PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff)
{
if (!frame)
return 0;
FrameLoader* fl = frame->loader();
if (securityCheck == DoSecurityCheck && (fl->state() == FrameStateProvisional || !fl->activeDocumentLoader() || fl->activeDocumentLoader()->isStopping()))
return 0;
ResourceRequest newRequest = request;
if (securityCheck == DoSecurityCheck && !frame->document()->securityOrigin()->canDisplay(request.url())) {
FrameLoader::reportLocalLoadFailed(frame, request.url().string());
return 0;
}
if (SecurityOrigin::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
newRequest.clearHTTPReferrer();
else if (!request.httpReferrer())
newRequest.setHTTPReferrer(fl->outgoingReferrer());
FrameLoader::addHTTPOriginIfNeeded(newRequest, fl->outgoingOrigin());
fl->addExtraFieldsToSubresourceRequest(newRequest);
RefPtr<SubresourceLoader> subloader(adoptRef(new SubresourceLoader(frame, client, sendResourceLoadCallbacks, shouldContentSniff)));
subloader->documentLoader()->addSubresourceLoader(subloader.get());
if (!subloader->load(newRequest))
return 0;
return subloader.release();
}
void FrameFetchContext::addAdditionalRequestHeaders(Document* document, ResourceRequest& request, FetchResourceType type)
{
bool isMainResource = type == FetchMainResource;
if (!isMainResource) {
String outgoingReferrer;
String outgoingOrigin;
if (request.httpReferrer().isNull()) {
outgoingReferrer = document->outgoingReferrer();
outgoingOrigin = document->outgoingOrigin();
} else {
outgoingReferrer = request.httpReferrer();
outgoingOrigin = SecurityOrigin::createFromString(outgoingReferrer)->toString();
}
outgoingReferrer = SecurityPolicy::generateReferrerHeader(document->referrerPolicy(), request.url(), outgoingReferrer);
if (outgoingReferrer.isEmpty())
request.clearHTTPReferrer();
else if (!request.httpReferrer())
request.setHTTPReferrer(Referrer(outgoingReferrer, document->referrerPolicy()));
request.addHTTPOriginIfNeeded(AtomicString(outgoingOrigin));
}
// The remaining modifications are only necessary for HTTP and HTTPS.
if (!request.url().isEmpty() && !request.url().protocolIsInHTTPFamily())
return;
m_frame->loader().applyUserAgent(request);
}
ResourceRequest ResourceHandleCFURLConnectionDelegate::createResourceRequest(CFURLRequestRef cfRequest, CFURLResponseRef redirectResponse)
{
ResourceRequest request;
CFHTTPMessageRef httpMessage = CFURLResponseGetHTTPResponse(redirectResponse);
if (httpMessage && CFHTTPMessageGetResponseStatusCode(httpMessage) == 307) {
RetainPtr<CFStringRef> lastHTTPMethod = m_handle->lastHTTPMethod().createCFString();
RetainPtr<CFStringRef> newMethod = adoptCF(CFURLRequestCopyHTTPRequestMethod(cfRequest));
if (CFStringCompareWithOptions(lastHTTPMethod.get(), newMethod.get(), CFRangeMake(0, CFStringGetLength(lastHTTPMethod.get())), kCFCompareCaseInsensitive)) {
RetainPtr<CFMutableURLRequestRef> mutableRequest = adoptCF(CFURLRequestCreateMutableCopy(0, cfRequest));
wkSetRequestStorageSession(m_handle->storageSession(), mutableRequest.get());
CFURLRequestSetHTTPRequestMethod(mutableRequest.get(), lastHTTPMethod.get());
FormData* body = m_handle->firstRequest().httpBody();
if (!equalIgnoringCase(m_handle->firstRequest().httpMethod(), "GET") && body && !body->isEmpty())
WebCore::setHTTPBody(mutableRequest.get(), body);
String originalContentType = m_handle->firstRequest().httpContentType();
if (!originalContentType.isEmpty())
CFURLRequestSetHTTPHeaderFieldValue(mutableRequest.get(), CFSTR("Content-Type"), originalContentType.createCFString().get());
request = mutableRequest.get();
}
}
if (request.isNull())
request = cfRequest;
if (!request.url().protocolIs("https") && protocolIs(request.httpReferrer(), "https") && m_handle->context()->shouldClearReferrerOnHTTPSToHTTPRedirect())
request.clearHTTPReferrer();
return request;
}
static CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef cfRequest, CFURLResponseRef cfRedirectResponse, const void* clientInfo)
{
#if LOG_DISABLED
UNUSED_PARAM(conn);
#endif
ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
if (!cfRedirectResponse) {
CFRetain(cfRequest);
return cfRequest;
}
LOG(Network, "CFNet - willSendRequest(conn=%p, handle=%p) (%s)", conn, handle, handle->firstRequest().url().string().utf8().data());
ResourceRequest request;
if (cfRedirectResponse) {
CFHTTPMessageRef httpMessage = CFURLResponseGetHTTPResponse(cfRedirectResponse);
if (httpMessage && CFHTTPMessageGetResponseStatusCode(httpMessage) == 307) {
RetainPtr<CFStringRef> lastHTTPMethod(AdoptCF, handle->lastHTTPMethod().createCFString());
RetainPtr<CFStringRef> newMethod(AdoptCF, CFURLRequestCopyHTTPRequestMethod(cfRequest));
if (CFStringCompareWithOptions(lastHTTPMethod.get(), newMethod.get(), CFRangeMake(0, CFStringGetLength(lastHTTPMethod.get())), kCFCompareCaseInsensitive)) {
RetainPtr<CFMutableURLRequestRef> mutableRequest(AdoptCF, CFURLRequestCreateMutableCopy(0, cfRequest));
#if USE(CFURLSTORAGESESSIONS)
wkSetRequestStorageSession(ResourceHandle::currentStorageSession(), mutableRequest.get());
#endif
CFURLRequestSetHTTPRequestMethod(mutableRequest.get(), lastHTTPMethod.get());
FormData* body = handle->firstRequest().httpBody();
if (!equalIgnoringCase(handle->firstRequest().httpMethod(), "GET") && body && !body->isEmpty())
WebCore::setHTTPBody(mutableRequest.get(), body);
String originalContentType = handle->firstRequest().httpContentType();
RetainPtr<CFStringRef> originalContentTypeCF(AdoptCF, originalContentType.createCFString());
if (!originalContentType.isEmpty())
CFURLRequestSetHTTPHeaderFieldValue(mutableRequest.get(), CFSTR("Content-Type"), originalContentTypeCF.get());
request = mutableRequest.get();
}
}
}
if (request.isNull())
request = cfRequest;
// Should not set Referer after a redirect from a secure resource to non-secure one.
if (!request.url().protocolIs("https") && protocolIs(request.httpReferrer(), "https"))
request.clearHTTPReferrer();
handle->willSendRequest(request, cfRedirectResponse);
if (request.isNull())
return 0;
cfRequest = request.cfURLRequest();
CFRetain(cfRequest);
return cfRequest;
}
void DocumentThreadableLoader::redirectReceived(CachedResource* resource, ResourceRequest& request, const ResourceResponse& redirectResponse)
{
ASSERT(m_client);
ASSERT_UNUSED(resource, resource == m_resource);
RefPtr<DocumentThreadableLoader> protect(this);
// Allow same origin requests to continue after allowing clients to audit the redirect.
if (isAllowedRedirect(request.url())) {
if (m_client->isDocumentThreadableLoaderClient())
static_cast<DocumentThreadableLoaderClient*>(m_client)->willSendRequest(request, redirectResponse);
return;
}
// When using access control, only simple cross origin requests are allowed to redirect. The new request URL must have a supported
// scheme and not contain the userinfo production. In addition, the redirect response must pass the access control check.
if (m_options.crossOriginRequestPolicy == UseAccessControl) {
bool allowRedirect = false;
if (m_simpleRequest) {
String accessControlErrorDescription;
allowRedirect = SchemeRegistry::shouldTreatURLSchemeAsCORSEnabled(request.url().protocol())
&& request.url().user().isEmpty()
&& request.url().pass().isEmpty()
&& passesAccessControlCheck(redirectResponse, m_options.allowCredentials, securityOrigin(), accessControlErrorDescription);
}
if (allowRedirect) {
if (m_resource)
clearResource();
RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::createFromString(redirectResponse.url());
RefPtr<SecurityOrigin> requestOrigin = SecurityOrigin::createFromString(request.url());
// If the request URL origin is not same origin with the original URL origin, set source origin to a globally unique identifier.
if (!originalOrigin->isSameSchemeHostPort(requestOrigin.get()))
m_options.securityOrigin = SecurityOrigin::createUnique();
// Force any subsequent requests to use these checks.
m_sameOriginRequest = false;
// Remove any headers that may have been added by the network layer that cause access control to fail.
