Skip to content

GitLab

T
tangled
Commit e4b5dc98 authored by Lukasz Anforowicz's avatar Lukasz Anforowicz Committed by Commit Bot
Browse files
Options

XSDB should also protect filesystem:... and blob:... URIs. 

Bug: 804957
Change-Id: I2d2cccf2e77ad44305af1601e52c6ae80e062d7d
Reviewed-on: https://chromium-review.googlesource.com/882450
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Reviewed-by: default avatarAlex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531936}
parent b6c42954
Show whitespace changes
Inline Side-by-side
Showing with 67 additions and 4 deletions
content/browser/loader/cross_site_document_resource_handler.cc
View file @ e4b5dc98
...@@ -495,6 +495,7 @@ bool CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders( ...@@ -495,6 +495,7 @@ bool CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders(
// quickly as possible. Checks that are likely to lead to returning false or // quickly as possible. Checks that are likely to lead to returning false or
// that are inexpensive should be near the top. // that are inexpensive should be near the top.
const GURL& url = request()->url(); const GURL& url = request()->url();
url::Origin target_origin = url::Origin::Create(url);
// Check if the response's site needs to have its documents protected. By // Check if the response's site needs to have its documents protected. By
// default, this will usually return false. // default, this will usually return false.
...@@ -507,7 +508,7 @@ bool CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders( ...@@ -507,7 +508,7 @@ bool CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders(
case SiteIsolationPolicy::XSDB_ENABLED_IF_ISOLATED: case SiteIsolationPolicy::XSDB_ENABLED_IF_ISOLATED:
if (!SiteIsolationPolicy::UseDedicatedProcessesForAllSites() && if (!SiteIsolationPolicy::UseDedicatedProcessesForAllSites() &&
!ChildProcessSecurityPolicyImpl::GetInstance()->IsIsolatedOrigin( !ChildProcessSecurityPolicyImpl::GetInstance()->IsIsolatedOrigin(
url::Origin::Create(url))) { target_origin)) {
return false; return false;
} }
break; break;
...@@ -531,11 +532,13 @@ bool CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders( ...@@ -531,11 +532,13 @@ bool CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders(
initiator = request()->initiator().value(); initiator = request()->initiator().value();
// Don't block same-origin documents. // Don't block same-origin documents.
if (initiator.IsSameOriginWith(url::Origin::Create(url))) if (initiator.IsSameOriginWith(target_origin))
return false; return false;
// Only block documents from HTTP(S) schemes. // Only block documents from HTTP(S) schemes. Checking the scheme of
if (!CrossSiteDocumentClassifier::IsBlockableScheme(url)) // |target_origin| ensures that we also protect content of blob: and
// filesystem: URLs if their nested origins have a HTTP(S) scheme.
if (!CrossSiteDocumentClassifier::IsBlockableScheme(target_origin.GetURL()))
return false; return false;
// Allow requests from file:// URLs for now. // Allow requests from file:// URLs for now.
......
content/browser/loader/cross_site_document_resource_handler_unittest.cc
View file @ e4b5dc98
...@@ -582,6 +582,36 @@ const TestScenario kScenarios[] = { ...@@ -582,6 +582,36 @@ const TestScenario kScenarios[] = {
Verdict::kAllow, // verdict Verdict::kAllow, // verdict
0, // verdict_packet 0, // verdict_packet
}, },
{
"Allowed: Same-site XHR to a filesystem URI",
__LINE__,
"filesystem:http://www.a.com/file.html", // target_url
RESOURCE_TYPE_XHR, // resource_type
"http://www.a.com/", // initiator_origin
OriginHeader::kOmit, // cors_request
"text/html", // response_mime_type
CROSS_SITE_DOCUMENT_MIME_TYPE_HTML, // canonical_mime_type
false, // include_no_sniff_header
AccessControlAllowOriginHeader::kOmit, // cors_response
{"<html><head>this should sniff as HTML"}, // packets
Verdict::kAllow, // verdict
-1, // verdict_packet
},
{
"Allowed: Same-site XHR to a blob URI",
__LINE__,
"blob:http://www.a.com/guid-goes-here", // target_url
RESOURCE_TYPE_XHR, // resource_type
"http://www.a.com/", // initiator_origin
OriginHeader::kOmit, // cors_request
"text/html", // response_mime_type
CROSS_SITE_DOCUMENT_MIME_TYPE_HTML, // canonical_mime_type
false, // include_no_sniff_header
AccessControlAllowOriginHeader::kOmit, // cors_response
{"<html><head>this should sniff as HTML"}, // packets
Verdict::kAllow, // verdict
-1, // verdict_packet
},
// Blocked responses (without sniffing): // Blocked responses (without sniffing):
{ {
...@@ -911,6 +941,36 @@ const TestScenario kScenarios[] = { ...@@ -911,6 +941,36 @@ const TestScenario kScenarios[] = {
Verdict::kBlock, // verdict Verdict::kBlock, // verdict
0, // verdict_packet 0, // verdict_packet
}, },
{
"Blocked: Cross-site XHR to a filesystem URI",
__LINE__,
"filesystem:http://www.b.com/file.html", // target_url
RESOURCE_TYPE_XHR, // resource_type
"http://www.a.com/", // initiator_origin
OriginHeader::kOmit, // cors_request
"text/html", // response_mime_type
CROSS_SITE_DOCUMENT_MIME_TYPE_HTML, // canonical_mime_type
false, // include_no_sniff_header
AccessControlAllowOriginHeader::kOmit, // cors_response
{"<html><head>this should sniff as HTML"}, // packets
Verdict::kBlock, // verdict
0, // verdict_packet
},
{
"Blocked: Cross-site XHR to a blob URI",
__LINE__,
"blob:http://www.b.com/guid-goes-here", // target_url
RESOURCE_TYPE_XHR, // resource_type
"http://www.a.com/", // initiator_origin
OriginHeader::kOmit, // cors_request
"text/html", // response_mime_type
CROSS_SITE_DOCUMENT_MIME_TYPE_HTML, // canonical_mime_type
false, // include_no_sniff_header
AccessControlAllowOriginHeader::kOmit, // cors_response
{"<html><head>this should sniff as HTML"}, // packets
Verdict::kBlock, // verdict
0, // verdict_packet
},
}; };
} // namespace } // namespace
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment