bcarrella/cef
1
0
Fork 0
mirror of https://bitbucket.org/chromiumembedded/cef synced 2025-02-03 20:47:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix incorrect Origin and Cookie headers for POST redirects (fixes issue #2806)

Browse Source 
This change also adds unit test coverage for cross-origin POST redirects.
This commit is contained in:
Marshall Greenblatt 2020-09-09 15:59:33 -04:00
parent 42f517ec69
commit 88faf1023a
2 changed files with 221 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
libcef/browser/net_service/proxy_url_loader_factory.cc
View File

@ -20,6 +20,7 @@
#include "content/public/browser/web_contents.h"
#include "mojo/public/cpp/base/big_buffer.h"
#include "net/http/http_status_code.h"
#include "net/url_request/redirect_util.h"
#include "net/url_request/url_request.h"
#include "services/network/public/cpp/cors/cors.h"
#include "services/network/public/cpp/features.h"
@ -884,27 +885,24 @@ void InterceptedRequest::ContinueToBeforeRedirect(
if (proxied_client_binding_)
proxied_client_binding_.ResumeIncomingMethodCallProcessing();
if (redirect_url.is_valid()) {
const auto original_url = request_.url;
const auto original_method = request_.method;
net::RedirectInfo new_redirect_info = redirect_info;
if (redirect_url.is_valid()) {
new_redirect_info.new_url = redirect_url;
target_client_->OnReceiveRedirect(new_redirect_info,
std::move(current_response_));
request_.url = redirect_url;
} else {
target_client_->OnReceiveRedirect(redirect_info,
std::move(current_response_));
request_.url = redirect_info.new_url;
new_redirect_info.new_site_for_cookies =
net::SiteForCookies::FromUrl(redirect_url);
}
// If request_ changes from POST to GET, strip POST headers.
const bool post_to_get =
request_.method == "POST" &&
redirect_info.new_method == net::HttpRequestHeaders::kGetMethod;
target_client_->OnReceiveRedirect(new_redirect_info,
std::move(current_response_));
request_.method = redirect_info.new_method;
request_.site_for_cookies = redirect_info.new_site_for_cookies;
request_.referrer = GURL(redirect_info.new_referrer);
request_.referrer_policy = redirect_info.new_referrer_policy;
request_.url = new_redirect_info.new_url;
request_.method = new_redirect_info.new_method;
request_.site_for_cookies = new_redirect_info.new_site_for_cookies;
request_.referrer = GURL(new_redirect_info.new_referrer);
request_.referrer_policy = new_redirect_info.new_referrer_policy;
if (request_.trusted_params) {
request_.trusted_params->isolation_info =
@ -912,15 +910,21 @@ void InterceptedRequest::ContinueToBeforeRedirect(
url::Origin::Create(request_.url));
}
// The request method can be changed to "GET". In this case we need to
// reset the request body manually, and strip the POST headers.
if (request_.method == net::HttpRequestHeaders::kGetMethod) {
request_.request_body = nullptr;
// Remove existing Cookie headers. They may be re-added after Restart().
const std::vector<std::string> remove_headers{
net::HttpRequestHeaders::kCookie};
if (post_to_get) {
request_.headers.RemoveHeader(net::HttpRequestHeaders::kContentLength);
request_.headers.RemoveHeader(net::HttpRequestHeaders::kContentType);
}
// Use common logic for sanitizing request headers including Origin and
// Content-*.
