Reset the state of SWProviderHost when SXGRequestHandler handles the response.

I introduced skip_other_interceptors flag in crrev.com/c/1278433 to skip the
service worker handling of the synthesized redirection of signed exchange.
But this was wrong. We need to call ServiceWorkerProviderHost::SetDocumentUrl()
and SetTopmostFrameUrl() even after SignedExchangeRequestHandler started
handling the response to reject the service worker API calls from the page in
the signed exchange correctly. And also we need to call
SetControllerRegistration(null) to reset the controller state.

Bug: 894755,907712
Change-Id: Iace762636982429c23ec24d9af6a466468e4b9fb
Reviewed-on: https://chromium-review.googlesource.com/c/1347954Reviewed-by: Matt Falkenhagen <falken@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Commit-Queue: Tsuyoshi Horo <horo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#610381}

content/browser/loader/navigation_url_loader_impl.cc

@@ -515,14 +515,28 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
     }
 
     // The ResourceDispatcherHostImpl can be null in unit tests.
-    if (!intercepted && ResourceDispatcherHostImpl::Get()) {
-      ResourceDispatcherHostImpl::Get()->BeginNavigationRequest(
+    ResourceDispatcherHostImpl* rdh = ResourceDispatcherHostImpl::Get();
+    if (!intercepted && rdh) {
+      rdh->BeginNavigationRequest(
           resource_context_, url_request_context_getter->GetURLRequestContext(),
           upload_file_system_context, *request_info_,
           std::move(navigation_ui_data_), std::move(url_loader_client),
           std::move(url_loader), service_worker_navigation_handle_core,
           appcache_handle_core, options, resource_request_->priority,
           global_request_id_);
+
+      if (!blink::ServiceWorkerUtils::IsServicificationEnabled()) {
+        // Get the SWProviderHost for non-S13nSW path. For S13nSW path,
+        // |service_worker_provider_host_| must be set in
+        // CreateServiceWorkerInterceptor().
+        net::URLRequest* url_request = rdh->GetURLRequest(global_request_id_);
+        ServiceWorkerProviderHost* service_worker_provider_host =
+            ServiceWorkerRequestHandler::GetProviderHost(url_request);
+        if (service_worker_provider_host) {
+          service_worker_provider_host_ =
+              service_worker_provider_host->AsWeakPtr();
+        }
+      }
     }
 
     // TODO(arthursonzogni): Detect when the ResourceDispatcherHost didn't
@@ -1376,6 +1390,17 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
               new_interceptors;
           new_interceptors.push_back(std::move(interceptors_[i]));
           new_interceptors.swap(interceptors_);
+          if (service_worker_provider_host_) {
+            // Reset the state of ServiceWorkerProviderHost.
+            // Currently we don't support Service Worker in Signed Exchange
+            // pages. The page will not be controlled by service workers. And
+            // Service Worker related APIs will fail with NoDocumentURL error.
+            // TODO(crbug/898733): Support SignedExchange loading and Service
+            // Worker integration.
+            service_worker_provider_host_->SetControllerRegistration(
+                nullptr, false /* notify_controllerchange */);
+            service_worker_provider_host_->UpdateURLs(GURL(), GURL());
+          }
         }
         return true;
       }
@@ -1391,8 +1416,8 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
 
   std::unique_ptr<NavigationLoaderInterceptor> CreateServiceWorkerInterceptor(
       const NavigationRequestInfo& request_info,
-      ServiceWorkerNavigationHandleCore* service_worker_navigation_handle_core)
-      const {
+      ServiceWorkerNavigationHandleCore*
+          service_worker_navigation_handle_core) {
     const ResourceType resource_type = request_info.is_main_frame
                                            ? RESOURCE_TYPE_MAIN_FRAME
                                            : RESOURCE_TYPE_SUB_FRAME;
@@ -1408,7 +1433,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
         request_info.begin_params->skip_service_worker, resource_type,
         request_info.begin_params->request_context_type, frame_type,
         request_info.are_ancestors_secure, request_info.common_params.post_data,
-        web_contents_getter_);
+        web_contents_getter_, &service_worker_provider_host_);
   }
 
   std::unique_ptr<SignedExchangeRequestHandler>
@@ -1543,6 +1568,10 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
   // If true, redirect checks will be handled in a proxy, and not here.
   bool bypass_redirect_checks_;
 
