Check X-Frame-Options and CSP frame-ancestors in network process
[WebKit.git] / Source / WebKit / NetworkProcess / NetworkResourceLoader.h
1 /*
2  * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
14  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
15  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
17  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
18  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
19  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
20  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
21  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
22  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
23  * THE POSSIBILITY OF SUCH DAMAGE.
24  */
25
26 #ifndef NetworkResourceLoader_h
27 #define NetworkResourceLoader_h
28
29 #include "DownloadID.h"
30 #include "MessageSender.h"
31 #include "NetworkConnectionToWebProcessMessages.h"
32 #include "NetworkLoadClient.h"
33 #include "NetworkResourceLoadParameters.h"
34 #include "ShareableResource.h"
35 #include <JavaScriptCore/ConsoleTypes.h>
36 #include <WebCore/ContentSecurityPolicyClient.h>
37 #include <WebCore/ResourceResponse.h>
38 #include <WebCore/Timer.h>
39
40 namespace WebCore {
41 class BlobDataFileReference;
42 class FormData;
43 class NetworkStorageSession;
44 class ResourceRequest;
45 class SecurityPolicyViolationEvent;
46 }
47
48 namespace WebKit {
49
50 class NetworkConnectionToWebProcess;
51 class NetworkLoad;
52 class NetworkLoadChecker;
53 class SandboxExtension;
54
55 namespace NetworkCache {
56 class Entry;
57 }
58
59 class NetworkResourceLoader final
60     : public RefCounted<NetworkResourceLoader>
61     , public NetworkLoadClient
62     , public IPC::MessageSender
63     , public WebCore::ContentSecurityPolicyClient {
64 public:
65     static Ref<NetworkResourceLoader> create(NetworkResourceLoadParameters&& parameters, NetworkConnectionToWebProcess& connection, RefPtr<Messages::NetworkConnectionToWebProcess::PerformSynchronousLoad::DelayedReply>&& reply = nullptr)
66     {
67         return adoptRef(*new NetworkResourceLoader(WTFMove(parameters), connection, WTFMove(reply)));
68     }
69     virtual ~NetworkResourceLoader();
70
71     const WebCore::ResourceRequest& originalRequest() const { return m_parameters.request; }
72
73     NetworkLoad* networkLoad() const { return m_networkLoad.get(); }
74
75     void start();
76     void abort();
77
78     void setDefersLoading(bool);
79
80     // Message handlers.
81     void didReceiveNetworkResourceLoaderMessage(IPC::Connection&, IPC::Decoder&);
82
83 #if USE(PROTECTION_SPACE_AUTH_CALLBACK)
84     void continueCanAuthenticateAgainstProtectionSpace(bool);
85 #endif
86     void continueWillSendRequest(WebCore::ResourceRequest&& newRequest, bool isAllowedToAskUserForCredentials);
87
88     const WebCore::ResourceResponse& response() const { return m_response; }
89
90     NetworkConnectionToWebProcess& connectionToWebProcess() { return m_connection; }
91     PAL::SessionID sessionID() const { return m_parameters.sessionID; }
92     ResourceLoadIdentifier identifier() const { return m_parameters.identifier; }
93     uint64_t frameID() const { return m_parameters.webFrameID; }
94     uint64_t pageID() const { return m_parameters.webPageID; }
95
96     struct SynchronousLoadData;
97
98     // NetworkLoadClient.
99     void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent) override;
100 #if USE(PROTECTION_SPACE_AUTH_CALLBACK)
101     void canAuthenticateAgainstProtectionSpaceAsync(const WebCore::ProtectionSpace&) override;
102 #endif
103     bool isSynchronous() const override;
104     bool isAllowedToAskUserForCredentials() const override { return m_isAllowedToAskUserForCredentials; }
105     void willSendRedirectedRequest(WebCore::ResourceRequest&&, WebCore::ResourceRequest&& redirectRequest, WebCore::ResourceResponse&&) override;
106     ShouldContinueDidReceiveResponse didReceiveResponse(WebCore::ResourceResponse&&) override;
107     void didReceiveBuffer(Ref<WebCore::SharedBuffer>&&, int reportedEncodedDataLength) override;
108     void didFinishLoading(const WebCore::NetworkLoadMetrics&) override;
109     void didFailLoading(const WebCore::ResourceError&) override;
110     void didBlockAuthenticationChallenge() override;
111     bool shouldCaptureExtraNetworkLoadMetrics() const override;
112
113     void convertToDownload(DownloadID, const WebCore::ResourceRequest&, const WebCore::ResourceResponse&);
114
115     bool isMainResource() const { return m_parameters.request.requester() == WebCore::ResourceRequest::Requester::Main; }
116     bool isMainFrameLoad() const { return isMainResource() && m_parameters.frameAncestorOrigins.size() == 1; }
