1 // Copyright 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ 6 #define CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ 7 8 #include <map> 9 #include <utility> 10 11 #include "base/gtest_prod_util.h" 12 #include "content/common/content_export.h" 13 #include "third_party/WebKit/public/platform/WebURLRequest.h" 14 #include "third_party/WebKit/public/platform/WebURLResponse.h" 15 #include "third_party/WebKit/public/web/WebFrame.h" 16 #include "webkit/common/resource_response_info.h" 17 #include "webkit/common/resource_type.h" 18 19 namespace content { 20 21 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP) 22 // for Site Isolation. XSDP will monitor network responses to a renderer and 23 // block illegal responses so that a compromised renderer cannot steal private 24 // information from other sites. For now SiteIsolationPolicy monitors responses 25 // to gather various UMA stats to see the compatibility impact of actual 26 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers 27 // are as follows: 28 // 29 // SiteIsolation.AllResponses : # of all network responses. 30 // SiteIsolation.XSD.DataLength : the length of the first packet of a response. 31 // SiteIsolation.XSD.MimeType (enum): 32 // # of responses from other sites, tagged with a document mime type. 33 // 0:HTML, 1:XML, 2:JSON, 3:Plain, 4:Others 34 // SiteIsolation.XSD.[%MIMETYPE].Blocked : 35 // blocked # of cross-site document responses grouped by sniffed MIME type. 36 // SiteIsolation.XSD.[%MIMETYPE].Blocked.RenderableStatusCode : 37 // # of responses with renderable status code, 38 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 39 // SiteIsolation.XSD.[%MIMETYPE].Blocked.NonRenderableStatusCode : 40 // # of responses with non-renderable status code, 41 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 42 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.RenderableStatusCode : 43 // # of responses failed to be sniffed for its MIME type, but blocked by 44 // "X-Content-Type-Options: nosniff" header, and with renderable status code 45 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 46 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode : 47 // # of responses failed to be sniffed for its MIME type, but blocked by 48 // "X-Content-Type-Options: nosniff" header, and with non-renderable status 49 // code out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 50 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked : 51 // # of responses, but not blocked due to failure of mime sniffing. 52 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS : 53 // # of responses that are plausibly sniffed to be JavaScript. 54 55 class CONTENT_EXPORT SiteIsolationPolicy { 56 public: 57 // Set activation flag for the UMA data collection for this renderer process. 58 static void SetPolicyEnabled(bool enabled); 59 60 // Records the bookkeeping data about the HTTP header information for the 61 // request identified by |request_id|. The bookkeeping data is used by 62 // ShouldBlockResponse. We have to make sure to call OnRequestComplete to free 63 // the bookkeeping data. 64 static void OnReceivedResponse(int request_id, 65 const GURL& frame_origin, 66 const GURL& response_url, 67 ResourceType::Type resource_type, 68 int origin_pid, 69 const webkit_glue::ResourceResponseInfo& info); 70 71 // Examines the first network packet in case response_url is registered as a 72 // cross-site document by DidReceiveResponse(). In case that this response is 73 // blocked, it returns an alternative data to be sent to the renderer in 74 // |alternative_data|. This records various kinds of UMA data stats. This 75 // function is called only if the length of received data is non-zero. 76 static bool ShouldBlockResponse(int request_id, 77 const char* payload, 78 int length, 79 std::string* alternative_data); 80 81 // Clean up booking data registered by OnReceiveResponse and OnReceivedData. 82 static void OnRequestComplete(int request_id); 83 84 struct ResponseMetaData { 85 86 enum CanonicalMimeType { 87 HTML = 0, 88 XML = 1, 89 JSON = 2, 90 Plain = 3, 91 Others = 4, 92 MaxCanonicalMimeType, 93 }; 94 95 ResponseMetaData(); 96 97 std::string frame_origin; 98 GURL response_url; 99 ResourceType::Type resource_type; 100 CanonicalMimeType canonical_mime_type; 101 int http_status_code; 102 bool no_sniff; 103 }; 104 105 typedef std::map<int, ResponseMetaData> RequestIdToMetaDataMap; 106 typedef std::map<int, bool> RequestIdToResultMap; 107 108 private: 109 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme); 110 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite); 111 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet); 112 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML); 113 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML); 114 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON); 115 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS); 116 117 // Returns the representative mime type enum value of the mime type of 118 // response. For example, this returns the same value for all text/xml mime 119 // type families such as application/xml, application/rss+xml. 120 static ResponseMetaData::CanonicalMimeType GetCanonicalMimeType( 121 const std::string& mime_type); 122 123 // Returns whether this scheme is a target of cross-site document 124 // policy(XSDP). This returns true only for http://* and https://* urls. 125 static bool IsBlockableScheme(const GURL& frame_origin); 126 127 // Returns whether the two urls belong to the same sites. 128 static bool IsSameSite(const GURL& frame_origin, const GURL& response_url); 129 130 // Returns whether there's a valid CORS header for frame_origin. This is 131 // simliar to CrossOriginAccessControl::passesAccessControlCheck(), but we use 132 // sites as our security domain, not origins. 133 // TODO(dsjang): this must be improved to be more accurate to the actual CORS 134 // specification. For now, this works conservatively, allowing XSDs that are 135 // not allowed by actual CORS rules by ignoring 1) credentials and 2) 136 // methods. Preflight requests don't matter here since they are not used to 137 // decide whether to block a document or not on the client side. 138 static bool IsValidCorsHeaderSet(const GURL& frame_origin, 139 const GURL& website_origin, 140 const std::string& access_control_origin); 141 142 static bool SniffForHTML(base::StringPiece data); 143 static bool SniffForXML(base::StringPiece data); 144 static bool SniffForJSON(base::StringPiece data); 145 146 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted 147 // when this class is used for actual blocking. 148 static bool SniffForJS(base::StringPiece data); 149 150 // Never needs to be constructed/destructed. 151 SiteIsolationPolicy() {} 152 ~SiteIsolationPolicy() {} 153 154 DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy); 155 }; 156 157 } // namespace content 158 159 #endif // CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ 160