+  // Used to reset the state of ServiceWorkerProviderHost when
+  // SignedExchangeRequestHandler will handle the response.
+  base::WeakPtr<ServiceWorkerProviderHost> service_worker_provider_host_;
+
   mutable base::WeakPtrFactory<URLLoaderRequestController> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(URLLoaderRequestController);

content/browser/service_worker/service_worker_request_handler.cc

@@ -146,7 +146,8 @@ ServiceWorkerRequestHandler::InitializeForNavigationNetworkService(
     network::mojom::RequestContextFrameType frame_type,
     bool is_parent_frame_secure,
     scoped_refptr<network::ResourceRequestBody> body,
-    base::RepeatingCallback<WebContents*()> web_contents_getter) {
+    base::RepeatingCallback<WebContents*()> web_contents_getter,
+    base::WeakPtr<ServiceWorkerProviderHost>* out_provider_host) {
   DCHECK(blink::ServiceWorkerUtils::IsServicificationEnabled());
   DCHECK(navigation_handle_core);
 
@@ -165,22 +166,22 @@ ServiceWorkerRequestHandler::InitializeForNavigationNetworkService(
     return nullptr;
 
   // Initialize the SWProviderHost.
-  base::WeakPtr<ServiceWorkerProviderHost> provider_host =
-      ServiceWorkerProviderHost::PreCreateNavigationHost(
-          context->AsWeakPtr(), is_parent_frame_secure,
-          std::move(web_contents_getter));
+  *out_provider_host = ServiceWorkerProviderHost::PreCreateNavigationHost(
+      context->AsWeakPtr(), is_parent_frame_secure,
+      std::move(web_contents_getter));
 
   std::unique_ptr<ServiceWorkerRequestHandler> handler(
-      provider_host->CreateRequestHandler(
-          network::mojom::FetchRequestMode::kNavigate,
-          network::mojom::FetchCredentialsMode::kInclude,
-          network::mojom::FetchRedirectMode::kManual,
-          std::string() /* integrity */, false /* keepalive */, resource_type,
-          request_context_type, frame_type, blob_storage_context->AsWeakPtr(),
-          body, skip_service_worker));
+      (*out_provider_host)
+          ->CreateRequestHandler(
+              network::mojom::FetchRequestMode::kNavigate,
+              network::mojom::FetchCredentialsMode::kInclude,
+              network::mojom::FetchRedirectMode::kManual,
+              std::string() /* integrity */, false /* keepalive */,
+              resource_type, request_context_type, frame_type,
+              blob_storage_context->AsWeakPtr(), body, skip_service_worker));
 
   navigation_handle_core->DidPreCreateProviderHost(
-      provider_host->provider_id());
+      (*out_provider_host)->provider_id());
 
   return base::WrapUnique<NavigationLoaderInterceptor>(handler.release());
 }

content/browser/service_worker/service_worker_request_handler.h

@@ -81,7 +81,8 @@ class CONTENT_EXPORT ServiceWorkerRequestHandler
       network::mojom::RequestContextFrameType frame_type,
       bool is_parent_frame_secure,
       scoped_refptr<network::ResourceRequestBody> body,
-      base::RepeatingCallback<WebContents*()> web_contents_getter);
+      base::RepeatingCallback<WebContents*()> web_contents_getter,
+      base::WeakPtr<ServiceWorkerProviderHost>* out_provider_host);
 
   static std::unique_ptr<NavigationLoaderInterceptor> InitializeForSharedWorker(
       const network::ResourceRequest& resource_request,

content/browser/service_worker/service_worker_request_handler_unittest.cc

@@ -169,6 +169,7 @@ class ServiceWorkerRequestHandlerTest : public testing::Test {
       bool expected_handler_created) {
     std::unique_ptr<ServiceWorkerNavigationHandleCore> navigation_handle_core =
         CreateNavigationHandleCore(helper_->context_wrapper());
+    base::WeakPtr<ServiceWorkerProviderHost> service_worker_provider_host;
     std::unique_ptr<NavigationLoaderInterceptor> interceptor =
         ServiceWorkerRequestHandler::InitializeForNavigationNetworkService(
             GURL(url), nullptr /* resource_context */,
@@ -177,7 +178,8 @@ class ServiceWorkerRequestHandlerTest : public testing::Test {
             blink::mojom::RequestContextType::HYPERLINK,
             network::mojom::RequestContextFrameType::kTopLevel,
             true /* is_parent_frame_secure */, nullptr /* body */,
-            base::RepeatingCallback<WebContents*(void)>());
+            base::RepeatingCallback<WebContents*(void)>(),
+            &service_worker_provider_host);
     return !!interceptor.get();
   }
 

content/browser/web_package/signed_exchange_request_handler_browsertest.cc

@@ -49,6 +49,7 @@
 #include "services/network/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock-matchers.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/common/service_worker/service_worker_utils.h"
 