117
118     bool isAlwaysOnLoggingAllowed() const;
119
120 #if HAVE(CFNETWORK_STORAGE_PARTITIONING) && !RELEASE_LOG_DISABLED
121     static bool shouldLogCookieInformation();
122     static void logCookieInformation(const String& label, const void* loggedObject, const WebCore::NetworkStorageSession&, const WebCore::URL& firstParty, const WebCore::SameSiteInfo&, const WebCore::URL&, const String& referrer, std::optional<uint64_t> frameID, std::optional<uint64_t> pageID, std::optional<uint64_t> identifier);
123 #endif
124
125 private:
126     NetworkResourceLoader(NetworkResourceLoadParameters&&, NetworkConnectionToWebProcess&, RefPtr<Messages::NetworkConnectionToWebProcess::PerformSynchronousLoad::DelayedReply>&&);
127
128     // IPC::MessageSender
129     IPC::Connection* messageSenderConnection() override;
130     uint64_t messageSenderDestinationID() override { return m_parameters.identifier; }
131
132     bool canUseCache(const WebCore::ResourceRequest&) const;
133     bool canUseCachedRedirect(const WebCore::ResourceRequest&) const;
134
135     void tryStoreAsCacheEntry();
136     void retrieveCacheEntry(const WebCore::ResourceRequest&);
137     void didRetrieveCacheEntry(std::unique_ptr<NetworkCache::Entry>);
138     void sendResultForCacheEntry(std::unique_ptr<NetworkCache::Entry>);
139     void validateCacheEntry(std::unique_ptr<NetworkCache::Entry>);
140     void dispatchWillSendRequestForCacheEntry(std::unique_ptr<NetworkCache::Entry>);
141     void continueProcessingCachedEntryAfterDidReceiveResponse(std::unique_ptr<NetworkCache::Entry>);
142
143     bool shouldInterruptLoadForXFrameOptions(const String&, const WebCore::URL&);
144     bool shouldInterruptLoadForCSPFrameAncestorsOrXFrameOptions(const WebCore::ResourceResponse&);
145
146     enum class FirstLoad { No, Yes };
147     void startNetworkLoad(WebCore::ResourceRequest&&, FirstLoad);
148     void continueDidReceiveResponse();
149
150     enum class LoadResult {
151         Unknown,
152         Success,
153         Failure,
154         Cancel
155     };
156     void cleanup(LoadResult);
157     
158     void platformDidReceiveResponse(const WebCore::ResourceResponse&);
159
160     void startBufferingTimerIfNeeded();
161     void bufferingTimerFired();
162     void sendBuffer(WebCore::SharedBuffer&, size_t encodedDataLength);
163
164     void consumeSandboxExtensions();
165     void invalidateSandboxExtensions();
166
167 #if HAVE(CFNETWORK_STORAGE_PARTITIONING) && !RELEASE_LOG_DISABLED
168     void logCookieInformation() const;
169 #endif
170
171     void continueWillSendRedirectedRequest(WebCore::ResourceRequest&& request, WebCore::ResourceRequest&& redirectRequest, WebCore::ResourceResponse&&);
172
173     WebCore::ResourceResponse sanitizeResponseIfPossible(WebCore::ResourceResponse&&, WebCore::ResourceResponse::SanitizationType);
174
175     // ContentSecurityPolicyClient
176     void addConsoleMessage(MessageSource, MessageLevel, const String&, unsigned long) final;
177     void sendCSPViolationReport(WebCore::URL&&, Ref<WebCore::FormData>&&) final;
178     void dispatchSecurityPolicyViolationEvent(Ref<WebCore::SecurityPolicyViolationEvent>&&) final { }; // No observable effect for frame-ancestors violation.
179
180     const NetworkResourceLoadParameters m_parameters;
181
182     Ref<NetworkConnectionToWebProcess> m_connection;
183
184     std::unique_ptr<NetworkLoad> m_networkLoad;
185
186     WebCore::ResourceResponse m_response;
187
188     size_t m_bytesReceived { 0 };
189     size_t m_bufferedDataEncodedDataLength { 0 };
190     RefPtr<WebCore::SharedBuffer> m_bufferedData;
191     unsigned m_redirectCount { 0 };
192
193     std::unique_ptr<SynchronousLoadData> m_synchronousLoadData;
194     Vector<RefPtr<WebCore::BlobDataFileReference>> m_fileReferences;
195
196     bool m_wasStarted { false };
197     bool m_didConsumeSandboxExtensions { false };
198     bool m_defersLoading { false };
199     bool m_isAllowedToAskUserForCredentials { false };
200     size_t m_numBytesReceived { 0 };
201
202     unsigned m_retrievedDerivedDataCount { 0 };
203
204     WebCore::Timer m_bufferingTimer;
205     RefPtr<NetworkCache::Cache> m_cache;
206     RefPtr<WebCore::SharedBuffer> m_bufferedDataForCache;
207     std::unique_ptr<NetworkCache::Entry> m_cacheEntryForValidation;
208     bool m_isWaitingContinueWillSendRequestForCachedRedirect { false };
209     std::unique_ptr<NetworkCache::Entry> m_cacheEntryWaitingForContinueDidReceiveResponse;
210     RefPtr<NetworkLoadChecker> m_networkLoadChecker;
211
212     std::optional<NetworkActivityTracker> m_networkActivityTracker;
213 };
214
215 } // namespace WebKit
216
217 #endif // NetworkResourceLoader_h