#include "config.h"
#include "PingLoader.h"
#include "ContentSecurityPolicy.h"
#include "Document.h"
#include "Frame.h"
#include "FrameLoader.h"
#include "FrameLoaderClient.h"
#include "InspectorInstrumentation.h"
#include "LoaderStrategy.h"
#include "NetworkLoadMetrics.h"
#include "Page.h"
#include "PlatformStrategies.h"
#include "ProgressTracker.h"
#include "ResourceHandle.h"
#include "ResourceLoadInfo.h"
#include "ResourceRequest.h"
#include "ResourceResponse.h"
#include "SecurityOrigin.h"
#include "SecurityPolicy.h"
#include "UserContentController.h"
#include <wtf/text/CString.h>
namespace WebCore {
#if !ENABLE(CONTENT_EXTENSIONS)
static inline bool processContentExtensionRulesForLoad(const Frame&, ResourceRequest&, ResourceType)
{
return false;
}
#else
static bool processContentExtensionRulesForLoad(const Frame& frame, ResourceRequest& request, ResourceType resourceType)
{
auto* documentLoader = frame.loader().documentLoader();
if (!documentLoader)
return false;
auto* page = frame.page();
if (!page)
return false;
auto status = page->userContentProvider().processContentExtensionRulesForLoad(request.url(), resourceType, *documentLoader);
applyBlockedStatusToRequest(status, page, request);
return status.blockedLoad;
}
#endif
void PingLoader::loadImage(Frame& frame, const URL& url)
{
ASSERT(frame.document());
auto& document = *frame.document();
if (!document.securityOrigin().canDisplay(url)) {
FrameLoader::reportLocalLoadFailed(&frame, url);
return;
}
ResourceRequest request(url);
if (processContentExtensionRulesForLoad(frame, request, ResourceType::Image))
return;
document.contentSecurityPolicy()->upgradeInsecureRequestIfNeeded(request, ContentSecurityPolicy::InsecureRequestType::Load);
request.setHTTPHeaderField(HTTPHeaderName::CacheControl, "max-age=0");
HTTPHeaderMap originalRequestHeader = request.httpHeaderFields();
String referrer = SecurityPolicy::generateReferrerHeader(document.referrerPolicy(), request.url(), frame.loader().outgoingReferrer());
if (!referrer.isEmpty())
request.setHTTPReferrer(referrer);
frame.loader().addExtraFieldsToSubresourceRequest(request);
startPingLoad(frame, request, WTFMove(originalRequestHeader), ShouldFollowRedirects::Yes);
}
void PingLoader::sendPing(Frame& frame, const URL& pingURL, const URL& destinationURL)
{
ASSERT(frame.document());
if (!pingURL.protocolIsInHTTPFamily())
return;
ResourceRequest request(pingURL);
if (processContentExtensionRulesForLoad(frame, request, ResourceType::Raw))
return;
auto& document = *frame.document();
document.contentSecurityPolicy()->upgradeInsecureRequestIfNeeded(request, ContentSecurityPolicy::InsecureRequestType::Load);
request.setHTTPMethod("POST");
request.setHTTPContentType("text/ping");
request.setHTTPBody(FormData::create("PING"));
request.setHTTPHeaderField(HTTPHeaderName::CacheControl, "max-age=0");
HTTPHeaderMap originalRequestHeader = request.httpHeaderFields();
frame.loader().addExtraFieldsToSubresourceRequest(request);
auto& sourceOrigin = document.securityOrigin();
FrameLoader::addHTTPOriginIfNeeded(request, sourceOrigin.toString());
request.setHTTPHeaderField(HTTPHeaderName::PingTo, destinationURL);
if (!SecurityPolicy::shouldHideReferrer(pingURL, frame.loader().outgoingReferrer())) {
request.setHTTPHeaderField(HTTPHeaderName::PingFrom, document.url());
if (!sourceOrigin.isSameSchemeHostPort(SecurityOrigin::create(pingURL).get())) {
String referrer = SecurityPolicy::generateReferrerHeader(document.referrerPolicy(), pingURL, frame.loader().outgoingReferrer());
if (!referrer.isEmpty())
request.setHTTPReferrer(referrer);
}
}
startPingLoad(frame, request, WTFMove(originalRequestHeader), ShouldFollowRedirects::Yes);
}
void PingLoader::sendViolationReport(Frame& frame, const URL& reportURL, Ref<FormData>&& report, ViolationReportType reportType)
{
ASSERT(frame.document());
ResourceRequest request(reportURL);
if (processContentExtensionRulesForLoad(frame, request, ResourceType::Raw))
return;
auto& document = *frame.document();
document.contentSecurityPolicy()->upgradeInsecureRequestIfNeeded(request, ContentSecurityPolicy::InsecureRequestType::Load);
request.setHTTPMethod("POST"_s);
request.setHTTPBody(WTFMove(report));
switch (reportType) {
case ViolationReportType::ContentSecurityPolicy:
request.setHTTPContentType("application/csp-report"_s);
break;
case ViolationReportType::XSSAuditor:
request.setHTTPContentType("application/json"_s);
break;
}
bool removeCookies = true;
if (document.securityOrigin().isSameSchemeHostPort(SecurityOrigin::create(reportURL).get()))
removeCookies = false;
if (removeCookies)
request.setAllowCookies(false);
HTTPHeaderMap originalRequestHeader = request.httpHeaderFields();
frame.loader().addExtraFieldsToSubresourceRequest(request);
String referrer = SecurityPolicy::generateReferrerHeader(document.referrerPolicy(), reportURL, frame.loader().outgoingReferrer());
if (!referrer.isEmpty())
request.setHTTPReferrer(referrer);
startPingLoad(frame, request, WTFMove(originalRequestHeader), ShouldFollowRedirects::No);
}
void PingLoader::startPingLoad(Frame& frame, ResourceRequest& request, HTTPHeaderMap&& originalRequestHeaders, ShouldFollowRedirects shouldFollowRedirects)
{
unsigned long identifier = frame.page()->progress().createUniqueIdentifier();
bool shouldUseCredentialStorage = frame.loader().client().shouldUseCredentialStorage(frame.loader().activeDocumentLoader(), identifier);
FetchOptions options;
options.credentials = shouldUseCredentialStorage ? FetchOptions::Credentials::Include : FetchOptions::Credentials::Omit;
options.redirect = shouldFollowRedirects == ShouldFollowRedirects::Yes ? FetchOptions::Redirect::Follow : FetchOptions::Redirect::Error;
InspectorInstrumentation::willSendRequestOfType(&frame, identifier, frame.loader().activeDocumentLoader(), request, InspectorInstrumentation::LoadType::Ping);
platformStrategies()->loaderStrategy()->startPingLoad(frame, request, WTFMove(originalRequestHeaders), options, [protectedFrame = makeRef(frame), identifier] (const ResourceError& error, const ResourceResponse& response) {
if (!response.isNull())
InspectorInstrumentation::didReceiveResourceResponse(protectedFrame, identifier, protectedFrame->loader().activeDocumentLoader(), response, nullptr);
if (error.isNull()) {
NetworkLoadMetrics emptyMetrics;
InspectorInstrumentation::didFinishLoading(protectedFrame.ptr(), protectedFrame->loader().activeDocumentLoader(), identifier, emptyMetrics, nullptr);
} else
InspectorInstrumentation::didFailLoading(protectedFrame.ptr(), protectedFrame->loader().activeDocumentLoader(), identifier, error);
});
}
}