
  73   GURL response_url;
  74   ResourceType::Type resource_type;
  75   CanonicalMimeType canonical_mime_type;
  76   int http_status_code;
  77   bool no_sniff;
  78 };
  79
  80 class CONTENT_EXPORT SiteIsolationPolicy {
  81  public:
  82   // Set activation flag for the UMA data collection for this renderer process.
  83   static void SetPolicyEnabled(bool enabled);
  84
  85   // Returns any bookkeeping data about the HTTP header information for the
  86   // request identified by |request_id|. Any data returned should then be
  87   // passed to ShouldBlockResponse with the first packet.
  88   static linked_ptr<SiteIsolationResponseMetaData> OnReceivedResponse(
  89       const GURL& frame_origin, const GURL& response_url,
  90       ResourceType::Type resource_type, int origin_pid,
  91       const webkit_glue::ResourceResponseInfo& info);
  92
  93   // Examines the first network packet in case response_url is registered as a
  94   // cross-site document by DidReceiveResponse().  In case that this response is
  95   // blocked, it returns an alternative data to be sent to the renderer in
  96   // |alternative_data|. This records various kinds of UMA data stats. This
  97   // function is called only if the length of received data is non-zero.
  98   static bool ShouldBlockResponse(
  99       linked_ptr<SiteIsolationResponseMetaData>& resp_data, const char* payload,
 100       int length, std::string* alternative_data);
 101
 102 private:
 103   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme);
 104   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite);
 105   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet);
 106   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML);
 107   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML);
 108   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON);
 109   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS);
 110
 111   // Returns the representative mime type enum value of the mime type of
 112   // response. For example, this returns the same value for all text/xml mime
 113   // type families such as application/xml, application/rss+xml.
 114   static SiteIsolationResponseMetaData::CanonicalMimeType GetCanonicalMimeType(
 115       const std::string& mime_type);
 116
 117   // Returns whether this scheme is a target of cross-site document
 118   // policy(XSDP). This returns true only for http://* and https://* urls.
 119   static bool IsBlockableScheme(const GURL& frame_origin);
 120
 121   // Returns whether the two urls belong to the same sites.
 122   static bool IsSameSite(const GURL& frame_origin, const GURL& response_url);
 123
 124   // Returns whether there's a valid CORS header for frame_origin.  This is
 125   // simliar to CrossOriginAccessControl::passesAccessControlCheck(), but we use
 126   // sites as our security domain, not origins.
 127   // TODO(dsjang): this must be improved to be more accurate to the actual CORS
 128   // specification. For now, this works conservatively, allowing XSDs that are
 129   // not allowed by actual CORS rules by ignoring 1) credentials and 2)
 130   // methods. Preflight requests don't matter here since they are not used to
 131   // decide whether to block a document or not on the client side.
 132   static bool IsValidCorsHeaderSet(const GURL& frame_origin,
 133                                    const GURL& website_origin,
 134                                    const std::string& access_control_origin);
 135
 136   static bool SniffForHTML(base::StringPiece data);
 137   static bool SniffForXML(base::StringPiece data);
 138   static bool SniffForJSON(base::StringPiece data);
 139
 140   // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted
 141   // when this class is used for actual blocking.
 142   static bool SniffForJS(base::StringPiece data);
 143
 144   // Never needs to be constructed/destructed.
 145   SiteIsolationPolicy() {}
 146   ~SiteIsolationPolicy() {}
 147
 148   DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy);
 149 };
 150
 151 }  // namespace content
 152
 153 #endif  // CONTENT_CHILD_SITE_ISOLATION_POLICY_H_