ce3b91559ba17f9ecf7710b0ca38903030232957
[WebKit-https.git] / Source / WebCore / loader / cache / CachedResourceLoader.cpp
1 /*
2     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
3     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
4     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
5     Copyright (C) 2004-2017 Apple Inc. All rights reserved.
6     Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
7
8     This library is free software; you can redistribute it and/or
9     modify it under the terms of the GNU Library General Public
10     License as published by the Free Software Foundation; either
11     version 2 of the License, or (at your option) any later version.
12
13     This library is distributed in the hope that it will be useful,
14     but WITHOUT ANY WARRANTY; without even the implied warranty of
15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16     Library General Public License for more details.
17
18     You should have received a copy of the GNU Library General Public License
19     along with this library; see the file COPYING.LIB.  If not, write to
20     the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
21     Boston, MA 02110-1301, USA.
22
23     This class provides all functionality needed for loading images, style sheets and html
24     pages from the web. It has a memory cache for these objects.
25 */
26
27 #include "config.h"
28 #include "CachedResourceLoader.h"
29
30 #include "CachedCSSStyleSheet.h"
31 #include "CachedFont.h"
32 #include "CachedImage.h"
33 #include "CachedRawResource.h"
34 #include "CachedResourceRequest.h"
35 #include "CachedSVGDocument.h"
36 #include "CachedSVGFont.h"
37 #include "CachedScript.h"
38 #include "CachedXSLStyleSheet.h"
39 #include "Chrome.h"
40 #include "ChromeClient.h"
41 #include "ContentExtensionError.h"
42 #include "ContentExtensionRule.h"
43 #include "ContentSecurityPolicy.h"
44 #include "DOMWindow.h"
45 #include "DiagnosticLoggingClient.h"
46 #include "DiagnosticLoggingKeys.h"
47 #include "Document.h"
48 #include "DocumentLoader.h"
49 #include "Frame.h"
50 #include "FrameLoader.h"
51 #include "FrameLoaderClient.h"
52 #include "HTMLElement.h"
53 #include "HTMLFrameOwnerElement.h"
54 #include "HTTPHeaderField.h"
55 #include "LoaderStrategy.h"
56 #include "LocalizedStrings.h"
57 #include "Logging.h"
58 #include "MainFrame.h"
59 #include "MemoryCache.h"
60 #include "Page.h"
61 #include "PingLoader.h"
62 #include "PlatformStrategies.h"
63 #include "RenderElement.h"
64 #include "ResourceLoadInfo.h"
65 #include "ResourceTiming.h"
66 #include "RuntimeEnabledFeatures.h"
67 #include "ScriptController.h"
68 #include "SecurityOrigin.h"
69 #include "SecurityPolicy.h"
70 #include "ServiceWorker.h"
71 #include "Settings.h"
72 #include "StyleSheetContents.h"
73 #include "SubresourceLoader.h"
74 #include "UserContentController.h"
75 #include "UserStyleSheet.h"
76 #include <pal/SessionID.h>
77 #include <wtf/text/CString.h>
78 #include <wtf/text/WTFString.h>
79
80 #if ENABLE(APPLICATION_MANIFEST)
81 #include "CachedApplicationManifest.h"
82 #endif
83
84 #if ENABLE(VIDEO_TRACK)
85 #include "CachedTextTrack.h"
86 #endif
87
88 #undef RELEASE_LOG_IF_ALLOWED
89 #define RELEASE_LOG_IF_ALLOWED(fmt, ...) RELEASE_LOG_IF(isAlwaysOnLoggingAllowed(), Network, "%p - CachedResourceLoader::" fmt, this, ##__VA_ARGS__)
90
91 namespace WebCore {
92
93 // Timeout for link preloads to be used after window.onload
94 static const Seconds unusedPreloadTimeout { 3_s };
95
96 template <typename T, typename U>
97 static inline ResourceErrorOr<CachedResourceHandle<T>> castCachedResourceTo(ResourceErrorOr<CachedResourceHandle<U>>&& cachedResource)
98 {
99     if (cachedResource)
100         return CachedResourceHandle<T> { static_cast<T*>(cachedResource.value().get()) };
101     return makeUnexpected(cachedResource.error());
102 }
103
104 static CachedResource* createResource(CachedResource::Type type, CachedResourceRequest&& request, PAL::SessionID sessionID)
105 {
106     switch (type) {
107     case CachedResource::ImageResource:
108         return new CachedImage(WTFMove(request), sessionID);
109     case CachedResource::CSSStyleSheet:
110         return new CachedCSSStyleSheet(WTFMove(request), sessionID);
111     case CachedResource::Script:
112         return new CachedScript(WTFMove(request), sessionID);
113     case CachedResource::SVGDocumentResource:
114         return new CachedSVGDocument(WTFMove(request), sessionID);
115 #if ENABLE(SVG_FONTS)
116     case CachedResource::SVGFontResource:
117         return new CachedSVGFont(WTFMove(request), sessionID);
118 #endif
119     case CachedResource::FontResource:
120         return new CachedFont(WTFMove(request), sessionID);
121     case CachedResource::Beacon:
122     case CachedResource::MediaResource:
123     case CachedResource::RawResource:
124     case CachedResource::Icon:
125     case CachedResource::MainResource:
126         return new CachedRawResource(WTFMove(request), type, sessionID);
127 #if ENABLE(XSLT)
128     case CachedResource::XSLStyleSheet:
129         return new CachedXSLStyleSheet(WTFMove(request), sessionID);
130 #endif
131 #if ENABLE(LINK_PREFETCH)
132     case CachedResource::LinkPrefetch:
133         return new CachedResource(WTFMove(request), CachedResource::LinkPrefetch, sessionID);
134     case CachedResource::LinkSubresource:
135         return new CachedResource(WTFMove(request), CachedResource::LinkSubresource, sessionID);
136 #endif
137 #if ENABLE(VIDEO_TRACK)
138     case CachedResource::TextTrackResource:
139         return new CachedTextTrack(WTFMove(request), sessionID);
140 #endif
141 #if ENABLE(APPLICATION_MANIFEST)
142     case CachedResource::ApplicationManifest:
143         return new CachedApplicationManifest(WTFMove(request), sessionID);
144 #endif
145     }
146     ASSERT_NOT_REACHED();
147     return nullptr;
148 }
149
150 CachedResourceLoader::CachedResourceLoader(DocumentLoader* documentLoader)
151     : m_document(nullptr)
152     , m_documentLoader(documentLoader)
153     , m_requestCount(0)
154     , m_unusedPreloadsTimer(*this, &CachedResourceLoader::warnUnusedPreloads)
155     , m_garbageCollectDocumentResourcesTimer(*this, &CachedResourceLoader::garbageCollectDocumentResources)
156     , m_autoLoadImages(true)
157     , m_imagesEnabled(true)
158     , m_allowStaleResources(false)
159 {
160 }
161
162 CachedResourceLoader::~CachedResourceLoader()
163 {
164     m_documentLoader = nullptr;
165     m_document = nullptr;
166
167     clearPreloads(ClearPreloadsMode::ClearAllPreloads);
168     for (auto& resource : m_documentResources.values())
169         resource->setOwningCachedResourceLoader(nullptr);
170
171     // Make sure no requests still point to this CachedResourceLoader
172     ASSERT(m_requestCount == 0);
173     m_unusedPreloadsTimer.stop();
174 }
175
176 CachedResource* CachedResourceLoader::cachedResource(const String& resourceURL) const
177 {
178     ASSERT(!resourceURL.isNull());
179     return cachedResource(MemoryCache::removeFragmentIdentifierIfNeeded(m_document->completeURL(resourceURL)));
180 }
181
182 CachedResource* CachedResourceLoader::cachedResource(const URL& url) const
183 {
184     ASSERT(!MemoryCache::shouldRemoveFragmentIdentifier(url));
185     return m_documentResources.get(url).get();
186 }
187
188 Frame* CachedResourceLoader::frame() const
189 {
190     return m_documentLoader ? m_documentLoader->frame() : nullptr;
191 }
192
193 PAL::SessionID CachedResourceLoader::sessionID() const
194 {
195     auto sessionID = PAL::SessionID::defaultSessionID();
196     if (auto* frame = this->frame()) {
197         if (auto* page = frame->page())
198             sessionID = page->sessionID();
199     }
200     return sessionID;
201 }
202
203 ResourceErrorOr<CachedResourceHandle<CachedImage>> CachedResourceLoader::requestImage(CachedResourceRequest&& request)
204 {
205     request.setDestinationIfNotSet(FetchOptions::Destination::Image);
206     if (Frame* frame = this->frame()) {
207         if (frame->loader().pageDismissalEventBeingDispatched() != FrameLoader::PageDismissalType::None) {
208             if (Document* document = frame->document())
209                 request.upgradeInsecureRequestIfNeeded(*document);
210             URL requestURL = request.resourceRequest().url();
211             if (requestURL.isValid() && canRequest(CachedResource::ImageResource, requestURL, request, ForPreload::No))
212                 PingLoader::loadImage(*frame, requestURL);
213             return CachedResourceHandle<CachedImage> { };
214         }
215     }
216
