ResourceError FrameLoaderClient::blockedError(const ResourceRequest& request) { return ResourceError(g_quark_to_string(WEBKIT_POLICY_ERROR), WEBKIT_POLICY_ERROR_CANNOT_USE_RESTRICTED_PORT, request.url().string(), _("Not allowed to use restricted network port")); }
// FIXME: We need to have better names for the 7 next *Error methods and have a localized description for each. ResourceError WebFrameLoaderClient::cancelledError(const ResourceRequest& request) { return ResourceError(String(WebURLErrorDomain), WebURLErrorCancelled, request.url().string(), String()); }
ResourceError WebFrameLoaderClient::cannotShowURLError(const ResourceRequest& request) { return ResourceError(String(WebKitCannotShowURL), WebURLErrorBadURL, request.url().string(), String()); }
void XMLHttpRequest::loadRequestAsynchronously(ResourceRequest& request) { ASSERT(m_async); // SubresourceLoader::create can return null here, for example if we're no longer attached to a page. // This is true while running onunload handlers. // FIXME: We need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>. // FIXME: Maybe create can return null for other reasons too? // We need to keep content sniffing enabled for local files due to CFNetwork not providing a MIME type // for local files otherwise, <rdar://problem/5671813>. bool sendResourceLoadCallbacks = !m_inPreflight; m_loader = SubresourceLoader::create(m_doc->frame(), this, request, false, sendResourceLoadCallbacks, request.url().isLocalFile()); if (m_loader) { // Neither this object nor the JavaScript wrapper should be deleted while // a request is in progress because we need to keep the listeners alive, // and they are referenced by the JavaScript wrapper. ref(); KJS::JSLock lock; gcProtectNullTolerant(ScriptInterpreter::getDOMObject(this)); } }
// We don't need to provide the error message string, that will be handled in BrowserErrorPage according to the error code. ResourceError FrameLoaderClientBlackBerry::cannotShowURLError(const ResourceRequest& request) { // FIXME: Why are we not passing the domain to the ResourceError? See PR #119789. return ResourceError(String(), WebKitErrorCannotShowURL, request.url().string(), String()); }
void InspectorResourceContentLoader::start() { m_started = true; Vector<Document*> documents; for (Frame* frame = m_inspectedFrame; frame; frame = frame->tree().traverseNext(m_inspectedFrame)) { if (!frame->isLocalFrame()) continue; LocalFrame* localFrame = toLocalFrame(frame); documents.append(localFrame->document()); documents.appendVector(InspectorPageAgent::importsForFrame(localFrame)); } for (Document* document : documents) { HashSet<String> urlsToFetch; ResourceRequest resourceRequest; HistoryItem* item = document->frame() ? document->frame()->loader().currentItem() : nullptr; if (item) { resourceRequest = FrameLoader::requestFromHistoryItem(item, ReturnCacheDataDontLoad); } else { resourceRequest = document->url(); resourceRequest.setCachePolicy(ReturnCacheDataDontLoad); } resourceRequest.setRequestContext(blink::WebURLRequest::RequestContextInternal); if (!resourceRequest.url().string().isEmpty()) { urlsToFetch.add(resourceRequest.url().string()); FetchRequest request(resourceRequest, FetchInitiatorTypeNames::internal); ResourcePtr<Resource> resource = document->fetcher()->fetchRawResource(request); if (resource) { // Prevent garbage collection by holding a reference to this resource. m_resources.append(resource.get()); ResourceClient* resourceClient = new ResourceClient(this); m_pendingResourceClients.add(resourceClient); resourceClient->waitForResource(resource.get()); } } WillBeHeapVector<RawPtrWillBeMember<CSSStyleSheet> > styleSheets; InspectorCSSAgent::collectAllDocumentStyleSheets(document, styleSheets); for (CSSStyleSheet* styleSheet : styleSheets) { if (styleSheet->isInline() || !styleSheet->contents()->loadCompleted()) continue; String url = styleSheet->baseURL().string(); if (url.isEmpty() || urlsToFetch.contains(url)) continue; urlsToFetch.add(url); FetchRequest request(ResourceRequest(url), FetchInitiatorTypeNames::internal); request.mutableResourceRequest().setRequestContext(blink::WebURLRequest::RequestContextInternal); ResourcePtr<Resource> resource = document->fetcher()->fetchCSSStyleSheet(request); if (!resource) continue; // Prevent garbage collection by holding a reference to this resource. m_resources.append(resource.get()); ResourceClient* resourceClient = new ResourceClient(this); m_pendingResourceClients.add(resourceClient); resourceClient->waitForResource(resource.get()); } } m_allRequestsStarted = true; checkDone(); }