 namespace content {
 
@@ -522,7 +523,8 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeRequestHandlerRealCertVerifierBrowserTest,
 
 enum class SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam {
   kLegacy,
-  kServiceWorkerServicification
+  kServiceWorkerServicification,
+  kNetworkService
 };
 
 class SignedExchangeRequestHandlerWithServiceWorkerBrowserTest
@@ -532,14 +534,23 @@ class SignedExchangeRequestHandlerWithServiceWorkerBrowserTest
  public:
   SignedExchangeRequestHandlerWithServiceWorkerBrowserTest() = default;
   void SetUp() override {
-    if (GetParam() ==
-        SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam ::
-            kServiceWorkerServicification) {
-      feature_list_.InitWithFeatures(
-          {blink::features::kServiceWorkerServicification}, {});
-    } else {
-      feature_list_.InitWithFeatures(
-          {}, {blink::features::kServiceWorkerServicification});
+    switch (GetParam()) {
+      case SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam::
+          kLegacy:
+        feature_list_.InitWithFeatures(
+            {}, {blink::features::kServiceWorkerServicification,
+                 network::features::kNetworkService});
+        break;
+      case SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam::
+          kServiceWorkerServicification:
+        feature_list_.InitWithFeatures(
+            {blink::features::kServiceWorkerServicification},
+            {network::features::kNetworkService});
+        break;
+      case SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam::
+          kNetworkService:
+        feature_list_.InitAndEnableFeature(network::features::kNetworkService);
+        break;
     }
     SignedExchangeRequestHandlerBrowserTestBase::SetUp();
   }
@@ -551,16 +562,11 @@ class SignedExchangeRequestHandlerWithServiceWorkerBrowserTest
       SignedExchangeRequestHandlerWithServiceWorkerBrowserTest);
 };
 
-INSTANTIATE_TEST_CASE_P(
-    SignedExchangeRequestHandlerWithServiceWorkerBrowserTest,
-    SignedExchangeRequestHandlerWithServiceWorkerBrowserTest,
-    testing::Values(
-        SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam::kLegacy,
-        SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam::
-            kServiceWorkerServicification));
-
 IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerWithServiceWorkerBrowserTest,
-                       Simple) {
+                       LogicalUrlInServiceWorkerScope) {
+  // SW-scope: https://test.example.org/test/
+  // SXG physical URL: http://127.0.0.1:PORT/sxg/test.example.org_test.sxg
+  // SXG logical URL: https://test.example.org/test/
   InstallUrlInterceptor(
       GURL("https://cert.example.org/cert.msg"),
       "content/test/data/sxg/test.example.org.public.pem.cbor");
@@ -589,9 +595,134 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerWithServiceWorkerBrowserTest,
   TitleWatcher title_watcher(shell()->web_contents(), title);
   title_watcher.AlsoWaitForTitle(base::ASCIIToUTF16("Generated"));
   NavigateToURL(shell(), url);
+  // The page content shoud be served from the signed exchange.
+  EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
+}
+
+IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerWithServiceWorkerBrowserTest,
+                       NotControlledByDistributorsSW) {
+  // SW-scope: http://127.0.0.1:PORT/sxg/
+  // SXG physical URL: http://127.0.0.1:PORT/sxg/test.example.org_test.sxg
+  // SXG logical URL: https://test.example.org/test/
+  InstallUrlInterceptor(
+      GURL("https://cert.example.org/cert.msg"),
+      "content/test/data/sxg/test.example.org.public.pem.cbor");
+  InstallMockCert();
+  embedded_test_server()->ServeFilesFromSourceDirectory("content/test/data");
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  const GURL install_sw_url = embedded_test_server()->GetURL(
+      "/sxg/no-respond-with-service-worker.html");
+
+  {
+    base::string16 title = base::ASCIIToUTF16("Done");
+    TitleWatcher title_watcher(shell()->web_contents(), title);
+    NavigateToURL(shell(), install_sw_url);
+    EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
+  }
+
+  base::string16 title = base::ASCIIToUTF16("https://test.example.org/test/");
+  TitleWatcher title_watcher(shell()->web_contents(), title);
+  NavigateToURL(shell(), embedded_test_server()->GetURL(
+                             "/sxg/test.example.org_test.sxg"));
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
+
+  // The page must not be controlled by the service worker of the physical URL.
+  EXPECT_EQ(false, EvalJs(shell(), "!!navigator.serviceWorker.controller"));
 }
 
+IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerWithServiceWorkerBrowserTest,
+                       NotControlledBySameOriginDistributorsSW) {
+  // SW-scope: https://test.example.org/scope/
+  // SXG physical URL: https://test.example.org/scope/test.example.org_test.sxg
+  // SXG logical URL: https://test.example.org/test/
+  InstallUrlInterceptor(
+      GURL("https://cert.example.org/cert.msg"),
+      "content/test/data/sxg/test.example.org.public.pem.cbor");
+  InstallMockCert();
+
+  InstallUrlInterceptor(GURL("https://test.example.org/scope/test.sxg"),
+                        "content/test/data/sxg/test.example.org_test.sxg");
+
+  const GURL install_sw_url = GURL(
+      "https://test.example.org/scope/no-respond-with-service-worker.html");
+
+  InstallUrlInterceptor(
+      install_sw_url,
+      "content/test/data/sxg/no-respond-with-service-worker.html");
+  InstallUrlInterceptor(
+      GURL("https://test.example.org/scope/no-respond-with-service-worker.js"),
+      "content/test/data/sxg/no-respond-with-service-worker.js");
+
+  {
+    base::string16 title = base::ASCIIToUTF16("Done");
+    TitleWatcher title_watcher(shell()->web_contents(), title);
+    NavigateToURL(shell(), install_sw_url);
+    EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
+  }
+
+  base::string16 title = base::ASCIIToUTF16("https://test.example.org/test/");
+  TitleWatcher title_watcher(shell()->web_contents(), title);
+  NavigateToURL(shell(), GURL("https://test.example.org/scope/test.sxg"));
+  EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
+
+  // The page must not be controlled by the service worker of the physical URL.
+  EXPECT_EQ(false, EvalJs(shell(), "!!navigator.serviceWorker.controller"));
+}
+
+IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerWithServiceWorkerBrowserTest,
+                       RegisterServiceWorkerFromSignedExchange) {
+  // SXG physical URL: http://127.0.0.1:PORT/sxg/test.example.org_test.sxg
+  // SXG logical URL: https://test.example.org/test/
+  InstallUrlInterceptor(
+      GURL("https://cert.example.org/cert.msg"),
+      "content/test/data/sxg/test.example.org.public.pem.cbor");
+  InstallMockCert();
+
+  InstallUrlInterceptor(
+      GURL("https://test.example.org/test/publisher-service-worker.js"),
+      "content/test/data/sxg/publisher-service-worker.js");
+
+  embedded_test_server()->ServeFilesFromSourceDirectory("content/test/data");
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  GURL url = embedded_test_server()->GetURL("/sxg/test.example.org_test.sxg");
+
+  {
+    base::string16 title = base::ASCIIToUTF16("https://test.example.org/test/");
+    TitleWatcher title_watcher(shell()->web_contents(), title);
+    NavigateToURL(shell(), url);
+    EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
+  }
+
+  const std::string register_sw_script =
+      "(async function() {"
+      "  try {"
+      "    const registration = await navigator.serviceWorker.register("
+      "        'publisher-service-worker.js', {scope: './'});"
+      "    window.domAutomationController.send(true);"
+      "  } catch (e) {"
+      "    window.domAutomationController.send(false);"
+      "  }"
+      "})();";
+  bool result = false;
+  EXPECT_TRUE(ExecuteScriptAndExtractBool(shell()->web_contents(),
+                                          register_sw_script, &result));
+  // serviceWorker.register() fails because the document URL of
+  // ServiceWorkerProviderHost is empty.
+  EXPECT_FALSE(result);
+}
+
+INSTANTIATE_TEST_CASE_P(
+    SignedExchangeRequestHandlerWithServiceWorkerBrowserTest,
+    SignedExchangeRequestHandlerWithServiceWorkerBrowserTest,
+    testing::Values(
+        SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam::kLegacy,
+        SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam::
+            kServiceWorkerServicification,
+        SignedExchangeRequestHandlerWithServiceWorkerBrowserTestParam::
+            kNetworkService));
+
 struct SignedExchangeAcceptHeaderBrowserTestParam {
   SignedExchangeAcceptHeaderBrowserTestParam(
       bool sxg_enabled,

content/test/data/sxg/no-respond-with-service-worker.html

+<script>
+async function register(script, scope) {
+  const registration = await navigator.serviceWorker.register(
+      script, {scope: scope});
+  await new Promise(resolve =>
+    registration.installing.addEventListener('statechange', resolve));
+}
+async function initialize() {
+  await register('no-respond-with-service-worker.js', './');
+  document.title = 'Done';
+}
+initialize();
+</script>

content/test/data/sxg/no-respond-with-service-worker.js

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+self.addEventListener('fetch', (event) => {
+});

content/test/data/sxg/no-respond-with-service-worker.js.mock-http-headers

+HTTP/1.1 200 OK
+Content-Type: application/javascript