bool should_clear_upload;
net::RedirectUtil::UpdateHttpRequest(original_url, original_method,
new_redirect_info,
base::make_optional(remove_headers),
/*modified_headers=*/base::nullopt,
&request_.headers, &should_clear_upload);
if (should_clear_upload) {
request_.request_body = nullptr;
}
}

186
tests/ceftests/cors_unittest.cc
View File

@ -1101,7 +1101,7 @@ CORS_TEST_FETCH_ALL(WithHeader, true)
namespace {
enum class RedirectGetMode {
enum class RedirectMode {
MODE_302,
MODE_307,
};
@ -1120,12 +1120,12 @@ struct RedirectGetResource : CookieResource {
}
};
void SetupRedirectGetResponse(RedirectGetMode mode,
void SetupRedirectResponse(RedirectMode mode,
const std::string& redirect_url,
CefRefPtr<CefResponse> response) {
if (mode == RedirectGetMode::MODE_302)
if (mode == RedirectMode::MODE_302)
response->SetStatus(302);
else if (mode == RedirectGetMode::MODE_307)
else if (mode == RedirectMode::MODE_307)
response->SetStatus(307);
else
NOTREACHED();
@ -1135,7 +1135,7 @@ void SetupRedirectGetResponse(RedirectGetMode mode,
}
// Test redirect requests.
void SetupRedirectGetRequest(RedirectGetMode mode,
void SetupRedirectGetRequest(RedirectMode mode,
CookieTestSetup* setup,
const std::string& test_name,
HandlerType main_handler,
@ -1152,7 +1152,7 @@ void SetupRedirectGetRequest(RedirectGetMode mode,
// Expect a single main request that results in a redirect.
const std::string& redirect_url = redirect_resource->GetPathURL();
main_resource->Init(main_handler, base_path, kMimeTypeHtml, std::string());
SetupRedirectGetResponse(mode, redirect_url, main_resource->response);
SetupRedirectResponse(mode, redirect_url, main_resource->response);
SetupCookieExpectations(setup, main_resource, redirect_resource);
@ -1170,7 +1170,7 @@ void SetupRedirectGetRequest(RedirectGetMode mode,
CookieResource resource_main; \
RedirectGetResource resource_redirect; \
SetupRedirectGetRequest( \
RedirectGetMode::mode, &setup, "CorsTest.RedirectGet" #test_name, \
RedirectMode::mode, &setup, "CorsTest.RedirectGet" #test_name, \
HandlerType::handler_main, &resource_main, \
HandlerType::handler_redirect, &resource_redirect); \
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup); \
@ -1216,3 +1216,175 @@ void SetupRedirectGetRequest(RedirectGetMode mode,
// Redirect GET requests.
CORS_TEST_REDIRECT_GET_ALL(302, MODE_302)
CORS_TEST_REDIRECT_GET_ALL(307, MODE_307)
namespace {
struct PostResource : CookieResource {
PostResource() {}
bool expect_downgrade_to_get = false;
bool was_redirected = false;
std::string main_origin;
bool is_cross_origin;
void InitOrigin(HandlerType main_handler) {
// Origin is always "null" for non-HTTP(S) schemes.
// This should only be "null" for non-standard schemes, but Blink is likely
// using SchemeIsHTTPOrHTTPS() when submitting the form request.
main_origin = main_handler == HandlerType::CUSTOM_NONSTANDARD_SCHEME ||
main_handler == HandlerType::CUSTOM_STANDARD_SCHEME
? "null"
: GetOrigin(main_handler);
// True if the request is considered cross-origin. Any requests between
// non-standard schemes are considered cross-origin (due to the "null"
// origin).
is_cross_origin = main_handler != handler ||
(main_handler == HandlerType::CUSTOM_NONSTANDARD_SCHEME &&
handler == main_handler);
}
bool VerifyRequest(CefRefPtr<CefRequest> request) const override {
if (!CookieResource::VerifyRequest(request))
return false;
// The "Origin" header should be present if the request is POST, and was not
// redirected cross-origin.
std::string expected_origin;
if (!expect_downgrade_to_get) {
if (was_redirected && is_cross_origin) {
// Always "null" for cross-origin redirects.