void updateRequestForAccessControl(ResourceRequest& request, SecurityOrigin* securityOrigin, StoredCredentials allowCredentials) { request.removeCredentials(); request.setAllowCookies(allowCredentials == AllowStoredCredentials); request.setHTTPOrigin(securityOrigin->toString()); }
bool FrameFetchContext::canRequest(Resource::Type type, const ResourceRequest& resourceRequest, const KURL& url, const ResourceLoaderOptions& options, bool forPreload, FetchRequest::OriginRestriction originRestriction) const { ResourceRequestBlockedReason reason = canRequestInternal(type, resourceRequest, url, options, forPreload, originRestriction, resourceRequest.redirectStatus()); if (reason != ResourceRequestBlockedReasonNone) { if (!forPreload) InspectorInstrumentation::didBlockRequest(frame(), resourceRequest, masterDocumentLoader(), options.initiatorInfo, reason); return false; } return true; }
ResourceRequestBlockedReason FrameFetchContext::canRequestInternal(Resource::Type type, const ResourceRequest& resourceRequest, const KURL& url, const ResourceLoaderOptions& options, bool forPreload, FetchRequest::OriginRestriction originRestriction, ResourceRequest::RedirectStatus redirectStatus) const { if (InspectorInstrumentation::shouldBlockRequest(frame(), resourceRequest)) return ResourceRequestBlockedReasonInspector; SecurityOrigin* securityOrigin = options.securityOrigin.get(); if (!securityOrigin && m_document) securityOrigin = m_document->getSecurityOrigin(); if (originRestriction != FetchRequest::NoOriginRestriction && securityOrigin && !securityOrigin->canDisplay(url)) { if (!forPreload) FrameLoader::reportLocalLoadFailed(frame(), url.elidedString()); WTF_LOG(ResourceLoading, "ResourceFetcher::requestResource URL was not allowed by SecurityOrigin::canDisplay"); return ResourceRequestBlockedReasonOther; } // Some types of resources can be loaded only from the same origin. Other // types of resources, like Images, Scripts, and CSS, can be loaded from // any URL. switch (type) { case Resource::MainResource: case Resource::Image: case Resource::CSSStyleSheet: case Resource::Script: case Resource::Font: case Resource::Raw: case Resource::LinkPrefetch: case Resource::LinkPreload: case Resource::TextTrack: case Resource::ImportResource: case Resource::Media: case Resource::Manifest: // By default these types of resources can be loaded from any origin. // FIXME: Are we sure about Resource::Font? if (originRestriction == FetchRequest::RestrictToSameOrigin && !securityOrigin->canRequest(url)) { printAccessDeniedMessage(url); return ResourceRequestBlockedReasonOrigin; } break; case Resource::XSLStyleSheet: ASSERT(RuntimeEnabledFeatures::xsltEnabled()); case Resource::SVGDocument: if (!securityOrigin->canRequest(url)) { printAccessDeniedMessage(url); return ResourceRequestBlockedReasonOrigin; } break; } // FIXME: Convert this to check the isolated world's Content Security Policy once webkit.org/b/104520 is solved. bool shouldBypassMainWorldCSP = frame()->script().shouldBypassMainWorldCSP() || options.contentSecurityPolicyOption == DoNotCheckContentSecurityPolicy; // Don't send CSP messages for preloads, we might never actually display those items. ContentSecurityPolicy::ReportingStatus cspReporting = forPreload ? ContentSecurityPolicy::SuppressReport : ContentSecurityPolicy::SendReport; if (m_document) { DCHECK(m_document->contentSecurityPolicy()); if (!shouldBypassMainWorldCSP && !m_document->contentSecurityPolicy()->allowRequest(resourceRequest.requestContext(), url, options.contentSecurityPolicyNonce, redirectStatus, cspReporting)) return ResourceRequestBlockedReasonCSP; } if (type == Resource::Script || type == Resource::ImportResource) { ASSERT(frame()); if (!frame()->loader().client()->allowScriptFromSource(!frame()->settings() || frame()->settings()->scriptEnabled(), url)) { frame()->loader().client()->didNotAllowScript(); // TODO(estark): Use a different ResourceRequestBlockedReason // here, since this check has nothing to do with // CSP. https://crbug.com/600795 return ResourceRequestBlockedReasonCSP; } } else if (type == Resource::Media || type == Resource::TextTrack) { ASSERT(frame()); if (!frame()->loader().client()->allowMedia(url)) return ResourceRequestBlockedReasonOther; } // SVG Images have unique security rules that prevent all subresource requests // except for data urls. if (type != Resource::MainResource && frame()->chromeClient().isSVGImageChromeClient() && !url.protocolIsData()) return ResourceRequestBlockedReasonOrigin; // Measure the number of legacy URL schemes ('ftp://') and the number of embedded-credential // ('http://*****:*****@...') resources embedded as subresources. in the hopes that we can // block them at some point in the future. if (resourceRequest.frameType() != WebURLRequest::FrameTypeTopLevel) { ASSERT(frame()->document()); if (SchemeRegistry::shouldTreatURLSchemeAsLegacy(url.protocol()) && !SchemeRegistry::shouldTreatURLSchemeAsLegacy(frame()->document()->getSecurityOrigin()->protocol())) UseCounter::count(frame()->document(), UseCounter::LegacyProtocolEmbeddedAsSubresource); if (!url.user().isEmpty() || !url.pass().isEmpty()) UseCounter::count(frame()->document(), UseCounter::RequestedSubresourceWithEmbeddedCredentials); } // Check for mixed content. We do this second-to-last so that when folks block // mixed content with a CSP policy, they don't get a warning. They'll still // get a warning in the console about CSP blocking the load. MixedContentChecker::ReportingStatus mixedContentReporting = forPreload ? MixedContentChecker::SuppressReport : MixedContentChecker::SendReport; if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url, mixedContentReporting)) return ResourceRequestBlockedReasonMixedContent; // Let the client have the final say into whether or not the load should proceed. DocumentLoader* documentLoader = masterDocumentLoader(); if (documentLoader && documentLoader->subresourceFilter() && type != Resource::MainResource && type != Resource::ImportResource && !documentLoader->subresourceFilter()->allowLoad(url, resourceRequest.requestContext())) return ResourceRequestBlockedReasonSubresourceFilter; return ResourceRequestBlockedReasonNone; }
bool ArgumentCoder<ResourceRequest>::decodePlatformData(ArgumentDecoder& decoder, ResourceRequest& resourceRequest) { String url; if (!decoder.decode(url)) return false; resourceRequest.setURL(URL(URL(), url)); String httpMethod; if (!decoder.decode(httpMethod)) return false; resourceRequest.setHTTPMethod(httpMethod); HTTPHeaderMap headers; if (!decoder.decode(headers)) return false; resourceRequest.setHTTPHeaderFields(WTF::move(headers)); double timeoutInterval; if (!decoder.decode(timeoutInterval)) return false; resourceRequest.setTimeoutInterval(timeoutInterval); bool hasHTTPBody; if (!decoder.decode(hasHTTPBody)) return false; if (hasHTTPBody) { String httpBody; if (!decoder.decode(httpBody)) return false; resourceRequest.setHTTPBody(FormData::create(httpBody.utf8())); } String firstPartyForCookies; if (!decoder.decode(firstPartyForCookies)) return false; resourceRequest.setFirstPartyForCookies(URL(URL(), firstPartyForCookies)); bool allowCookies; if (!decoder.decode(allowCookies)) return false; resourceRequest.setAllowCookies(allowCookies); ResourceLoadPriority priority; if (!decoder.decodeEnum(priority)) return false; resourceRequest.setPriority(priority); ResourceRequestCachePolicy cachePolicy; if (!decoder.decodeEnum(cachePolicy)) return false; resourceRequest.setCachePolicy(cachePolicy); ResourceRequest::Requester requester; if (!decoder.decodeEnum(requester)) return false; resourceRequest.setRequester(requester); uint32_t soupMessageFlags; if (!decoder.decode(soupMessageFlags)) return false; resourceRequest.setSoupMessageFlags(static_cast<SoupMessageFlags>(soupMessageFlags)); uint64_t initiatingPageID; if (!decoder.decode(initiatingPageID)) return false; resourceRequest.setInitiatingPageID(initiatingPageID); return true; }