request.clearHTTPContentType();
request.clearHTTPReferrer();
request.clearHTTPOrigin();
request.clearHTTPUserAgent();
request.clearHTTPAccept();
makeCrossOriginAccessRequest(request);
return;
}
}
m_client->didFailRedirectCheck();
request = ResourceRequest();
}
PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff, bool shouldBufferData)
{
if (!frame)
return 0;
FrameLoader* fl = frame->loader();
if (securityCheck == DoSecurityCheck && (fl->state() == FrameStateProvisional || !fl->activeDocumentLoader() || fl->activeDocumentLoader()->isStopping()))
return 0;
ResourceRequest newRequest = request;
if (securityCheck == DoSecurityCheck && !frame->document()->securityOrigin()->canDisplay(request.url())) {
FrameLoader::reportLocalLoadFailed(frame, request.url().string());
return 0;
}
// Note: We skip the Content-Security-Policy check here because we check
// the Content-Security-Policy at the CachedResourceLoader layer so we can
// handle different resource types differently.
String outgoingReferrer;
String outgoingOrigin;
if (request.httpReferrer().isNull()) {
outgoingReferrer = fl->outgoingReferrer();
outgoingOrigin = fl->outgoingOrigin();
} else {
outgoingReferrer = request.httpReferrer();
outgoingOrigin = SecurityOrigin::createFromString(outgoingReferrer)->toString();
}
if (SecurityOrigin::shouldHideReferrer(request.url(), outgoingReferrer))
newRequest.clearHTTPReferrer();
else if (!request.httpReferrer())
newRequest.setHTTPReferrer(outgoingReferrer);
FrameLoader::addHTTPOriginIfNeeded(newRequest, outgoingOrigin);
fl->addExtraFieldsToSubresourceRequest(newRequest);
RefPtr<SubresourceLoader> subloader(adoptRef(new SubresourceLoader(frame, client, sendResourceLoadCallbacks, shouldContentSniff)));
subloader->setShouldBufferData(shouldBufferData);
subloader->documentLoader()->addSubresourceLoader(subloader.get());
if (!subloader->init(newRequest))
return 0;
return subloader.release();
}
// Called each time the message is going to be sent again except the first time.
// It's used mostly to let webkit know about redirects.
static void restartedCallback(SoupMessage* msg, gpointer data)
{
ResourceHandle* handle = static_cast<ResourceHandle*>(data);
if (!handle)
return;
ResourceHandleInternal* d = handle->getInternal();
if (d->m_cancelled)
return;
char* uri = soup_uri_to_string(soup_message_get_uri(msg), false);
String location = String(uri);
g_free(uri);
KURL newURL = KURL(handle->request().url(), location);
ResourceRequest request = handle->request();
ResourceResponse response;
request.setURL(newURL);
request.setHTTPMethod(msg->method);
fillResponseFromMessage(msg, &response);
// Should not set Referer after a redirect from a secure resource to non-secure one.
if (!request.url().protocolIs("https") && protocolIs(request.httpReferrer(), "https")) {
request.clearHTTPReferrer();
soup_message_headers_remove(msg->request_headers, "Referer");
}
if (d->client())
d->client()->willSendRequest(handle, request, response);
if (d->m_cancelled)
return;
#ifdef HAVE_LIBSOUP_2_29_90
// Update the first party in case the base URL changed with the redirect
String firstPartyString = request.firstPartyForCookies().string();
if (!firstPartyString.isEmpty()) {
GOwnPtr<SoupURI> firstParty(soup_uri_new(firstPartyString.utf8().data()));
soup_message_set_first_party(d->m_msg, firstParty.get());
}
#endif
}
PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, CachedResource* resource, const ResourceRequest& request, const ResourceLoaderOptions& options)
{
if (!frame)
return 0;
FrameLoader* frameLoader = frame->loader();
if (options.securityCheck == DoSecurityCheck && (frameLoader->state() == FrameStateProvisional || !frameLoader->activeDocumentLoader() || frameLoader->activeDocumentLoader()->isStopping()))
return 0;
ResourceRequest newRequest = request;
// Note: We skip the Content-Security-Policy check here because we check
// the Content-Security-Policy at the CachedResourceLoader layer so we can
// handle different resource types differently.