217     auto defer = clientDefersImage(request.resourceRequest().url()) ? DeferOption::DeferredByClient : DeferOption::NoDefer;
218     return castCachedResourceTo<CachedImage>(requestResource(CachedResource::ImageResource, WTFMove(request), ForPreload::No, defer));
219 }
220
221 ResourceErrorOr<CachedResourceHandle<CachedFont>> CachedResourceLoader::requestFont(CachedResourceRequest&& request, bool isSVG)
222 {
223     request.setDestinationIfNotSet(FetchOptions::Destination::Font);
224 #if ENABLE(SVG_FONTS)
225     if (isSVG)
226         return castCachedResourceTo<CachedFont>(requestResource(CachedResource::SVGFontResource, WTFMove(request)));
227 #else
228     UNUSED_PARAM(isSVG);
229 #endif
230     return castCachedResourceTo<CachedFont>(requestResource(CachedResource::FontResource, WTFMove(request)));
231 }
232
233 #if ENABLE(VIDEO_TRACK)
234 ResourceErrorOr<CachedResourceHandle<CachedTextTrack>> CachedResourceLoader::requestTextTrack(CachedResourceRequest&& request)
235 {
236     request.setDestinationIfNotSet(FetchOptions::Destination::Track);
237     return castCachedResourceTo<CachedTextTrack>(requestResource(CachedResource::TextTrackResource, WTFMove(request)));
238 }
239 #endif
240
241 ResourceErrorOr<CachedResourceHandle<CachedCSSStyleSheet>> CachedResourceLoader::requestCSSStyleSheet(CachedResourceRequest&& request)
242 {
243     request.setDestinationIfNotSet(FetchOptions::Destination::Style);
244     return castCachedResourceTo<CachedCSSStyleSheet>(requestResource(CachedResource::CSSStyleSheet, WTFMove(request)));
245 }
246
247 CachedResourceHandle<CachedCSSStyleSheet> CachedResourceLoader::requestUserCSSStyleSheet(CachedResourceRequest&& request)
248 {
249     request.setDestinationIfNotSet(FetchOptions::Destination::Style);
250
251     ASSERT(document());
252     request.setDomainForCachePartition(*document());
253
254     auto& memoryCache = MemoryCache::singleton();
255     if (request.allowsCaching()) {
256         if (CachedResource* existing = memoryCache.resourceForRequest(request.resourceRequest(), sessionID())) {
257             if (is<CachedCSSStyleSheet>(*existing))
258                 return downcast<CachedCSSStyleSheet>(existing);
259             memoryCache.remove(*existing);
260         }
261     }
262
263     request.removeFragmentIdentifierIfNeeded();
264
265     CachedResourceHandle<CachedCSSStyleSheet> userSheet = new CachedCSSStyleSheet(WTFMove(request), sessionID());
266
267     if (userSheet->allowsCaching())
268         memoryCache.add(*userSheet);
269     // FIXME: loadResource calls setOwningCachedResourceLoader() if the resource couldn't be added to cache. Does this function need to call it, too?
270
271     userSheet->load(*this);
272     return userSheet;
273 }
274
275 ResourceErrorOr<CachedResourceHandle<CachedScript>> CachedResourceLoader::requestScript(CachedResourceRequest&& request)
276 {
277     request.setDestinationIfNotSet(FetchOptions::Destination::Script);
278     return castCachedResourceTo<CachedScript>(requestResource(CachedResource::Script, WTFMove(request)));
279 }
280
281 #if ENABLE(XSLT)
282 ResourceErrorOr<CachedResourceHandle<CachedXSLStyleSheet>> CachedResourceLoader::requestXSLStyleSheet(CachedResourceRequest&& request)
283 {
284     request.setDestinationIfNotSet(FetchOptions::Destination::Xslt);
285     return castCachedResourceTo<CachedXSLStyleSheet>(requestResource(CachedResource::XSLStyleSheet, WTFMove(request)));
286 }
287 #endif
288
289 ResourceErrorOr<CachedResourceHandle<CachedSVGDocument>> CachedResourceLoader::requestSVGDocument(CachedResourceRequest&& request)
290 {
291     return castCachedResourceTo<CachedSVGDocument>(requestResource(CachedResource::SVGDocumentResource, WTFMove(request)));
292 }
293
294 #if ENABLE(LINK_PREFETCH)
295 ResourceErrorOr<CachedResourceHandle<CachedResource>> CachedResourceLoader::requestLinkResource(CachedResource::Type type, CachedResourceRequest&& request)
296 {
297     ASSERT(frame());
298     ASSERT(type == CachedResource::LinkPrefetch || type == CachedResource::LinkSubresource);
299     return requestResource(type, WTFMove(request));
300 }
301 #endif
302
303 ResourceErrorOr<CachedResourceHandle<CachedRawResource>> CachedResourceLoader::requestMedia(CachedResourceRequest&& request)
304 {
305     // FIXME: Set destination to either audio or video.
306     return castCachedResourceTo<CachedRawResource>(requestResource(CachedResource::MediaResource, WTFMove(request)));
307 }
308
309 ResourceErrorOr<CachedResourceHandle<CachedRawResource>> CachedResourceLoader::requestIcon(CachedResourceRequest&& request)
310 {
311     request.setDestinationIfNotSet(FetchOptions::Destination::Image);
312     return castCachedResourceTo<CachedRawResource>(requestResource(CachedResource::Icon, WTFMove(request)));
313 }
314
315 ResourceErrorOr<CachedResourceHandle<CachedRawResource>> CachedResourceLoader::requestRawResource(CachedResourceRequest&& request)
316 {
317     ASSERT(request.options().destination == FetchOptions::Destination::EmptyString || request.options().serviceWorkersMode == ServiceWorkersMode::None);
318     return castCachedResourceTo<CachedRawResource>(requestResource(CachedResource::RawResource, WTFMove(request)));
319 }
320
321 ResourceErrorOr<CachedResourceHandle<CachedRawResource>> CachedResourceLoader::requestBeaconResource(CachedResourceRequest&& request)
322 {
323     ASSERT(request.options().destination == FetchOptions::Destination::EmptyString);
324     return castCachedResourceTo<CachedRawResource>(requestResource(CachedResource::Beacon, WTFMove(request)));
325 }
326
327 ResourceErrorOr<CachedResourceHandle<CachedRawResource>> CachedResourceLoader::requestMainResource(CachedResourceRequest&& request)
328 {
329     request.setDestinationIfNotSet(FetchOptions::Destination::Document);
330     return castCachedResourceTo<CachedRawResource>(requestResource(CachedResource::MainResource, WTFMove(request)));
331 }
332
333 #if ENABLE(APPLICATION_MANIFEST)
334 ResourceErrorOr<CachedResourceHandle<CachedApplicationManifest>> CachedResourceLoader::requestApplicationManifest(CachedResourceRequest&& request)
335 {
336     return castCachedResourceTo<CachedApplicationManifest>(requestResource(CachedResource::ApplicationManifest, WTFMove(request)));
337 }
338 #endif // ENABLE(APPLICATION_MANIFEST)
339
340 static MixedContentChecker::ContentType contentTypeFromResourceType(CachedResource::Type type)
341 {
342     switch (type) {
343     // https://w3c.github.io/webappsec-mixed-content/#category-optionally-blockable
344     // Editor's Draft, 11 February 2016
345     // 3.1. Optionally-blockable Content
346     case CachedResource::ImageResource:
347     case CachedResource::MediaResource:
348             return MixedContentChecker::ContentType::ActiveCanWarn;
349
350     case CachedResource::CSSStyleSheet:
351     case CachedResource::Script:
352     case CachedResource::FontResource:
353         return MixedContentChecker::ContentType::Active;
354
355 #if ENABLE(SVG_FONTS)
356     case CachedResource::SVGFontResource:
357         return MixedContentChecker::ContentType::Active;
358 #endif
359
360     case CachedResource::Beacon:
361     case CachedResource::RawResource:
362     case CachedResource::Icon:
363     case CachedResource::SVGDocumentResource:
364         return MixedContentChecker::ContentType::Active;
365 #if ENABLE(XSLT)
366     case CachedResource::XSLStyleSheet:
367         return MixedContentChecker::ContentType::Active;
368 #endif
369
370 #if ENABLE(LINK_PREFETCH)
371     case CachedResource::LinkPrefetch:
372     case CachedResource::LinkSubresource:
373         return MixedContentChecker::ContentType::Active;
374 #endif
375
376 #if ENABLE(VIDEO_TRACK)
377     case CachedResource::TextTrackResource:
378         return MixedContentChecker::ContentType::Active;
379 #endif
380 #if ENABLE(APPLICATION_MANIFEST)
381     case CachedResource::ApplicationManifest:
382         return MixedContentChecker::ContentType::Active;
383 #endif
384     default:
385         ASSERT_NOT_REACHED();
386         return MixedContentChecker::ContentType::Active;
387     }
388 }
389
390 bool CachedResourceLoader::checkInsecureContent(CachedResource::Type type, const URL& url) const
391 {
392     if (!canRequestInContentDispositionAttachmentSandbox(type, url))
393         return false;
394
395     switch (type) {
396     case CachedResource::Script:
397 #if ENABLE(XSLT)
398     case CachedResource::XSLStyleSheet:
399 #endif
400     case CachedResource::SVGDocumentResource:
401     case CachedResource::CSSStyleSheet:
402         // These resource can inject script into the current document (Script,
403         // XSL) or exfiltrate the content of the current document (CSS).