void FrameFetchContext::setFirstPartyForCookies(ResourceRequest& request) { if (frame()->tree().top()->isLocalFrame()) request.setFirstPartyForCookies(toLocalFrame(frame()->tree().top())->document()->firstPartyForCookies()); }
void ArgumentCoder<ResourceRequest>::encodePlatformData(ArgumentEncoder& encoder, const ResourceRequest& resourceRequest) { encoder << resourceRequest.url().string(); encoder << resourceRequest.httpMethod(); encoder << resourceRequest.httpHeaderFields(); encoder << resourceRequest.timeoutInterval(); // FIXME: Do not encode HTTP message body. // 1. It can be large and thus costly to send across. // 2. It is misleading to provide a body with some requests, while others use body streams, which cannot be serialized at all. FormData* httpBody = resourceRequest.httpBody(); encoder << static_cast<bool>(httpBody); if (httpBody) encoder << httpBody->flattenToString(); encoder << resourceRequest.firstPartyForCookies().string(); encoder << resourceRequest.allowCookies(); encoder.encodeEnum(resourceRequest.priority()); encoder.encodeEnum(resourceRequest.cachePolicy()); encoder.encodeEnum(resourceRequest.requester()); encoder << static_cast<uint32_t>(resourceRequest.soupMessageFlags()); encoder << resourceRequest.initiatingPageID(); }
ResourceError FrameLoaderClient::interruptForPolicyChangeError(const ResourceRequest& request) { return ResourceError(g_quark_to_string(WEBKIT_POLICY_ERROR), WEBKIT_POLICY_ERROR_FRAME_LOAD_INTERRUPTED_BY_POLICY_CHANGE, request.url().string(), _("Frame load was interrupted")); }
ResourceError FrameLoaderClient::cannotShowURLError(const ResourceRequest& request) { return ResourceError(g_quark_to_string(WEBKIT_POLICY_ERROR), WEBKIT_POLICY_ERROR_CANNOT_SHOW_URL, request.url().string(), _("URL cannot be shown")); }
ResourceError cannotShowURLError(const ResourceRequest& request) { return ResourceError(errorDomainPolicy, PolicyErrorCannotShowURL, request.url(), ASCIILiteral("URL cannot be shown")); }
void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse) { #if USE(QUICK_LOOK) // Always allow QuickLook-generated URLs based on the protocol scheme. if (!request.isNull() && request.url().protocolIs(QLPreviewProtocol())) return; #endif String oldRequestURL = request.url().string(); m_frame.loader().documentLoader()->didTellClientAboutLoad(request.url()); m_frame.loader().client().dispatchWillSendRequest(loader, identifier, request, redirectResponse); // If the URL changed, then we want to put that new URL in the "did tell client" set too. if (!request.isNull() && oldRequestURL != request.url().string()) m_frame.loader().documentLoader()->didTellClientAboutLoad(request.url()); InspectorInstrumentation::willSendRequest(&m_frame, identifier, loader, request, redirectResponse); // Report WebTiming for all frames. if (loader && !request.isNull() && request.url() == loader->requestURL()) request.setReportLoadTiming(true); #if ENABLE(RESOURCE_TIMING) request.setReportLoadTiming(true); #endif }
ResourceError interruptedForPolicyChangeError(const ResourceRequest& request) { return ResourceError(errorDomainPolicy, PolicyErrorFrameLoadInterruptedByPolicyChange, request.url(), ASCIILiteral("Frame load was interrupted")); }
bool equalIgnoringHeaderFields(const ResourceRequest& a, const ResourceRequest& b) { if (a.url() != b.url()) return false; if (a.getCachePolicy() != b.getCachePolicy()) return false; if (a.timeoutInterval() != b.timeoutInterval()) return false; if (a.firstPartyForCookies() != b.firstPartyForCookies()) return false; if (a.httpMethod() != b.httpMethod()) return false; if (a.allowStoredCredentials() != b.allowStoredCredentials()) return false; if (a.priority() != b.priority()) return false; if (a.referrerPolicy() != b.referrerPolicy()) return false; EncodedFormData* formDataA = a.httpBody(); EncodedFormData* formDataB = b.httpBody(); if (!formDataA) return !formDataB; if (!formDataB) return !formDataA; if (*formDataA != *formDataB) return false; return true; }
CrossThreadCopierBase<false, false, ResourceRequest>::Type CrossThreadCopierBase<false, false, ResourceRequest>::copy(const ResourceRequest& request) { return request.copyData(); }
void WebDownload::init(ResourceHandle* handle, const ResourceRequest& request, const ResourceResponse& response, IWebDownloadDelegate* delegate) { m_delegate = delegate ? delegate : DefaultDownloadDelegate::sharedInstance(); CFURLConnectionRef connection = handle->connection(); if (!connection) { LOG_ERROR("WebDownload::WebDownload(ResourceHandle*,...) called with an inactive ResourceHandle"); return; } CFURLDownloadClient client = {0, this, 0, 0, 0, didStartCallback, willSendRequestCallback, didReceiveAuthenticationChallengeCallback, didReceiveResponseCallback, willResumeWithResponseCallback, didReceiveDataCallback, shouldDecodeDataOfMIMETypeCallback, decideDestinationWithSuggestedObjectNameCallback, didCreateDestinationCallback, didFinishCallback, didFailCallback}; m_request.adoptRef(WebMutableURLRequest::createInstance(request)); m_download = adoptCF(CFURLDownloadCreateAndStartWithLoadingConnection(0, connection, request.cfURLRequest(UpdateHTTPBody), response.cfURLResponse(), &client)); // It is possible for CFURLDownloadCreateAndStartWithLoadingConnection() to fail if the passed in CFURLConnection is not in a "downloadable state" // However, we should never hit that case if (!m_download) { ASSERT_NOT_REACHED(); LOG_ERROR("WebDownload - Failed to create WebDownload from existing connection (%s)", request.url().string().utf8().data()); } else LOG(Download, "WebDownload - Created WebDownload %p from existing connection (%s)", this, request.url().string().utf8().data()); // The CFURLDownload either starts successfully and retains the CFURLConnection, // or it fails to creating and we have a now-useless connection with a dangling ref. // Either way, we need to release the connection to balance out ref counts handle->releaseConnectionForDownload(); CFRelease(connection); }
void NetworkProcessConnection::didCacheResource(const ResourceRequest& request, const ShareableResource::Handle& handle, SessionID sessionID) { CachedResource* resource = MemoryCache::singleton().resourceForRequest(request, sessionID); if (!resource) return; RefPtr<SharedBuffer> buffer = handle.tryWrapInSharedBuffer(); if (!buffer) { LOG_ERROR("Unable to create SharedBuffer from ShareableResource handle for resource url %s", request.url().string().utf8().data()); return; } resource->tryReplaceEncodedData(*buffer); }
void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const ResourceResponse& redirectResponse) { // Note that there are no asserts here as there are for the other callbacks. This is due to the // fact that this "callback" is sent when starting every load, and the state of callback // deferrals plays less of a part in this function in preventing the bad behavior deferring // callbacks is meant to prevent. ASSERT(!newRequest.isNull()); // The additional processing can do anything including possibly removing the last // reference to this object; one example of this is 3266216. RefPtr<MainResourceLoader> protect(this); if (!frameLoader()->checkIfFormActionAllowedByCSP(newRequest.url())) { cancel(); return; } ASSERT(documentLoader()->timing()->fetchStart()); if (!redirectResponse.isNull()) { // If the redirecting url is not allowed to display content from the target origin, // then block the redirect. RefPtr<SecurityOrigin> redirectingOrigin = SecurityOrigin::create(redirectResponse.url()); if (!redirectingOrigin->canDisplay(newRequest.url())) { FrameLoader::reportLocalLoadFailed(m_documentLoader->frame(), newRequest.url().elidedString()); cancel(); return; } documentLoader()->timing()->addRedirect(redirectResponse.url(), newRequest.url()); } // Update