1 // Copyright 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ 6 #define CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ 7 8 #include <map> 9 #include <utility> 10 11 #include "base/gtest_prod_util.h" 12 #include "base/memory/linked_ptr.h" 13 #include "base/strings/string_piece.h" 14 #include "content/common/content_export.h" 15 #include "webkit/common/resource_type.h" 16 17 class GURL; 18 19 namespace content { 20 21 struct ResourceResponseInfo; 22 23 // SiteIsolationPolicy implements the cross-site document blocking policy (XSDP) 24 // for Site Isolation. XSDP will monitor network responses to a renderer and 25 // block illegal responses so that a compromised renderer cannot steal private 26 // information from other sites. For now SiteIsolationPolicy monitors responses 27 // to gather various UMA stats to see the compatibility impact of actual 28 // deployment of the policy. The UMA stat categories SiteIsolationPolicy gathers 29 // are as follows: 30 // 31 // SiteIsolation.AllResponses : # of all network responses. 32 // SiteIsolation.XSD.DataLength : the length of the first packet of a response. 33 // SiteIsolation.XSD.MimeType (enum): 34 // # of responses from other sites, tagged with a document mime type. 35 // 0:HTML, 1:XML, 2:JSON, 3:Plain, 4:Others 36 // SiteIsolation.XSD.[%MIMETYPE].Blocked : 37 // blocked # of cross-site document responses grouped by sniffed MIME type. 38 // SiteIsolation.XSD.[%MIMETYPE].Blocked.RenderableStatusCode : 39 // # of responses with renderable status code, 40 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 41 // SiteIsolation.XSD.[%MIMETYPE].Blocked.NonRenderableStatusCode : 42 // # of responses with non-renderable status code, 43 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 44 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.RenderableStatusCode : 45 // # of responses failed to be sniffed for its MIME type, but blocked by 46 // "X-Content-Type-Options: nosniff" header, and with renderable status code 47 // out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 48 // SiteIsolation.XSD.[%MIMETYPE].NoSniffBlocked.NonRenderableStatusCode : 49 // # of responses failed to be sniffed for its MIME type, but blocked by 50 // "X-Content-Type-Options: nosniff" header, and with non-renderable status 51 // code out of SiteIsolation.XSD.[%MIMETYPE].Blocked. 52 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked : 53 // # of responses, but not blocked due to failure of mime sniffing. 54 // SiteIsolation.XSD.[%MIMETYPE].NotBlocked.MaybeJS : 55 // # of responses that are plausibly sniffed to be JavaScript. 56 57 struct SiteIsolationResponseMetaData { 58 59 enum CanonicalMimeType { 60 HTML = 0, 61 XML = 1, 62 JSON = 2, 63 Plain = 3, 64 Others = 4, 65 MaxCanonicalMimeType, 66 }; 67 68 SiteIsolationResponseMetaData(); 69 70 std::string frame_origin; 71 GURL response_url; 72 ResourceType::Type resource_type; 73 CanonicalMimeType canonical_mime_type; 74 int http_status_code; 75 bool no_sniff; 76 }; 77 78 class CONTENT_EXPORT SiteIsolationPolicy { 79 public: 80 // Set activation flag for the UMA data collection for this renderer process. 81 static void SetPolicyEnabled(bool enabled); 82 83 // Returns any bookkeeping data about the HTTP header information for the 84 // request identified by |request_id|. Any data returned should then be 85 // passed to ShouldBlockResponse with the first packet. 86 static linked_ptr<SiteIsolationResponseMetaData> OnReceivedResponse( 87 const GURL& frame_origin, 88 const GURL& response_url, 89 ResourceType::Type resource_type, 90 int origin_pid, 91 const ResourceResponseInfo& info); 92 93 // Examines the first network packet in case response_url is registered as a 94 // cross-site document by DidReceiveResponse(). In case that this response is 95 // blocked, it returns an alternative data to be sent to the renderer in 96 // |alternative_data|. This records various kinds of UMA data stats. This 97 // function is called only if the length of received data is non-zero. 98 static bool ShouldBlockResponse( 99 linked_ptr<SiteIsolationResponseMetaData>& resp_data, const char* payload, 100 int length, std::string* alternative_data); 101 102 private: 103 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsBlockableScheme); 104 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsSameSite); 105 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, IsValidCorsHeaderSet); 106 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForHTML); 107 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForXML); 108 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJSON); 109 FRIEND_TEST_ALL_PREFIXES(SiteIsolationPolicyTest, SniffForJS); 110 111 // Returns the representative mime type enum value of the mime type of 112 // response. For example, this returns the same value for all text/xml mime 113 // type families such as application/xml, application/rss+xml. 114 static SiteIsolationResponseMetaData::CanonicalMimeType GetCanonicalMimeType( 115 const std::string& mime_type); 116 117 // Returns whether this scheme is a target of cross-site document 118 // policy(XSDP). This returns true only for http://* and https://* urls. 119 static bool IsBlockableScheme(const GURL& frame_origin); 120 121 // Returns whether the two urls belong to the same sites. 122 static bool IsSameSite(const GURL& frame_origin, const GURL& response_url); 123 124 // Returns whether there's a valid CORS header for frame_origin. This is 125 // simliar to CrossOriginAccessControl::passesAccessControlCheck(), but we use 126 // sites as our security domain, not origins. 127 // TODO(dsjang): this must be improved to be more accurate to the actual CORS 128 // specification. For now, this works conservatively, allowing XSDs that are 129 // not allowed by actual CORS rules by ignoring 1) credentials and 2) 130 // methods. Preflight requests don't matter here since they are not used to 131 // decide whether to block a document or not on the client side. 132 static bool IsValidCorsHeaderSet(const GURL& frame_origin, 133 const GURL& website_origin, 134 const std::string& access_control_origin); 135 136 static bool SniffForHTML(base::StringPiece data); 137 static bool SniffForXML(base::StringPiece data); 138 static bool SniffForJSON(base::StringPiece data); 139 140 // TODO(dsjang): this is only needed for collecting UMA stat. Will be deleted 141 // when this class is used for actual blocking. 142 static bool SniffForJS(base::StringPiece data); 143 144 // Never needs to be constructed/destructed. SiteIsolationPolicy()145 SiteIsolationPolicy() {} ~SiteIsolationPolicy()146 ~SiteIsolationPolicy() {} 147 148 DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicy); 149 }; 150 151 } // namespace content 152 153 #endif // CONTENT_CHILD_SITE_ISOLATION_POLICY_H_ 154