404         if (Frame* frame = this->frame()) {
405             if (!frame->loader().mixedContentChecker().canRunInsecureContent(m_document->securityOrigin(), url))
406                 return false;
407             Frame& top = frame->tree().top();
408             if (&top != frame && !top.loader().mixedContentChecker().canRunInsecureContent(top.document()->securityOrigin(), url))
409                 return false;
410         }
411         break;
412 #if ENABLE(VIDEO_TRACK)
413     case CachedResource::TextTrackResource:
414 #endif
415     case CachedResource::MediaResource:
416     case CachedResource::RawResource:
417     case CachedResource::Icon:
418     case CachedResource::ImageResource:
419 #if ENABLE(SVG_FONTS)
420     case CachedResource::SVGFontResource:
421 #endif
422     case CachedResource::FontResource: {
423         // These resources can corrupt only the frame's pixels.
424         if (Frame* frame = this->frame()) {
425             if (!frame->loader().mixedContentChecker().canDisplayInsecureContent(m_document->securityOrigin(), contentTypeFromResourceType(type), url, MixedContentChecker::AlwaysDisplayInNonStrictMode::Yes))
426                 return false;
427             Frame& topFrame = frame->tree().top();
428             if (!topFrame.loader().mixedContentChecker().canDisplayInsecureContent(topFrame.document()->securityOrigin(), contentTypeFromResourceType(type), url))
429                 return false;
430         }
431         break;
432     }
433     case CachedResource::MainResource:
434     case CachedResource::Beacon:
435 #if ENABLE(LINK_PREFETCH)
436     case CachedResource::LinkPrefetch:
437     case CachedResource::LinkSubresource:
438         // Prefetch cannot affect the current document.
439 #endif
440 #if ENABLE(APPLICATION_MANIFEST)
441     case CachedResource::ApplicationManifest:
442 #endif
443         break;
444     }
445     return true;
446 }
447
448 bool CachedResourceLoader::allowedByContentSecurityPolicy(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options, ContentSecurityPolicy::RedirectResponseReceived redirectResponseReceived) const
449 {
450     if (options.contentSecurityPolicyImposition == ContentSecurityPolicyImposition::SkipPolicyCheck)
451         return true;
452
453     ASSERT(m_document);
454     ASSERT(m_document->contentSecurityPolicy());
455
456     switch (type) {
457 #if ENABLE(XSLT)
458     case CachedResource::XSLStyleSheet:
459 #endif
460     case CachedResource::Script:
461         if (!m_document->contentSecurityPolicy()->allowScriptFromSource(url, redirectResponseReceived))
462             return false;
463         break;
464     case CachedResource::CSSStyleSheet:
465         if (!m_document->contentSecurityPolicy()->allowStyleFromSource(url, redirectResponseReceived))
466             return false;
467         break;
468     case CachedResource::SVGDocumentResource:
469     case CachedResource::Icon:
470     case CachedResource::ImageResource:
471         if (!m_document->contentSecurityPolicy()->allowImageFromSource(url, redirectResponseReceived))
472             return false;
473         break;
474 #if ENABLE(SVG_FONTS)
475     case CachedResource::SVGFontResource:
476 #endif
477     case CachedResource::FontResource:
478         if (!m_document->contentSecurityPolicy()->allowFontFromSource(url, redirectResponseReceived))
479             return false;
480         break;
481     case CachedResource::MediaResource:
482 #if ENABLE(VIDEO_TRACK)
483     case CachedResource::TextTrackResource:
484 #endif
485         if (!m_document->contentSecurityPolicy()->allowMediaFromSource(url, redirectResponseReceived))
486             return false;
487         break;
488     case CachedResource::Beacon:
489     case CachedResource::RawResource:
490         return true;
491 #if ENABLE(APPLICATION_MANIFEST)
492     case CachedResource::ApplicationManifest:
493         if (!m_document->contentSecurityPolicy()->allowManifestFromSource(url, redirectResponseReceived))
494             return false;
495         break;
496 #endif
497     default:
498         ASSERT_NOT_REACHED();
499     }
500
501     return true;
502 }
503
504 static inline bool isSameOriginDataURL(const URL& url, const ResourceLoaderOptions& options)
505 {
506     // FIXME: Remove same-origin data URL flag since it was removed from fetch spec (https://github.com/whatwg/fetch/issues/381).
507     return url.protocolIsData() && options.sameOriginDataURLFlag == SameOriginDataURLFlag::Set;
508 }
509
510 bool CachedResourceLoader::canRequest(CachedResource::Type type, const URL& url, const CachedResourceRequest& request, ForPreload forPreload)
511 {
512     auto& options = request.options();
513
514     if (document() && !document()->securityOrigin().canDisplay(url)) {
515         if (forPreload == ForPreload::No)
516             FrameLoader::reportLocalLoadFailed(frame(), url.stringCenterEllipsizedToLength());
517         LOG(ResourceLoading, "CachedResourceLoader::requestResource URL was not allowed by SecurityOrigin::canDisplay");
518         return false;
519     }
520
521     if (options.mode == FetchOptions::Mode::SameOrigin && !m_document->securityOrigin().canRequest(url) && !isSameOriginDataURL(url, options)) {
522         printAccessDeniedMessage(url);
523         return false;
524     }
525
526     if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::No))
527         return false;
528
529     // SVG Images have unique security rules that prevent all subresource requests except for data urls.
530     if (type != CachedResource::MainResource && frame() && frame()->page()) {
531         if (frame()->page()->chrome().client().isSVGImageChromeClient() && !url.protocolIsData())
532             return false;
533     }
534
535     // Last of all, check for insecure content. We do this last so that when folks block insecure content with a CSP policy, they don't get a warning.
536     // They'll still get a warning in the console about CSP blocking the load.
537
538     // FIXME: Should we consider whether the request is for preload here?
539     if (!checkInsecureContent(type, url))
540         return false;
541
542     return true;
543 }
544
545 // FIXME: Should we find a way to know whether the redirection is for a preload request like we do for CachedResourceLoader::canRequest?
546 bool CachedResourceLoader::canRequestAfterRedirection(CachedResource::Type type, const URL& url, const ResourceLoaderOptions& options) const
547 {
548     if (document() && !document()->securityOrigin().canDisplay(url)) {
549         FrameLoader::reportLocalLoadFailed(frame(), url.stringCenterEllipsizedToLength());
550         LOG(ResourceLoading, "CachedResourceLoader::requestResource URL was not allowed by SecurityOrigin::canDisplay");
551         return false;
552     }
553
554     // FIXME: According to https://fetch.spec.whatwg.org/#http-redirect-fetch, we should check that the URL is HTTP(s) except if in navigation mode.
555     // But we currently allow at least data URLs to be loaded.
556
557     if (options.mode == FetchOptions::Mode::SameOrigin && !m_document->securityOrigin().canRequest(url)) {
558         printAccessDeniedMessage(url);
559         return false;
560     }
561
562     if (!allowedByContentSecurityPolicy(type, url, options, ContentSecurityPolicy::RedirectResponseReceived::Yes))
563         return false;
564
565     // Last of all, check for insecure content. We do this last so that when folks block insecure content with a CSP policy, they don't get a warning.
566     // They'll still get a warning in the console about CSP blocking the load.
567     if (!checkInsecureContent(type, url))
568         return false;
569
570     return true;
571 }
572
573 bool CachedResourceLoader::updateRequestAfterRedirection(CachedResource::Type type, ResourceRequest& request, const ResourceLoaderOptions& options)
574 {
575     ASSERT(m_documentLoader);
576     if (auto* document = m_documentLoader->cachedResourceLoader().document())
577         upgradeInsecureResourceRequestIfNeeded(request, *document);
578
579     // FIXME: We might want to align the checks done here with the ones done in CachedResourceLoader::requestResource, content extensions blocking in particular.
580
581     return canRequestAfterRedirection(type, request.url(), options);
582 }
583
584 bool CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox(CachedResource::Type type, const URL& url) const
585 {
586     Document* document;
587
588     // FIXME: Do we want to expand this to all resource types that the mixed content checker would consider active content?
589     switch (type) {
590     case CachedResource::MainResource:
591         if (auto ownerElement = frame() ? frame()->ownerElement() : nullptr) {
592             document = &ownerElement->document();
593             break;
594         }
595         return true;
596     case CachedResource::CSSStyleSheet:
597         document = m_document;
598         break;
599     default:
600         return true;
601     }
602
603     if (!document->shouldEnforceContentDispositionAttachmentSandbox() || document->securityOrigin().canRequest(url))
604         return true;
605
606     String message = "Unsafe attempt to load URL " + url.stringCenterEllipsizedToLength() + " from document with Content-Disposition: attachment at URL " + document->url().stringCenterEllipsizedToLength() + ".";
607     document->addConsoleMessage(MessageSource::Security, MessageLevel::Error, message);
608     return false;
609 }
610
611 bool CachedResourceLoader::shouldContinueAfterNotifyingLoadedFromMemoryCache(const CachedResourceRequest& request, CachedResource& resource, ResourceError& error)
612 {
613     if (!frame() || resource.status() != CachedResource::Cached)
614         return true;
615
616     ResourceRequest newRequest = ResourceRequest(resource.url());
617     newRequest.setInitiatorIdentifier(request.resourceRequest().initiatorIdentifier());
618     if (request.resourceRequest().hiddenFromInspector())
619         newRequest.setHiddenFromInspector(true);
620     frame()->loader().loadedResourceFromMemoryCache(resource, newRequest, error);
621
622     // FIXME <http://webkit.org/b/113251>: If the delegate modifies the request's
623     // URL, it is no longer appropriate to use this CachedResource.
624     return !newRequest.isNull();
625 }
626
627 bool CachedResourceLoader::shouldUpdateCachedResourceWithCurrentRequest(const CachedResource& resource, const CachedResourceRequest& request)
628 {
629     // WebKit is not supporting CORS for fonts (https://bugs.webkit.org/show_bug.cgi?id=86817), no need to update the resource before reusing it.
630     if (resource.type() == CachedResource::Type::FontResource)
631         return false;
632
633 #if ENABLE(SVG_FONTS)
634     if (resource.type() == CachedResource::Type::SVGFontResource)
635         return false;
636 #endif
637
638 #if ENABLE(XSLT)
639     // Load is same-origin, we do not check for CORS.
640     if (resource.type() == CachedResource::XSLStyleSheet)
641         return false;
642 #endif
643
644     // FIXME: We should enable resource reuse for these resource types
645     switch (resource.type()) {
646     case CachedResource::SVGDocumentResource:
647         return false;
648     case CachedResource::MainResource:
649         return false;
650 #if ENABLE(LINK_PREFETCH)
651     case CachedResource::LinkPrefetch:
652         return false;
653     case CachedResource::LinkSubresource:
654         return false;
655 #endif
656     default:
657         break;
658     }
659
660     if (resource.options().mode != request.options().mode || !originsMatch(request.origin(), resource.origin()))
661         return true;
662
663     if (resource.options().redirect != request.options().redirect && resource.hasRedirections())
664         return true;
665
666     return false;
667 }
668
669 static inline bool isResourceSuitableForDirectReuse(const CachedResource& resource, const CachedResourceRequest& request)
670 {
671     // FIXME: For being loaded requests, the response tainting may not be correctly computed if the fetch mode is not the same.
672     // Even if the fetch mode is the same, we are not sure that the resource can be reused (Vary: Origin header for instance).
673     // We should find a way to improve this.
674     if (resource.status() != CachedResource::Cached)
675         return false;
676
677     // If the cached resource has not followed redirections, it is incomplete and we should not use it.
678     // Let's make sure the memory cache has no such resource.
679     ASSERT(resource.response().type() != ResourceResponse::Type::Opaqueredirect);
680
681     // We could support redirect modes other than Follow in case of a redirected resource.
682     // This case is rare and is not worth optimizing currently.
683     if (request.options().redirect != FetchOptions::Redirect::Follow && resource.hasRedirections())
684         return false;
685
686     // FIXME: Implement reuse of cached raw resources.
687     if (resource.type() == CachedResource::Type::RawResource || resource.type() == CachedResource::Type::MediaResource)
688         return false;
689
690     if (resource.type() == CachedResource::Beacon)
691         return false;
692
693     return true;
694 }
695
696 CachedResourceHandle<CachedResource> CachedResourceLoader::updateCachedResourceWithCurrentRequest(const CachedResource& resource, CachedResourceRequest&& request)
697 {
698     if (!isResourceSuitableForDirectReuse(resource, request)) {
699         request.setCachingPolicy(CachingPolicy::DisallowCaching);
700         return loadResource(resource.type(), WTFMove(request));
701     }
702
703     auto resourceHandle = createResource(resource.type(), WTFMove(request), sessionID());
704     resourceHandle->loadFrom(resource);
705     return resourceHandle;
706 }
707
708 static inline void logMemoryCacheResourceRequest(Frame* frame, const String& key, const String& description)
709 {
710     if (!frame || !frame->page())
711         return;
712     frame->page()->diagnosticLoggingClient().logDiagnosticMessage(key, description, ShouldSample::Yes);
713 }
714
715 void CachedResourceLoader::prepareFetch(CachedResource::Type type, CachedResourceRequest& request)
716 {
717     // Implementing step 1 to 7 of https://fetch.spec.whatwg.org/#fetching
718     auto* document = this->document();
719
720     if (document) {
721         if (!request.origin())
722             request.setOrigin(document->securityOrigin());
723 #if ENABLE(SERVICE_WORKER)
724         request.setClientIdentifierIfNeeded(document->identifier());
725         if (auto* activeServiceWorker = document->activeServiceWorker())
726             request.setSelectedServiceWorkerRegistrationIdentifierIfNeeded(activeServiceWorker->registrationIdentifier());
727 #endif
728     }
729
730     request.setAcceptHeaderIfNone(type);
731
732     // Accept-Language value is handled in underlying port-specific code.
733     // FIXME: Decide whether to support client hints
734 }
735
736 void CachedResourceLoader::updateHTTPRequestHeaders(CachedResource::Type type, CachedResourceRequest& request)
737 {
738     // Implementing steps 7 to 12 of https://fetch.spec.whatwg.org/#http-network-or-cache-fetch
739
740     // FIXME: We should reconcile handling of MainResource with other resources.
741     if (type != CachedResource::Type::MainResource) {
742         // In some cases we may try to load resources in frameless documents. Such loads always fail.
743         // FIXME: We shouldn't need to do the check on frame.
744         if (auto* frame = this->frame())
745             request.updateReferrerOriginAndUserAgentHeaders(frame->loader());
746     }
747
748     request.updateAccordingCacheMode();
749 }
750
751 ResourceErrorOr<CachedResourceHandle<CachedResource>> CachedResourceLoader::requestResource(CachedResource::Type type, CachedResourceRequest&& request, ForPreload forPreload, DeferOption defer)
752 {
753     // Entry point to https://fetch.spec.whatwg.org/#main-fetch.
754     std::unique_ptr<ResourceRequest> originalRequest;
755     if (CachedResource::shouldUsePingLoad(type))
756         originalRequest = std::make_unique<ResourceRequest>(request.resourceRequest());
757
758     if (Document* document = this->document())
759         request.upgradeInsecureRequestIfNeeded(*document);
760
761     request.updateReferrerPolicy(document() ? document()->referrerPolicy() : ReferrerPolicy::NoReferrerWhenDowngrade);
762     URL url = request.resourceRequest().url();
763
764     LOG(ResourceLoading, "CachedResourceLoader::requestResource '%s', charset '%s', priority=%d, forPreload=%u", url.stringCenterEllipsizedToLength().latin1().data(), request.charset().latin1().data(), request.priority() ? static_cast<int>(request.priority().value()) : -1, forPreload == ForPreload::Yes);
765
766     if (!url.isValid()) {
767         RELEASE_LOG_IF_ALLOWED("requestResource: URL is invalid (frame = %p)", frame());
768         return makeUnexpected(ResourceError { errorDomainWebKitInternal, 0, url, ASCIILiteral("URL is invalid") });
769     }
770
771     prepareFetch(type, request);
772
773     // We are passing url as well as request, as request url may contain a fragment identifier.
774     if (!canRequest(type, url, request, forPreload)) {
775         RELEASE_LOG_IF_ALLOWED("requestResource: Not allowed to request resource (frame = %p)", frame());
776         return makeUnexpected(ResourceError { errorDomainWebKitInternal, 0, url, ASCIILiteral("Not allowed to request resource"), ResourceError::Type::AccessControl });
777     }
778
779 #if ENABLE(CONTENT_EXTENSIONS)
780     if (frame() && frame()->page() && m_documentLoader) {
781         const auto& resourceRequest = request.resourceRequest();
782         auto* page = frame()->page();
783         auto blockedStatus = page->userContentProvider().processContentExtensionRulesForLoad(resourceRequest.url(), toResourceType(type), *m_documentLoader);
784         request.applyBlockedStatus(blockedStatus, page);
785         if (blockedStatus.blockedLoad) {
786             RELEASE_LOG_IF_ALLOWED("requestResource: Resource blocked by content blocker (frame = %p)", frame());
787             if (type == CachedResource::Type::MainResource) {
788                 CachedResourceHandle<CachedResource> resource = createResource(type, WTFMove(request), sessionID());
789                 ASSERT(resource);
790                 resource->error(CachedResource::Status::LoadError);
791                 resource->setResourceError(ResourceError(ContentExtensions::WebKitContentBlockerDomain, 0, resourceRequest.url(), WEB_UI_STRING("The URL was blocked by a content blocker", "WebKitErrorBlockedByContentBlocker description")));
792                 return WTFMove(resource);
793             }
794             return makeUnexpected(ResourceError { errorDomainWebKitInternal, 0, url, ASCIILiteral("Resource blocked by content blocker"), ResourceError::Type::AccessControl });
795         }
796         if (blockedStatus.madeHTTPS
797             && type == CachedResource::Type::MainResource
798             && m_documentLoader->isLoadingMainResource()) {
799             // This is to make sure the correct 'new' URL shows in the location bar.
800             m_documentLoader->frameLoader()->client().dispatchDidChangeProvisionalURL();
801         }
802         url = request.resourceRequest().url(); // The content extension could have changed it from http to https.
803         url = MemoryCache::removeFragmentIdentifierIfNeeded(url); // Might need to remove fragment identifier again.
804     }
805 #endif
806
807     if (frame() && m_documentLoader && !m_documentLoader->customHeaderFields().isEmpty()) {
808         bool sameOriginRequest = false;
809         auto requestedOrigin = SecurityOrigin::create(url);
810         if (type == CachedResource::Type::MainResource) {
811             if (frame()->isMainFrame())
812                 sameOriginRequest = true;
813             else if (auto* topDocument = frame()->mainFrame().document())
814                 sameOriginRequest = topDocument->securityOrigin().isSameSchemeHostPort(requestedOrigin.get());
815         } else if (document()) {
816             sameOriginRequest = document()->topDocument().securityOrigin().isSameSchemeHostPort(requestedOrigin.get())
817                 && document()->securityOrigin().isSameSchemeHostPort(requestedOrigin.get());
818         }
819         if (sameOriginRequest) {
820             for (auto& field : m_documentLoader->customHeaderFields())
821                 request.resourceRequest().setHTTPHeaderField(field.name(), field.value());
822         }
823     }
824
825     LoadTiming loadTiming;
826     loadTiming.markStartTimeAndFetchStart();
827     InitiatorContext initiatorContext = request.options().initiatorContext;
828
829     if (request.resourceRequest().url().protocolIsInHTTPFamily())
830         updateHTTPRequestHeaders(type, request);
831
832     auto& memoryCache = MemoryCache::singleton();
833     if (request.allowsCaching() && memoryCache.disabled()) {
834         if (auto handle = m_documentResources.take(url.string()))
835             handle->setOwningCachedResourceLoader(nullptr);
836     }
837
838     // See if we can use an existing resource from the cache.
839     CachedResourceHandle<CachedResource> resource;
840     if (document())
841         request.setDomainForCachePartition(*document());
842
843     if (request.allowsCaching())
844         resource = memoryCache.resourceForRequest(request.resourceRequest(), sessionID());
845
846     if (resource && request.isLinkPreload() && !resource->isLinkPreload())
847         resource->setLinkPreload();
848
849     logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::memoryCacheUsageKey(), resource ? DiagnosticLoggingKeys::inMemoryCacheKey() : DiagnosticLoggingKeys::notInMemoryCacheKey());
850
851     RevalidationPolicy policy = determineRevalidationPolicy(type, request, resource.get(), forPreload, defer);
852     switch (policy) {
853     case Reload:
854         memoryCache.remove(*resource);
855         FALLTHROUGH;
856     case Load:
857         if (resource)
858             logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::memoryCacheEntryDecisionKey(), DiagnosticLoggingKeys::unusedKey());
859         resource = loadResource(type, WTFMove(request));
860         break;
861     case Revalidate:
862         if (resource)
863             logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::memoryCacheEntryDecisionKey(), DiagnosticLoggingKeys::revalidatingKey());
864         resource = revalidateResource(WTFMove(request), *resource);
865         break;
866     case Use:
867         ASSERT(resource);
868         if (shouldUpdateCachedResourceWithCurrentRequest(*resource, request)) {
869             resource = updateCachedResourceWithCurrentRequest(*resource, WTFMove(request));
870             if (resource->status() != CachedResource::Status::Cached)
871                 policy = Load;
872         } else {
873             ResourceError error;
874             if (!shouldContinueAfterNotifyingLoadedFromMemoryCache(request, *resource, error))
875                 return makeUnexpected(WTFMove(error));
876             logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::memoryCacheEntryDecisionKey(), DiagnosticLoggingKeys::usedKey());
877             loadTiming.setResponseEnd(MonotonicTime::now());
878
879             memoryCache.resourceAccessed(*resource);
880
881             if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled() && document() && !resource->isLoading()) {
882                 auto resourceTiming = ResourceTiming::fromCache(url, request.initiatorName(), loadTiming, resource->response(), *request.origin());
883                 if (initiatorContext == InitiatorContext::Worker) {
884                     ASSERT(is<CachedRawResource>(resource.get()));
885                     downcast<CachedRawResource>(resource.get())->finishedTimingForWorkerLoad(WTFMove(resourceTiming));
886                 } else {
887                     ASSERT(initiatorContext == InitiatorContext::Document);
888                     m_resourceTimingInfo.storeResourceTimingInitiatorInformation(resource, request.initiatorName(), frame());
889                     m_resourceTimingInfo.addResourceTiming(*resource.get(), *document(), WTFMove(resourceTiming));
890                 }
891             }
892
893             if (forPreload == ForPreload::No)
894                 resource->setLoadPriority(request.priority());
895         }
896         break;
897     }
898     ASSERT(resource);
899     resource->setOriginalRequest(WTFMove(originalRequest));
900
901     if (forPreload == ForPreload::No && resource->loader() && resource->ignoreForRequestCount()) {
902         resource->setIgnoreForRequestCount(false);
903         incrementRequestCount(*resource);
904     }
905
906     if ((policy != Use || resource->stillNeedsLoad()) && defer == DeferOption::NoDefer) {
907         resource->load(*this);
908
909         // We don't support immediate loads, but we do support immediate failure.
