Commit 0f9781be authored by Clark DuVall's avatar Clark DuVall Committed by Commit Bot

Disallow redirects to blob: URLs

Blob URLs are ephemeral, so it doesn't make much sense to allow
redirecting to them.

See comments on crrev.com/c/1277785 for more info.

Change-Id: Iae31dc04f1ad4042d2b6861e05ca53699a3a31a6
Reviewed-on: https://chromium-review.googlesource.com/c/1278132Reviewed-by: default avatarDaniel Murphy <dmurph@chromium.org>
Reviewed-by: default avatarNasko Oskov <nasko@chromium.org>
Commit-Queue: Clark DuVall <cduvall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#600454}
parent 6896c8a2
...@@ -115,7 +115,7 @@ bool IsSafeRedirectTarget(const GURL& from_url, const GURL& to_url) { ...@@ -115,7 +115,7 @@ bool IsSafeRedirectTarget(const GURL& from_url, const GURL& to_url) {
static base::NoDestructor<std::set<std::string>> kUnsafeSchemes( static base::NoDestructor<std::set<std::string>> kUnsafeSchemes(
std::set<std::string>({ std::set<std::string>({
url::kAboutScheme, url::kDataScheme, url::kFileScheme, url::kAboutScheme, url::kDataScheme, url::kFileScheme,
url::kFileSystemScheme, url::kFileSystemScheme, url::kBlobScheme,
#if defined(OS_ANDROID) #if defined(OS_ANDROID)
url::kContentScheme, url::kContentScheme,
#endif #endif
......
...@@ -43,6 +43,8 @@ TEST(UrlUtilsTest, IsSafeRedirectTarget) { ...@@ -43,6 +43,8 @@ TEST(UrlUtilsTest, IsSafeRedirectTarget) {
GURL(), CreateValidURL("filesystem:http://foo.com/bar"))); GURL(), CreateValidURL("filesystem:http://foo.com/bar")));
EXPECT_FALSE( EXPECT_FALSE(
IsSafeRedirectTarget(GURL(), CreateValidURL("data:text/plain,foo"))); IsSafeRedirectTarget(GURL(), CreateValidURL("data:text/plain,foo")));
EXPECT_FALSE(
IsSafeRedirectTarget(GURL(), CreateValidURL("blob:https://foo.com/bar")));
#if defined(OS_ANDROID) #if defined(OS_ANDROID)
EXPECT_FALSE( EXPECT_FALSE(
IsSafeRedirectTarget(GURL(), CreateValidURL("content://foo.bar"))); IsSafeRedirectTarget(GURL(), CreateValidURL("content://foo.bar")));
......
...@@ -89,6 +89,10 @@ net::URLRequestJob* BlobProtocolHandler::MaybeCreateJob( ...@@ -89,6 +89,10 @@ net::URLRequestJob* BlobProtocolHandler::MaybeCreateJob(
LookupBlobHandle(request)); LookupBlobHandle(request));
} }
bool BlobProtocolHandler::IsSafeRedirectTarget(const GURL& location) const {
return false;
}
BlobDataHandle* BlobProtocolHandler::LookupBlobHandle( BlobDataHandle* BlobProtocolHandler::LookupBlobHandle(
net::URLRequest* request) const { net::URLRequest* request) const {
BlobDataHandle* blob_data_handle = GetRequestBlobDataHandle(request); BlobDataHandle* blob_data_handle = GetRequestBlobDataHandle(request);
......
...@@ -44,9 +44,11 @@ class STORAGE_EXPORT BlobProtocolHandler ...@@ -44,9 +44,11 @@ class STORAGE_EXPORT BlobProtocolHandler
explicit BlobProtocolHandler(BlobStorageContext* context); explicit BlobProtocolHandler(BlobStorageContext* context);
~BlobProtocolHandler() override; ~BlobProtocolHandler() override;
// net::URLRequestJobFactory::ProtocolHandler implementation:
net::URLRequestJob* MaybeCreateJob( net::URLRequestJob* MaybeCreateJob(
net::URLRequest* request, net::URLRequest* request,
net::NetworkDelegate* network_delegate) const override; net::NetworkDelegate* network_delegate) const override;
bool IsSafeRedirectTarget(const GURL& location) const override;
private: private:
BlobDataHandle* LookupBlobHandle(net::URLRequest* request) const; BlobDataHandle* LookupBlobHandle(net::URLRequest* request) const;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment