OOR-CORS: Update blink::OriginAccessEntry to use the port

network::cors::OriginAccessEntry was updated to support port number.
This patches also update corresponding blink::OriginAccessEntry
so that it takes const SecurityOrigin& or const KURL& in ctors
in order to obtain the effective port. The port number is passed
to the network::cors::OriginAccessEntry to support the port match
in Blink.

Bug: 936900
Change-Id: I72d534280a4bd9a8296fe383385cd90e346f2b6c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1617049
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#662128}

services/network/public/cpp/cors/origin_access_entry.h

@@ -43,6 +43,8 @@ class COMPONENT_EXPORT(NETWORK_CPP) OriginAccessEntry final {
   // IPv6 addresses must include brackets (e.g.
   // '[2001:db8:85a3::8a2e:370:7334]', not '2001:db8:85a3::8a2e:370:7334').
   // The priority argument is used to break ties when multiple entries match.
+  // If a valid |port| is specified, MatchesOrigin() takes it into account.
+  // kPortAny can be used to match any port.
   OriginAccessEntry(const std::string& protocol,
                     const std::string& host,
                     const int32_t port,

third_party/blink/renderer/core/dom/document.cc

@@ -5135,7 +5135,7 @@ Document::EventFactorySet& Document::EventFactories() {
 const OriginAccessEntry& Document::AccessEntryFromURL() {
   if (!access_entry_from_url_) {
     access_entry_from_url_ = std::make_unique<OriginAccessEntry>(
-        Url().Protocol(), Url().Host(),
+        Url(),
         network::mojom::CorsOriginAccessMatchMode::kAllowRegistrableDomains);
   }
   return *access_entry_from_url_;
@@ -5397,9 +5397,11 @@ void Document::setDomain(const String& raw_domain,
     return;
   }
 
+  scoped_refptr<SecurityOrigin> new_origin =
+      GetSecurityOrigin()->IsolatedCopy();
+  new_origin->SetDomainFromDOM(new_domain);
   OriginAccessEntry access_entry(
-      GetSecurityOrigin()->Protocol(), new_domain,
-      network::mojom::CorsOriginAccessMatchMode::kAllowSubdomains);
+      *new_origin, network::mojom::CorsOriginAccessMatchMode::kAllowSubdomains);
   network::cors::OriginAccessEntry::MatchResult result =
       access_entry.MatchesOrigin(*GetSecurityOrigin());
   if (result == network::cors::OriginAccessEntry::kDoesNotMatchOrigin) {
@@ -5509,7 +5511,7 @@ const KURL Document::SiteForCookies() const {
   base::Optional<OriginAccessEntry> remote_entry;
   if (!top_local_frame) {
     remote_entry.emplace(
-        top_document_url.Protocol(), top_document_url.Host(),
+        top_document_url,
         network::mojom::CorsOriginAccessMatchMode::kAllowRegistrableDomains);
   }
   const OriginAccessEntry& access_entry =

third_party/blink/renderer/modules/credentialmanager/credentials_container.cc

@@ -165,12 +165,11 @@ bool CheckPublicKeySecurityRequirements(ScriptPromiseResolver* resolver,
   String effective_domain = origin->Domain();
 
   // TODO(crbug.com/803077): Avoid constructing an OriginAccessEntry just
-  // for the IP address check.
+  // for the IP address check. See also crbug.com/827542.
   bool reject_because_invalid_domain = effective_domain.IsEmpty();
   if (!reject_because_invalid_domain) {
     OriginAccessEntry access_entry(
-        origin->Protocol(), effective_domain,
-        network::mojom::CorsOriginAccessMatchMode::kAllowSubdomains);
+        *origin, network::mojom::CorsOriginAccessMatchMode::kAllowSubdomains);
     reject_because_invalid_domain = access_entry.HostIsIPAddress();
   }
   if (reject_because_invalid_domain) {
@@ -184,8 +183,11 @@ bool CheckPublicKeySecurityRequirements(ScriptPromiseResolver* resolver,
   // https://w3c.github.io/webauthn/#CreateCred-DetermineRpId and
   // https://w3c.github.io/webauthn/#GetAssn-DetermineRpId.
   if (!relying_party_id.IsNull()) {
+    scoped_refptr<SecurityOrigin> relaying_party_origin =
+        origin->IsolatedCopy();
+    relaying_party_origin->SetDomainFromDOM(relying_party_id);
     OriginAccessEntry access_entry(
-        origin->Protocol(), relying_party_id,
+        *relaying_party_origin,
         network::mojom::CorsOriginAccessMatchMode::kAllowSubdomains);
     if (relying_party_id.IsEmpty() ||
         access_entry.MatchesDomain(*origin) !=

third_party/blink/renderer/platform/weborigin/origin_access_entry.cc

@@ -31,18 +31,29 @@
 #include "third_party/blink/renderer/platform/weborigin/origin_access_entry.h"
 
 #include "services/network/public/mojom/cors.mojom-shared.h"
+#include "third_party/blink/renderer/platform/weborigin/known_ports.h"
+#include "third_party/blink/renderer/platform/weborigin/kurl.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
 
 namespace blink {
 
 OriginAccessEntry::OriginAccessEntry(
-    const String& protocol,
-    const String& host,
+    const SecurityOrigin& origin,
     network::mojom::CorsOriginAccessMatchMode match_mode,
     network::mojom::CorsOriginAccessMatchPriority priority)
-    : private_(protocol.Ascii().data(),
-               host.Ascii().data(),
-               network::cors::OriginAccessEntry::kPortAny,
+    : private_(origin.Protocol().Ascii().data(),
+               origin.Domain().Ascii().data(),
+               origin.EffectivePort(),
+               match_mode,
+               priority) {}
+
+OriginAccessEntry::OriginAccessEntry(
+    const KURL& url,
+    network::mojom::CorsOriginAccessMatchMode match_mode,
+    network::mojom::CorsOriginAccessMatchPriority priority)
+    : private_(url.Protocol().Ascii().data(),
+               url.Host().Ascii().data(),
+               url.Port() ? url.Port() : DefaultPortForProtocol(url.Protocol()),
                match_mode,
                priority) {}
 

third_party/blink/renderer/platform/weborigin/origin_access_entry.h

@@ -38,30 +38,28 @@
 
 namespace blink {
 
+class KURL;
 class SecurityOrigin;
 
 // A class to wrap network::cors::OriginAccessEntry to use with Blink types.
+// Comments below explains only blink::OriginAccessEntry specific behaviors.
+// See also network::cors::OriginAccessEntry for detailed explanation.
 class PLATFORM_EXPORT OriginAccessEntry {
   USING_FAST_MALLOC(OriginAccessEntry);
 
  public:
-  // If host is empty string and MatchMode is not DisallowSubdomains, the entry
-  // will match all domains in the specified protocol.
-  // IPv6 addresses must include brackets (e.g.
-  // '[2001:db8:85a3::8a2e:370:7334]', not '2001:db8:85a3::8a2e:370:7334').
-  // An entry with a higher priority will win in case there are two conflicting
-  // entries.
-  // TODO(crbug.com/936900): Take a port.
   OriginAccessEntry(
-      const String& protocol,
-      const String& host,
+      const SecurityOrigin& origin,
+      network::mojom::CorsOriginAccessMatchMode,
+      network::mojom::CorsOriginAccessMatchPriority priority =
+          network::mojom::CorsOriginAccessMatchPriority::kDefaultPriority);
+  OriginAccessEntry(
+      const KURL& url,
       network::mojom::CorsOriginAccessMatchMode,
       network::mojom::CorsOriginAccessMatchPriority priority =
           network::mojom::CorsOriginAccessMatchPriority::kDefaultPriority);
   OriginAccessEntry(OriginAccessEntry&& from);
 
-  // MatchesOrigin requires a protocol match (e.g. 'http' != 'https') and a port
-  // match. MatchesDomain relaxes these constraints.
   network::cors::OriginAccessEntry::MatchResult MatchesOrigin(
       const SecurityOrigin&) const;
   network::cors::OriginAccessEntry::MatchResult MatchesDomain(

third_party/blink/renderer/platform/weborigin/security_origin.cc

@@ -277,7 +277,7 @@ String SecurityOrigin::RegistrableDomain() const {
     return String();
 
   OriginAccessEntry entry(
-      Protocol(), Host(),
+      *this,
       network::mojom::CorsOriginAccessMatchMode::kAllowRegistrableDomains);
   String domain = entry.registrable_domain();
   return domain.IsEmpty() ? String() : domain;