910         if (resource->errorOccurred()) {
911             if (resource->allowsCaching() && resource->inCache())
912                 memoryCache.remove(*resource);
913
914             auto resourceError = resource->resourceError();
915             // Synchronous cancellations are likely due to access control.
916             if (resourceError.isNull() || resourceError.isCancellation())
917                 return makeUnexpected(ResourceError { String(), 0, url, String(), ResourceError::Type::AccessControl });
918             return makeUnexpected(resourceError);
919         }
920     }
921
922     if (document() && !document()->loadEventFinished() && !resource->resourceRequest().url().protocolIsData())
923         m_validatedURLs.add(resource->resourceRequest().url());
924
925     ASSERT(resource->url() == url.string());
926     m_documentResources.set(resource->url(), resource);
927     return WTFMove(resource);
928 }
929
930 void CachedResourceLoader::documentDidFinishLoadEvent()
931 {
932     m_validatedURLs.clear();
933
934     // If m_preloads is not empty here, it's full of link preloads,
935     // as speculative preloads were cleared at DCL.
936     if (m_preloads && m_preloads->size() && !m_unusedPreloadsTimer.isActive())
937         m_unusedPreloadsTimer.startOneShot(unusedPreloadTimeout);
938 }
939
940 void CachedResourceLoader::stopUnusedPreloadsTimer()
941 {
942     m_unusedPreloadsTimer.stop();
943 }
944
945 CachedResourceHandle<CachedResource> CachedResourceLoader::revalidateResource(CachedResourceRequest&& request, CachedResource& resource)
946 {
947     ASSERT(resource.inCache());
948     auto& memoryCache = MemoryCache::singleton();
949     ASSERT(!memoryCache.disabled());
950     ASSERT(resource.canUseCacheValidator());
951     ASSERT(!resource.resourceToRevalidate());
952     ASSERT(resource.sessionID() == sessionID());
953     ASSERT(resource.allowsCaching());
954
955     CachedResourceHandle<CachedResource> newResource = createResource(resource.type(), WTFMove(request), resource.sessionID());
956
957     LOG(ResourceLoading, "Resource %p created to revalidate %p", newResource.get(), &resource);
958     newResource->setResourceToRevalidate(&resource);
959
960     memoryCache.remove(resource);
961     memoryCache.add(*newResource);
962
963     if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())
964         m_resourceTimingInfo.storeResourceTimingInitiatorInformation(newResource, newResource->initiatorName(), frame());
965
966     return newResource;
967 }
968
969 CachedResourceHandle<CachedResource> CachedResourceLoader::loadResource(CachedResource::Type type, CachedResourceRequest&& request)
970 {
971     auto& memoryCache = MemoryCache::singleton();
972     ASSERT(!request.allowsCaching() || !memoryCache.resourceForRequest(request.resourceRequest(), sessionID())
973         || request.resourceRequest().cachePolicy() == DoNotUseAnyCache || request.resourceRequest().cachePolicy() == ReloadIgnoringCacheData || request.resourceRequest().cachePolicy() == RefreshAnyCacheData);
974
975     LOG(ResourceLoading, "Loading CachedResource for '%s'.", request.resourceRequest().url().stringCenterEllipsizedToLength().latin1().data());
976
977     CachedResourceHandle<CachedResource> resource = createResource(type, WTFMove(request), sessionID());
978
979     if (resource->allowsCaching() && !memoryCache.add(*resource))
980         resource->setOwningCachedResourceLoader(this);
981
982     if (RuntimeEnabledFeatures::sharedFeatures().resourceTimingEnabled())
983         m_resourceTimingInfo.storeResourceTimingInitiatorInformation(resource, resource->initiatorName(), frame());
984
985     return resource;
986 }
987
988 static void logRevalidation(const String& reason, DiagnosticLoggingClient& logClient)
989 {
990     logClient.logDiagnosticMessage(DiagnosticLoggingKeys::cachedResourceRevalidationReasonKey(), reason, ShouldSample::Yes);
991 }
992
993 static void logResourceRevalidationDecision(CachedResource::RevalidationDecision reason, const Frame* frame)
994 {
995     if (!frame || !frame->page())
996         return;
997     auto& logClient = frame->page()->diagnosticLoggingClient();
998     switch (reason) {
999     case CachedResource::RevalidationDecision::No:
1000         break;
1001     case CachedResource::RevalidationDecision::YesDueToExpired:
1002         logRevalidation(DiagnosticLoggingKeys::isExpiredKey(), logClient);
1003         break;
1004     case CachedResource::RevalidationDecision::YesDueToNoStore:
1005         logRevalidation(DiagnosticLoggingKeys::noStoreKey(), logClient);
1006         break;
1007     case CachedResource::RevalidationDecision::YesDueToNoCache:
1008         logRevalidation(DiagnosticLoggingKeys::noCacheKey(), logClient);
1009         break;
1010     case CachedResource::RevalidationDecision::YesDueToCachePolicy:
1011         logRevalidation(DiagnosticLoggingKeys::reloadKey(), logClient);
1012         break;
1013     }
1014 }
1015
1016 CachedResourceLoader::RevalidationPolicy CachedResourceLoader::determineRevalidationPolicy(CachedResource::Type type, CachedResourceRequest& cachedResourceRequest, CachedResource* existingResource, ForPreload forPreload, DeferOption defer) const
1017 {
1018     auto& request = cachedResourceRequest.resourceRequest();
1019
1020     if (!existingResource)
1021         return Load;
1022
1023     if (request.cachePolicy() == DoNotUseAnyCache || request.cachePolicy() == ReloadIgnoringCacheData)
1024         return Load;
1025
1026     if (request.cachePolicy() == RefreshAnyCacheData)
1027         return Reload;
1028
1029 #if ENABLE(SERVICE_WORKER)
1030     // FIXME: We should validate/specify this behavior.
1031     if (cachedResourceRequest.options().serviceWorkerRegistrationIdentifier != existingResource->options().serviceWorkerRegistrationIdentifier) {
1032         LOG(ResourceLoading, "CachedResourceLoader::determineRevalidationPolicy reloading because selected service worker differs");
1033         return Reload;
1034     }
1035 #endif
1036
1037     // We already have a preload going for this URL.
1038     if (forPreload == ForPreload::Yes && existingResource->isPreloaded())
1039         return Use;
1040
1041     // If the same URL has been loaded as a different type, we need to reload.