String outgoingReferrer;
String outgoingOrigin;
if (request.httpReferrer().isNull()) {
outgoingReferrer = frameLoader->outgoingReferrer();
outgoingOrigin = frameLoader->outgoingOrigin();
} else {
outgoingReferrer = request.httpReferrer();
outgoingOrigin = SecurityOrigin::createFromString(outgoingReferrer)->toString();
}
outgoingReferrer = SecurityPolicy::generateReferrerHeader(frame->document()->referrerPolicy(), request.url(), outgoingReferrer);
if (outgoingReferrer.isEmpty())
newRequest.clearHTTPReferrer();
else if (!request.httpReferrer())
newRequest.setHTTPReferrer(outgoingReferrer);
FrameLoader::addHTTPOriginIfNeeded(newRequest, outgoingOrigin);
frameLoader->addExtraFieldsToSubresourceRequest(newRequest);
RefPtr<SubresourceLoader> subloader(adoptRef(new SubresourceLoader(frame, resource, options)));
if (!subloader->init(newRequest))
return 0;
return subloader.release();
}
// In this method, we can clear |request| to tell content::WebURLLoaderImpl of
// Chromium not to follow the redirect. This works only when this method is
// called by RawResource::willSendRequest(). If called by
// RawResource::didAddClient(), clearing |request| won't be propagated
// to content::WebURLLoaderImpl. So, this loader must also get detached from
// the resource by calling clearResource().
void DocumentThreadableLoader::redirectReceived(Resource* resource, ResourceRequest& request, const ResourceResponse& redirectResponse)
{
ASSERT(m_client);
ASSERT_UNUSED(resource, resource == this->resource());
ASSERT(m_async);
if (!m_actualRequest.isNull()) {
reportResponseReceived(resource->identifier(), redirectResponse);
handlePreflightFailure(redirectResponse.url().string(), "Response for preflight is invalid (redirect)");
// |this| may be dead here.
request = ResourceRequest();
return;
}
if (m_redirectMode == WebURLRequest::FetchRedirectModeManual) {
// Keep |this| alive even if the client release a reference in
// responseReceived().
RefPtr<DocumentThreadableLoader> protect(this);
// We use |m_redirectMode| to check the original redirect mode.
// |request| is a new request for redirect. So we don't set the redirect
// mode of it in WebURLLoaderImpl::Context::OnReceivedRedirect().
ASSERT(request.useStreamOnResponse());
// There is no need to read the body of redirect response because there
// is no way to read the body of opaque-redirect filtered response's
// internal response.
// TODO(horo): If we support any API which expose the internal body, we
// will have to read the body. And also HTTPCache changes will be needed
// because it doesn't store the body of redirect responses.
responseReceived(resource, redirectResponse, adoptPtr(new EmptyDataHandle()));
if (m_client) {
ASSERT(m_actualRequest.isNull());
notifyFinished(resource);
}
request = ResourceRequest();
return;
}
if (m_redirectMode == WebURLRequest::FetchRedirectModeError || !isAllowedByContentSecurityPolicy(request.url(), ContentSecurityPolicy::DidRedirect)) {
ThreadableLoaderClient* client = m_client;
clear();
client->didFailRedirectCheck();
// |this| may be dead here.
request = ResourceRequest();
return;
}
// Allow same origin requests to continue after allowing clients to audit the redirect.
if (isAllowedRedirect(request.url())) {
if (m_client->isDocumentThreadableLoaderClient())
static_cast<DocumentThreadableLoaderClient*>(m_client)->willFollowRedirect(request, redirectResponse);
return;
}
if (m_corsRedirectLimit <= 0) {
ThreadableLoaderClient* client = m_client;
clear();
client->didFailRedirectCheck();
// |this| may be dead here.
} else if (m_options.crossOriginRequestPolicy == UseAccessControl) {
--m_corsRedirectLimit;
InspectorInstrumentation::didReceiveCORSRedirectResponse(document().frame(), resource->identifier(), document().frame()->loader().documentLoader(), redirectResponse, 0);
bool allowRedirect = false;
String accessControlErrorDescription;
// Non-simple cross origin requests (both preflight and actual one) are
// not allowed to follow redirect.
if (m_crossOriginNonSimpleRequest) {
accessControlErrorDescription = "The request was redirected to '"+ request.url().string() + "', which is disallowed for cross-origin requests that require preflight.";
} else {
// The redirect response must pass the access control check if the
// original request was not same-origin.
allowRedirect = CrossOriginAccessControl::isLegalRedirectLocation(request.url(), accessControlErrorDescription)
&& (m_sameOriginRequest || passesAccessControlCheck(redirectResponse, effectiveAllowCredentials(), securityOrigin(), accessControlErrorDescription, m_requestContext));
}
if (allowRedirect) {
// FIXME: consider combining this with CORS redirect handling performed by
// CrossOriginAccessControl::handleRedirect().
clearResource();
RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::create(redirectResponse.url());
RefPtr<SecurityOrigin> requestOrigin = SecurityOrigin::create(request.url());
// If the original request wasn't same-origin, then if the request URL origin is not same origin with the original URL origin,
// set the source origin to a globally unique identifier. (If the original request was same-origin, the origin of the new request
// should be the original URL origin.)