cookie policy base URL as URL changes, except for subframes, which use the // URL of the main frame which doesn't change when we redirect. if (frameLoader()->isLoadingMainFrame()) newRequest.setFirstPartyForCookies(newRequest.url()); // If we're fielding a redirect in response to a POST, force a load from origin, since // this is a common site technique to return to a page viewing some data that the POST // just modified. // Also, POST requests always load from origin, but this does not affect subresources. if (newRequest.cachePolicy() == UseProtocolCachePolicy && isPostOrRedirectAfterPost(newRequest, redirectResponse)) newRequest.setCachePolicy(ReloadIgnoringCacheData); Frame* top = m_documentLoader->frame()->tree()->top(); if (top != m_documentLoader->frame()) { if (!frameLoader()->mixedContentChecker()->canDisplayInsecureContent(top->document()->securityOrigin(), newRequest.url())) { cancel(); return; } } // Don't set this on the first request. It is set when the main load was started. m_documentLoader->setRequest(newRequest); if (!redirectResponse.isNull()) { // We checked application cache for initial URL, now we need to check it for redirected one. ASSERT(!m_substituteData.isValid()); documentLoader()->applicationCacheHost()->maybeLoadMainResourceForRedirect(newRequest, m_substituteData); if (m_substituteData.isValid()) m_identifierForLoadWithoutResourceLoader = identifier(); } // FIXME: Ideally we'd stop the I/O until we hear back from the navigation policy delegate // listener. But there's no way to do that in practice. So instead we cancel later if the // listener tells us to. In practice that means the navigation policy needs to be decided // synchronously for these redirect cases. if (!redirectResponse.isNull()) { ref(); // balanced by deref in continueAfterNavigationPolicy frameLoader()->policyChecker()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this); } }
void FrameLoaderClientBlackBerry::startDownload(const ResourceRequest& request, const String& suggestedName) { m_webPagePrivate->load(request.url().string().utf8().data(), 0, "GET", NetworkRequest::UseProtocolCachePolicy, 0, 0, 0, 0, false, false, true, "", suggestedName.utf8().data()); }
ResourceError cancelledError(const ResourceRequest& request) { return ResourceError(errorDomainNetwork, NetworkErrorCancelled, request.url(), ASCIILiteral("Load request cancelled")); }
void InspectorResourceAgent::willSendWebSocketHandshakeRequest(unsigned long identifier, const ResourceRequest& request) { RefPtr<Inspector::Protocol::Network::WebSocketRequest> requestObject = Inspector::Protocol::Network::WebSocketRequest::create() .setHeaders(buildObjectForHeaders(request.httpHeaderFields())); m_frontendDispatcher->webSocketWillSendHandshakeRequest(IdentifiersFactory::requestId(identifier), currentTime(), requestObject); }
ResourceError blockedError(const ResourceRequest& request) { return ResourceError(errorDomainPolicy, PolicyErrorCannotUseRestrictedPort, request.url(), ASCIILiteral("Not allowed to use restricted network port")); }
ResourceError WebFrameLoaderClient::blockedError(const ResourceRequest& request) { return ResourceError(String(WebKitErrorDomain), WebKitErrorCannotUseRestrictedPort, request.url().string(), String()); }
ResourceError blockedByContentBlockerError(const ResourceRequest& request) { return ResourceError(errorDomainPolicy, PolicyErrorBlockedByContentBlocker, request.url(), ASCIILiteral("Blocked by content blocker")); }
ResourceError WebFrameLoaderClient::interruptForPolicyChangeError(const ResourceRequest& request) { return ResourceError(String(WebKitErrorDomain), WebKitErrorFrameLoadInterruptedByPolicyChange, request.url().string(), String()); }
ResourceError FrameLoaderClient::cancelledError(const ResourceRequest& request) { return ResourceError(g_quark_to_string(WEBKIT_NETWORK_ERROR), WEBKIT_NETWORK_ERROR_CANCELLED, request.url().string(), _("Load request cancelled")); }