1042     if (existingResource->type() != type) {
1043         LOG(ResourceLoading, "CachedResourceLoader::determineRevalidationPolicy reloading due to type mismatch.");
1044         logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::inMemoryCacheKey(), DiagnosticLoggingKeys::unusedReasonTypeMismatchKey());
1045         return Reload;
1046     }
1047
1048     if (!existingResource->varyHeaderValuesMatch(request))
1049         return Reload;
1050
1051     auto* textDecoder = existingResource->textResourceDecoder();
1052     if (textDecoder && !textDecoder->hasEqualEncodingForCharset(cachedResourceRequest.charset())) {
1053         if (!existingResource->hasUnknownEncoding())
1054             return Reload;
1055         existingResource->setHasUnknownEncoding(false);
1056         existingResource->setEncoding(cachedResourceRequest.charset());
1057     }
1058
1059     // FIXME: We should use the same cache policy for all resource types. The raw resource policy is overly strict
1060     //        while the normal subresource policy is too loose.
1061     if (existingResource->isMainOrMediaOrIconOrRawResource() && frame()) {
1062         bool strictPolicyDisabled = frame()->loader().isStrictRawResourceValidationPolicyDisabledForTesting();
1063         bool canReuseRawResource = strictPolicyDisabled || downcast<CachedRawResource>(*existingResource).canReuse(request);
1064         if (!canReuseRawResource)
1065             return Reload;
1066     }
1067
1068     // Conditional requests should have failed canReuse check.
1069     ASSERT(!request.isConditional());
1070
1071     // Do not load from cache if images are not enabled. The load for this image will be blocked in CachedImage::load.
1072     if (defer == DeferOption::DeferredByClient)
1073         return Reload;
1074
1075     // Don't reload resources while pasting or if cache mode allows stale resources.
1076     if (m_allowStaleResources || cachedResourceRequest.options().cache == FetchOptions::Cache::ForceCache || cachedResourceRequest.options().cache == FetchOptions::Cache::OnlyIfCached)
1077         return Use;
1078
1079     ASSERT(cachedResourceRequest.options().cache == FetchOptions::Cache::Default || cachedResourceRequest.options().cache == FetchOptions::Cache::NoCache);
1080
1081     // Always use preloads.
1082     if (existingResource->isPreloaded())
1083         return Use;
1084
1085     // We can find resources that are being validated from cache only when validation is just successfully completing.
1086     if (existingResource->validationCompleting())
1087         return Use;
1088     ASSERT(!existingResource->validationInProgress());
1089
1090     auto cachePolicy = this->cachePolicy(type, request.url());
1091
1092     // Validate the redirect chain.
1093     bool cachePolicyIsHistoryBuffer = cachePolicy == CachePolicyHistoryBuffer;
1094     if (!existingResource->redirectChainAllowsReuse(cachePolicyIsHistoryBuffer ? ReuseExpiredRedirection : DoNotReuseExpiredRedirection)) {
1095         LOG(ResourceLoading, "CachedResourceLoader::determineRevalidationPolicy reloading due to not cached or expired redirections.");
1096         logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::inMemoryCacheKey(), DiagnosticLoggingKeys::unusedReasonRedirectChainKey());
1097         return Reload;
1098     }
1099
1100     // CachePolicyHistoryBuffer uses the cache except if this is a main resource with "cache-control: no-store".
1101     if (cachePolicyIsHistoryBuffer) {
1102         // FIXME: Ignoring "cache-control: no-cache" for sub-resources on history navigation but not the main
1103         // resource is inconsistent. We should probably harmonize this.
1104         if (!existingResource->response().cacheControlContainsNoStore() || type != CachedResource::MainResource)
1105             return Use;
1106     }
1107
1108     // Don't reuse resources with Cache-control: no-store.
1109     if (existingResource->response().cacheControlContainsNoStore()) {
1110         LOG(ResourceLoading, "CachedResourceLoader::determineRevalidationPolicy reloading due to Cache-control: no-store.");
1111         logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::inMemoryCacheKey(), DiagnosticLoggingKeys::unusedReasonNoStoreKey());
1112         return Reload;
1113     }
1114
1115     // If credentials were sent with the previous request and won't be
1116     // with this one, or vice versa, re-fetch the resource.
1117     //
1118     // This helps with the case where the server sends back
1119     // "Access-Control-Allow-Origin: *" all the time, but some of the
1120     // client's requests are made without CORS and some with.
1121     if (existingResource->resourceRequest().allowCookies() != request.allowCookies() || existingResource->options().credentials != cachedResourceRequest.options().credentials) {
1122         LOG(ResourceLoading, "CachedResourceLoader::determineRevalidationPolicy reloading due to difference in credentials settings.");
1123         logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::inMemoryCacheKey(), DiagnosticLoggingKeys::unusedReasonCredentialSettingsKey());
1124         return Reload;
1125     }
1126
1127     // During the initial load, avoid loading the same resource multiple times for a single document, even if the cache policies would tell us to.
1128     if (document() && !document()->loadEventFinished() && m_validatedURLs.contains(existingResource->url()))
1129         return Use;
1130
1131     // CachePolicyReload always reloads
1132     if (cachePolicy == CachePolicyReload) {
1133         LOG(ResourceLoading, "CachedResourceLoader::determineRevalidationPolicy reloading due to CachePolicyReload.");
1134         logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::inMemoryCacheKey(), DiagnosticLoggingKeys::unusedReasonReloadKey());
1135         return Reload;
1136     }
1137     
1138     // We'll try to reload the resource if it failed last time.
1139     if (existingResource->errorOccurred()) {
1140         LOG(ResourceLoading, "CachedResourceLoader::determineRevalidationPolicye reloading due to resource being in the error state");
1141         logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::inMemoryCacheKey(), DiagnosticLoggingKeys::unusedReasonErrorKey());
1142         return Reload;
1143     }
1144
1145     if (existingResource->isLoading()) {
1146         // Do not use cached main resources that are still loading because sharing
1147         // loading CachedResources in this case causes issues with regards to cancellation.
1148         // If one of the DocumentLoader clients decides to cancel the load, then the load
1149         // would be cancelled for all other DocumentLoaders as well.
1150         if (type == CachedResource::Type::MainResource)
1151             return Reload;
1152         // For cached subresources that are still loading we ignore the cache policy.
1153         return Use;
1154     }
1155
1156     auto revalidationDecision = existingResource->makeRevalidationDecision(cachePolicy);
1157     logResourceRevalidationDecision(revalidationDecision, frame());
1158
1159     // Check if the cache headers requires us to revalidate (cache expiration for example).
1160     if (revalidationDecision != CachedResource::RevalidationDecision::No) {
1161         // See if the resource has usable ETag or Last-modified headers.
1162         if (existingResource->canUseCacheValidator())
1163             return Revalidate;
1164         
1165         // No, must reload.
1166         LOG(ResourceLoading, "CachedResourceLoader::determineRevalidationPolicy reloading due to missing cache validators.");
1167         logMemoryCacheResourceRequest(frame(), DiagnosticLoggingKeys::inMemoryCacheKey(), DiagnosticLoggingKeys::unusedReasonMustRevalidateNoValidatorKey());
1168         return Reload;
1169     }
1170
1171     return Use;
1172 }
1173
1174 void CachedResourceLoader::printAccessDeniedMessage(const URL& url) const
1175 {
1176     if (url.isNull())
1177         return;
1178
1179     if (!frame())
1180         return;
1181
1182     String message;
1183     if (!m_document || m_document->url().isNull())
1184         message = "Unsafe attempt to load URL " + url.stringCenterEllipsizedToLength() + '.';
1185     else
1186         message = "Unsafe attempt to load URL " + url.stringCenterEllipsizedToLength() + " from frame with URL " + m_document->url().stringCenterEllipsizedToLength() + ". Domains, protocols and ports must match.\n";
1187
1188     frame()->document()->addConsoleMessage(MessageSource::Security, MessageLevel::Error, message);
1189 }
1190
1191 void CachedResourceLoader::setAutoLoadImages(bool enable)
1192 {
1193     if (enable == m_autoLoadImages)
1194         return;
1195
1196     m_autoLoadImages = enable;
1197
1198     if (!m_autoLoadImages)
1199         return;
1200
1201     reloadImagesIfNotDeferred();
1202 }
1203
1204 void CachedResourceLoader::setImagesEnabled(bool enable)
1205 {
1206     if (enable == m_imagesEnabled)
1207         return;
1208
1209     m_imagesEnabled = enable;
1210
1211     if (!m_imagesEnabled)
1212         return;
1213
1214     reloadImagesIfNotDeferred();
1215 }
1216
1217 bool CachedResourceLoader::clientDefersImage(const URL&) const
1218 {
1219     return !m_imagesEnabled;
1220 }
1221
1222 bool CachedResourceLoader::shouldPerformImageLoad(const URL& url) const
1223 {
1224     return m_autoLoadImages || url.protocolIsData();
1225 }
1226
1227 bool CachedResourceLoader::shouldDeferImageLoad(const URL& url) const
1228 {
1229     return clientDefersImage(url) || !shouldPerformImageLoad(url);
1230 }
1231
1232 void CachedResourceLoader::reloadImagesIfNotDeferred()
1233 {
1234     for (auto& resource : m_documentResources.values()) {
1235         if (is<CachedImage>(*resource) && resource->stillNeedsLoad() && !clientDefersImage(resource->url()))
1236             downcast<CachedImage>(*resource).load(*this);
1237     }
1238 }
1239
1240 CachePolicy CachedResourceLoader::cachePolicy(CachedResource::Type type, const URL& url) const
1241 {
1242     Frame* frame = this->frame();
1243     if (!frame)
1244         return CachePolicyVerify;
1245
1246     if (type != CachedResource::MainResource)
1247         return frame->loader().subresourceCachePolicy(url);
1248
1249     if (Page* page = frame->page()) {
1250         if (page->isResourceCachingDisabled())
1251             return CachePolicyReload;
1252     }
1253
1254     switch (frame->loader().loadType()) {
1255     case FrameLoadType::ReloadFromOrigin:
1256     case FrameLoadType::Reload:
1257         return CachePolicyReload;
1258     case FrameLoadType::Back:
1259     case FrameLoadType::Forward:
1260     case FrameLoadType::IndexedBackForward:
1261         // Do not revalidate cached main resource on back/forward navigation.
1262         return CachePolicyHistoryBuffer;
1263     default:
1264         return CachePolicyVerify;
1265     }
1266 }
1267
1268 void CachedResourceLoader::removeCachedResource(CachedResource& resource)
1269 {
1270     ASSERT(!m_documentResources.contains(resource.url()) || m_documentResources.get(resource.url()).get() == &resource);
1271     m_documentResources.remove(resource.url());
1272 }
1273
1274 void CachedResourceLoader::loadDone(bool shouldPerformPostLoadActions)
1275 {
1276     RefPtr<DocumentLoader> protectDocumentLoader(m_documentLoader);
1277     RefPtr<Document> protectDocument(m_document);
1278
1279     if (frame())
1280         frame()->loader().loadDone();
1281
1282     if (shouldPerformPostLoadActions)
1283         performPostLoadActions();
1284
1285     if (!m_garbageCollectDocumentResourcesTimer.isActive())
1286         m_garbageCollectDocumentResourcesTimer.startOneShot(0_s);
1287 }
1288
1289 // Garbage collecting m_documentResources is a workaround for the
1290 // CachedResourceHandles on the RHS being strong references. Ideally this
1291 // would be a weak map, however CachedResourceHandles perform additional
1292 // bookkeeping on CachedResources, so instead pseudo-GC them -- when the
1293 // reference count reaches 1, m_documentResources is the only reference, so
1294 // remove it from the map.
1295 void CachedResourceLoader::garbageCollectDocumentResources()
1296 {
1297     typedef Vector<String, 10> StringVector;
1298     StringVector resourcesToDelete;
1299
1300     for (auto& resource : m_documentResources) {
1301         if (resource.value->hasOneHandle()) {
1302             resourcesToDelete.append(resource.key);
1303             resource.value->setOwningCachedResourceLoader(nullptr);
1304         }
1305     }
1306
1307     for (auto& resource : resourcesToDelete)
1308         m_documentResources.remove(resource);
1309 }
1310
1311 void CachedResourceLoader::performPostLoadActions()
1312 {
1313     platformStrategies()->loaderStrategy()->servePendingRequests();
1314 }
1315
1316 void CachedResourceLoader::incrementRequestCount(const CachedResource& resource)
1317 {
1318     if (resource.ignoreForRequestCount())
1319         return;
1320
1321     ++m_requestCount;
1322 }
1323
1324 void CachedResourceLoader::decrementRequestCount(const CachedResource& resource)
1325 {
1326     if (resource.ignoreForRequestCount())
1327         return;
1328
1329     --m_requestCount;
1330     ASSERT(m_requestCount > -1);
1331 }
1332
1333 ResourceErrorOr<CachedResourceHandle<CachedResource>> CachedResourceLoader::preload(CachedResource::Type type, CachedResourceRequest&& request)
1334 {
1335     if (request.charset().isEmpty() && (type == CachedResource::Script || type == CachedResource::CSSStyleSheet))
1336         request.setCharset(m_document->charset());
1337
1338     auto resource = requestResource(type, WTFMove(request), ForPreload::Yes);
1339     if (resource && (!m_preloads || !m_preloads->contains(resource.value().get()))) {
1340         auto resourceValue = resource.value();
1341         // Fonts need special treatment since just creating the resource doesn't trigger a load.
1342         if (type == CachedResource::FontResource)
1343             downcast<CachedFont>(resourceValue.get())->beginLoadIfNeeded(*this);
1344         resourceValue->increasePreloadCount();
1345
1346         if (!m_preloads)
1347             m_preloads = std::make_unique<ListHashSet<CachedResource*>>();
1348         m_preloads->add(resourceValue.get());
1349     }
1350     return resource;
1351 }
1352
1353 void CachedResourceLoader::warnUnusedPreloads()
1354 {
1355     if (!m_preloads)
1356         return;
1357     for (const auto& resource : *m_preloads) {
1358         if (resource && resource->isLinkPreload() && resource->preloadResult() == CachedResource::PreloadNotReferenced && document()) {
1359             document()->addConsoleMessage(MessageSource::Other, MessageLevel::Warning,
1360                 "The resource " + resource->url().string() +
1361                 " was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it wasn't preloaded for nothing.");
1362         }
1363     }
1364 }
1365
1366 bool CachedResourceLoader::isPreloaded(const String& urlString) const
1367 {
1368     const URL& url = m_document->completeURL(urlString);
1369
1370     if (m_preloads) {
1371         for (auto& resource : *m_preloads) {
1372             if (resource->url() == url)
1373                 return true;
1374         }
1375     }
1376     return false;
1377 }
1378
1379 void CachedResourceLoader::clearPreloads(ClearPreloadsMode mode)
1380 {
1381     if (!m_preloads)
1382         return;
1383
1384     std::unique_ptr<ListHashSet<CachedResource*>> remainingLinkPreloads;
1385     for (auto* resource : *m_preloads) {
1386         ASSERT(resource);
1387         if (mode == ClearPreloadsMode::ClearSpeculativePreloads && resource->isLinkPreload()) {
1388             if (!remainingLinkPreloads)
1389                 remainingLinkPreloads = std::make_unique<ListHashSet<CachedResource*>>();
1390             remainingLinkPreloads->add(resource);
1391             continue;
1392         }
1393         resource->decreasePreloadCount();
1394         bool deleted = resource->deleteIfPossible();
1395         if (!deleted && resource->preloadResult() == CachedResource::PreloadNotReferenced)
1396             MemoryCache::singleton().remove(*resource);
1397     }
1398     m_preloads = WTFMove(remainingLinkPreloads);
1399 }
1400
1401 const ResourceLoaderOptions& CachedResourceLoader::defaultCachedResourceOptions()
1402 {
1403     static NeverDestroyed<ResourceLoaderOptions> options(SendCallbacks, SniffContent, BufferData, StoredCredentialsPolicy::Use, ClientCredentialPolicy::MayAskClientForCredentials, FetchOptions::Credentials::Include, DoSecurityCheck, FetchOptions::Mode::NoCors, DoNotIncludeCertificateInfo, ContentSecurityPolicyImposition::DoPolicyCheck, DefersLoadingPolicy::AllowDefersLoading, CachingPolicy::AllowCaching);
1404     return options;
1405 }
1406
1407 bool CachedResourceLoader::isAlwaysOnLoggingAllowed() const
1408 {
1409     return m_documentLoader ? m_documentLoader->isAlwaysOnLoggingAllowed() : true;
1410 }
1411
1412 }