if (!m_sameOriginRequest && !originalOrigin->isSameSchemeHostPort(requestOrigin.get()))
m_securityOrigin = SecurityOrigin::createUnique();
// Force any subsequent requests to use these checks.
m_sameOriginRequest = false;
// Since the request is no longer same-origin, if the user didn't request credentials in
// the first place, update our state so we neither request them nor expect they must be allowed.
if (m_resourceLoaderOptions.credentialsRequested == ClientDidNotRequestCredentials)
m_forceDoNotAllowStoredCredentials = true;
// Remove any headers that may have been added by the network layer that cause access control to fail.
request.clearHTTPReferrer();
request.clearHTTPOrigin();
request.clearHTTPUserAgent();
// Add any CORS simple request headers which we previously saved from the original request.
for (const auto& header : m_simpleRequestHeaders)
request.setHTTPHeaderField(header.key, header.value);
makeCrossOriginAccessRequest(request);
// |this| may be dead here.
return;
}
ThreadableLoaderClient* client = m_client;
clear();
client->didFailAccessControlCheck(ResourceError(errorDomainBlinkInternal, 0, redirectResponse.url().string(), accessControlErrorDescription));
// |this| may be dead here.
} else {
ThreadableLoaderClient* client = m_client;
clear();
client->didFailRedirectCheck();
// |this| may be dead here.
}
request = ResourceRequest();
}
void DocumentThreadableLoader::redirectReceived(Resource* resource, ResourceRequest& request, const ResourceResponse& redirectResponse)
{
ASSERT(m_client);
ASSERT_UNUSED(resource, resource == this->resource());
RefPtr<DocumentThreadableLoader> protect(this);
if (!isAllowedByPolicy(request.url())) {
m_client->didFailRedirectCheck();
request = ResourceRequest();
return;
}
// Allow same origin requests to continue after allowing clients to audit the redirect.
if (isAllowedRedirect(request.url())) {
if (m_client->isDocumentThreadableLoaderClient())
static_cast<DocumentThreadableLoaderClient*>(m_client)->willSendRequest(request, redirectResponse);
return;
}
// When using access control, only simple cross origin requests are allowed to redirect. The new request URL must have a supported
// scheme and not contain the userinfo production. In addition, the redirect response must pass the access control check if the
// original request was not same-origin.
if (m_options.crossOriginRequestPolicy == UseAccessControl) {
InspectorInstrumentation::didReceiveCORSRedirectResponse(m_document->frame(), resource->identifier(), m_document->frame()->loader().documentLoader(), redirectResponse, 0);
bool allowRedirect = false;
String accessControlErrorDescription;
if (m_simpleRequest) {
allowRedirect = CrossOriginAccessControl::isLegalRedirectLocation(request.url(), accessControlErrorDescription)
&& (m_sameOriginRequest || passesAccessControlCheck(redirectResponse, m_options.allowCredentials, securityOrigin(), accessControlErrorDescription));
} else {
accessControlErrorDescription = "The request was redirected to '"+ request.url().string() + "', which is disallowed for cross-origin requests that require preflight.";
}
if (allowRedirect) {
// FIXME: consider combining this with CORS redirect handling performed by
// CrossOriginAccessControl::handleRedirect().
clearResource();
RefPtr<SecurityOrigin> originalOrigin = SecurityOrigin::create(redirectResponse.url());
RefPtr<SecurityOrigin> requestOrigin = SecurityOrigin::create(request.url());
// If the original request wasn't same-origin, then if the request URL origin is not same origin with the original URL origin,
// set the source origin to a globally unique identifier. (If the original request was same-origin, the origin of the new request
// should be the original URL origin.)
if (!m_sameOriginRequest && !originalOrigin->isSameSchemeHostPort(requestOrigin.get()))
m_options.securityOrigin = SecurityOrigin::createUnique();
// Force any subsequent requests to use these checks.
m_sameOriginRequest = false;
// Since the request is no longer same-origin, if the user didn't request credentials in
// the first place, update our state so we neither request them nor expect they must be allowed.
if (m_options.credentialsRequested == ClientDidNotRequestCredentials)
m_options.allowCredentials = DoNotAllowStoredCredentials;
// Remove any headers that may have been added by the network layer that cause access control to fail.
request.clearHTTPContentType();
request.clearHTTPReferrer();
request.clearHTTPOrigin();
request.clearHTTPUserAgent();
request.clearHTTPAccept();
makeCrossOriginAccessRequest(request);
return;
}
ResourceError error(errorDomainBlinkInternal, 0, redirectResponse.url().string(), accessControlErrorDescription);
m_client->didFailAccessControlCheck(error);
} else {
m_client->didFailRedirectCheck();
}
request = ResourceRequest();
}
