Home | History | Annotate | Download | only in child 
      1 // Copyright 2013 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #ifndef CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
      6 #define CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
      7 
      8 #include <map>
      9 #include <utility>
     10 
     11 #include "base/gtest_prod_util.h"
     12 #include "base/memory/linked_ptr.h"
     13 #include "base/strings/string_piece.h"
     14 #include "content/common/content_export.h"
     15 #include "webkit/common/resource_type.h"
     16 
     17 class GURL;
     18 
     19 namespace content {
     20 
     21 struct ResourceResponseInfo;
     22 
     23 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP)
     24 // for Site Isolation. XSDP will monitor network responses to a renderer and
     25 // block illegal responses so that a compromised renderer cannot steal private
     26 // information from other sites. For now SiteIsolationPolicy monitors responses
     27 // to gather various UMA stats to see the compatibility impact of actual
     28 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers
     29 // are as follows:
     30 //
     31 // SiteIsolation.AllResponses : # of all network responses.
     32 // SiteIsolation.XSD.DataLength : the length of the first packet of a response.
     33 // SiteIsolation.XSD.MimeType (enum):
     34 //   # of responses from other sites, tagged with a document mime type.
     35 //   0:HTML, 1:XML, 2:JSON, 3:Plain, 4:Others
     36 // SiteIsolation.XSD.[%MIMETYPE].Blocked :
     37 //   blocked # of cross-site document responses grouped by sniffed MIME type.
     38 // SiteIsolation.XSD.[%MIMETYPE].Blocked.RenderableStatusCode :
     39 //   # of responses with renderable status code,
     40 //   out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
     41 // SiteIsolation.XSD.[%MIMETYPE].Blocked.NonRenderableStatusCode :
     42 //   # of responses with non-renderable status code,
     43 //   out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
     44 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.RenderableStatusCode :
     45 //   # of responses failed to be sniffed for its MIME type, but blocked by
     46 //   "X-Content-Type-Options: nosniff" header, and with renderable status code
     47 //   out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
     48 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode :
     49 //   # of responses failed to be sniffed for its MIME type, but blocked by
     50 //   "X-Content-Type-Options: nosniff" header, and with non-renderable status
     51 //   code out of SiteIsolation.XSD.[%MIMETYPE].Blocked.
     52 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked :
     53 //   # of responses, but not blocked due to failure of mime sniffing.
     54 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS :
     55 //   # of responses that are plausibly sniffed to be JavaScript.
     56 
     57 struct SiteIsolationResponseMetaData {
     58 
     59   enum CanonicalMimeType {
     60     HTML = 0,
     61     XML = 1,
     62     JSON = 2,
     63     Plain = 3,
     64     Others = 4,
     65     MaxCanonicalMimeType,
     66   };
     67 
     68   SiteIsolationResponseMetaData();
     69 
     70   std::string frame_origin;
     71   GURL response_url;
     72   ResourceType::Type resource_type;
     73   CanonicalMimeType canonical_mime_type;
     74   int http_status_code;
     75   bool no_sniff;
     76 };
     77 
     78 class CONTENT_EXPORT SiteIsolationPolicy {
     79  public:
     80   // Set activation flag for the UMA data collection for this renderer process.
     81   static void SetPolicyEnabled(bool enabled);
     82 
     83   // Returns any bookkeeping data about the HTTP header information for the
     84   // request identified by |request_id|. Any data returned should then be
     85   // passed to ShouldBlockResponse with the first packet.
     86   static linked_ptr<SiteIsolationResponseMetaData> OnReceivedResponse(
     87       const GURL& frame_origin,
     88       const GURL& response_url,
     89       ResourceType::Type resource_type,
     90       int origin_pid,
     91       const ResourceResponseInfo& info);
     92 
     93   // Examines the first network packet in case response_url is registered as a
     94   // cross-site document by DidReceiveResponse().  In case that this response is
     95   // blocked, it returns an alternative data to be sent to the renderer in
     96   // |alternative_data|. This records various kinds of UMA data stats. This
     97   // function is called only if the length of received data is non-zero.
     98   static bool ShouldBlockResponse(
     99       linked_ptr<SiteIsolationResponseMetaData>& resp_data, const char* payload,
    100       int length, std::string* alternative_data);
    101 
    102 private:
    103   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme);
    104   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite);
    105   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet);
    106   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML);
    107   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML);
    108   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON);
    109   FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS);
    110 
    111   // Returns the representative mime type enum value of the mime type of
    112   // response. For example, this returns the same value for all text/xml mime
    113   // type families such as application/xml, application/rss+xml.
    114   static SiteIsolationResponseMetaData::CanonicalMimeType GetCanonicalMimeType(
    115       const std::string& mime_type);
    116 
    117   // Returns whether this scheme is a target of cross-site document
    118   // policy(XSDP). This returns true only for http://* and https://* urls.
    119   static bool IsBlockableScheme(const GURL& frame_origin);
    120 
    121   // Returns whether the two urls belong to the same sites.
    122   static bool IsSameSite(const GURL& frame_origin, const GURL& response_url);
    123 
    124   // Returns whether there's a valid CORS header for frame_origin.  This is
    125   // simliar to CrossOriginAccessControl::passesAccessControlCheck(), but we use
    126   // sites as our security domain, not origins.
    127   // TODO(dsjang): this must be improved to be more accurate to the actual CORS
    128   // specification. For now, this works conservatively, allowing XSDs that are
    129   // not allowed by actual CORS rules by ignoring 1) credentials and 2)
    130   // methods. Preflight requests don't matter here since they are not used to
    131   // decide whether to block a document or not on the client side.
    132   static bool IsValidCorsHeaderSet(const GURL& frame_origin,
    133                                    const GURL& website_origin,
    134                                    const std::string& access_control_origin);
    135 
    136   static bool SniffForHTML(base::StringPiece data);
    137   static bool SniffForXML(base::StringPiece data);
    138   static bool SniffForJSON(base::StringPiece data);
    139 
    140   // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted
    141   // when this class is used for actual blocking.
    142   static bool SniffForJS(base::StringPiece data);
    143 
    144   // Never needs to be constructed/destructed.
    145   SiteIsolationPolicy() {}
    146   ~SiteIsolationPolicy() {}
    147 
    148   DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy);
    149 };
    150 
    151 }  // namespace content
    152 
    153 #endif  // CONTENT_CHILD_SITE_ISOLATION_POLICY_H_
    154