Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-08-02 12:10:29 +01:00
Code Issues Projects Releases Packages Wiki Activity

Auto merge of #14508 - servo:determine_request_referrer, r=jdm,frewsxcv

Browse source 
Rewrite determine_request_referrer() to explicitly limit it to the checks it can do.

Checks for the Client value should reside in the script thread.

I also noted some other issues in this code.

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/14508)
<!-- Reviewable:end -->
This commit is contained in:
bors-servo 2016-12-09 13:13:27 -08:00 • committed by GitHub
commit 882d5512bb
3 changed files with 40 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

31
components/net/fetch/methods.rs
View file

@ -21,6 +21,7 @@ use net_traits::response::{Response, ResponseBody, ResponseType};
use std::borrow::Cow;
use std::fs::File;
use std::io::Read;
use std::mem;
use std::rc::Rc;
use std::sync::mpsc::{Sender, Receiver};
@ -154,15 +155,27 @@ pub fn main_fetch(request: Rc<Request>,
request.referrer_policy.set(Some(referrer_policy));
// Step 8
if *request.referrer.borrow() != Referrer::NoReferrer {
// remove Referrer headers set in past redirects/preflights
// this stops the assertion in determine_request_referrer from failing
request.headers.borrow_mut().remove::<RefererHeader>();
let referrer_url = determine_request_referrer(&mut *request.headers.borrow_mut(),
referrer_policy,
request.referrer.borrow_mut().take(),
request.current_url().clone());
*request.referrer.borrow_mut() = Referrer::from_url(referrer_url);
{
let mut referrer = request.referrer.borrow_mut();
let referrer_url = match mem::replace(&mut *referrer, Referrer::NoReferrer) {
Referrer::NoReferrer => None,
Referrer::Client => {
// FIXME(#14507): We should never get this value here; it should
// already have been handled in the script thread.
request.headers.borrow_mut().remove::<RefererHeader>();
None
},
Referrer::ReferrerUrl(url) => {
request.headers.borrow_mut().remove::<RefererHeader>();
determine_request_referrer(&mut *request.headers.borrow_mut(),
referrer_policy,
url,
request.current_url().clone())
}
};
if let Some(referrer_url) = referrer_url {
*referrer = Referrer::ReferrerUrl(referrer_url);
}
}
// Step 9

35
components/net/http_loader.rs
View file

@ -238,27 +238,28 @@ fn strip_url(mut referrer_url: ServoUrl, origin_only: bool) -> Option<ServoUrl>
}
/// https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer
/// Steps 4-6.
pub fn determine_request_referrer(headers: &mut Headers,
referrer_policy: ReferrerPolicy,
referrer_url: Option<ServoUrl>,
url: ServoUrl) -> Option<ServoUrl> {
//TODO - algorithm step 2 not addressed
referrer_source: ServoUrl,
current_url: ServoUrl)
-> Option<ServoUrl> {
assert!(!headers.has::<Referer>());
if let Some(ref_url) = referrer_url {
let cross_origin = ref_url.origin() != url.origin();
return match referrer_policy {
ReferrerPolicy::NoReferrer => None,
ReferrerPolicy::Origin => strip_url(ref_url, true),
ReferrerPolicy::SameOrigin => if cross_origin { None } else { strip_url(ref_url, false) },
ReferrerPolicy::UnsafeUrl => strip_url(ref_url, false),
ReferrerPolicy::OriginWhenCrossOrigin => strip_url(ref_url, cross_origin),
ReferrerPolicy::StrictOrigin => strict_origin(ref_url, url),
ReferrerPolicy::StrictOriginWhenCrossOrigin => strict_origin_when_cross_origin(ref_url, url),
ReferrerPolicy::NoReferrerWhenDowngrade =>
no_referrer_when_downgrade_header(ref_url, url),
};
// FIXME(#14505): this does not seem to be the correct way of checking for
// same-origin requests.
let cross_origin = referrer_source.origin() != current_url.origin();
// FIXME(#14506): some of these cases are expected to consider whether the
// request's client is "TLS-protected", whatever that means.
match referrer_policy {
ReferrerPolicy::NoReferrer => None,
ReferrerPolicy::Origin => strip_url(referrer_source, true),
ReferrerPolicy::SameOrigin => if cross_origin { None } else { strip_url(referrer_source, false) },
ReferrerPolicy::UnsafeUrl => strip_url(referrer_source, false),
ReferrerPolicy::OriginWhenCrossOrigin => strip_url(referrer_source, cross_origin),
ReferrerPolicy::StrictOrigin => strict_origin(referrer_source, current_url),
ReferrerPolicy::StrictOriginWhenCrossOrigin => strict_origin_when_cross_origin(referrer_source, current_url),
ReferrerPolicy::NoReferrerWhenDowngrade => no_referrer_when_downgrade_header(referrer_source, current_url),
}
return None;
}
pub fn set_request_cookies(url: &ServoUrl, headers: &mut Headers, cookie_jar: &Arc<RwLock<CookieStorage>>) {