expected_origin = "null";
} else {
expected_origin = main_origin;
}
}
const std::string& origin = request->GetHeaderByName("Origin");
EXPECT_STREQ(expected_origin.c_str(), origin.c_str()) << GetPathURL();
if (expected_origin != origin)
return false;
const std::string& method = request->GetMethod();
const bool has_post_data = request->GetPostData() != nullptr;
if (expect_downgrade_to_get) {
EXPECT_FALSE(has_post_data) << GetPathURL();
EXPECT_STREQ("GET", method.c_str()) << GetPathURL();
return !has_post_data && method == "GET";
} else {
EXPECT_TRUE(has_post_data) << GetPathURL();
EXPECT_STREQ("POST", method.c_str()) << GetPathURL();
return has_post_data && method == "POST";
}
}
};
std::string GetPostFormHtml(const std::string& submit_url) {
return "<html><body>"
"<form id=\"f\" action=\"" +
submit_url +
"\" method=\"post\">"
"<input type=\"hidden\" name=\"n\" value=\"v\"></form>"
"<script>document.getElementById('f').submit();</script>"
"</body></html>";
}
// Test redirect requests.
void SetupRedirectPostRequest(RedirectMode mode,
CookieTestSetup* setup,
const std::string& test_name,
HandlerType main_handler,
CookieResource* main_resource,
PostResource* submit_resource,
HandlerType redirect_handler,
PostResource* redirect_resource) {
const std::string& base_path = "/" + test_name;
// Expect a single redirect request that sends SuccessMsg.
redirect_resource->Init(redirect_handler, base_path + ".redirect.html",
kMimeTypeHtml, GetDefaultSuccessMsgHtml());
redirect_resource->InitOrigin(main_handler);
redirect_resource->expected_success_query_ct = 1;
// 302 redirects will downgrade POST requests to GET.
redirect_resource->expect_downgrade_to_get = mode == RedirectMode::MODE_302;
redirect_resource->was_redirected = true;
// Expect a single submit request that redirects the response.
const std::string& redirect_url = redirect_resource->GetPathURL();
submit_resource->Init(main_handler, base_path + ".submit.html", kMimeTypeHtml,
std::string());
submit_resource->InitOrigin(main_handler);
SetupRedirectResponse(mode, redirect_url, submit_resource->response);
// Expect a single main request that submits the form.
const std::string& submit_url = submit_resource->GetPathURL();
main_resource->Init(main_handler, base_path, kMimeTypeHtml,
GetPostFormHtml(submit_url));
SetupCookieExpectations(setup, main_resource, submit_resource);
SetupCookieExpectations(setup, main_resource, redirect_resource);
setup->AddResource(main_resource);
setup->AddResource(submit_resource);
setup->AddResource(redirect_resource);
}
} // namespace
// Test redirect GET requests with different origin combinations.
#define CORS_TEST_REDIRECT_POST(test_name, mode, handler_main, \
handler_redirect) \
TEST(CorsTest, RedirectPost##test_name) { \
CookieTestSetup setup; \
CookieResource resource_main; \
PostResource resource_submit, resource_redirect; \
SetupRedirectPostRequest( \
RedirectMode::mode, &setup, "CorsTest.RedirectPost" #test_name, \
HandlerType::handler_main, &resource_main, &resource_submit, \
HandlerType::handler_redirect, &resource_redirect); \
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup); \
handler->ExecuteTest(); \
ReleaseAndWaitForDestructor(handler); \
}
// Test all redirect GET combinations (same and cross-origin).
#define CORS_TEST_REDIRECT_POST_ALL(name, mode) \
CORS_TEST_REDIRECT_POST(name##ServerToServer, mode, SERVER, SERVER) \
CORS_TEST_REDIRECT_POST(name##ServerToHttpScheme, mode, SERVER, HTTP_SCHEME) \
CORS_TEST_REDIRECT_POST(name##ServerToCustomStandardScheme, mode, SERVER, \
CUSTOM_STANDARD_SCHEME) \
CORS_TEST_REDIRECT_POST(name##ServerToCustomNonStandardScheme, mode, SERVER, \
CUSTOM_NONSTANDARD_SCHEME) \
CORS_TEST_REDIRECT_POST(name##HttpSchemeToServer, mode, HTTP_SCHEME, SERVER) \
CORS_TEST_REDIRECT_POST(name##HttpSchemeToHttpScheme, mode, HTTP_SCHEME, \
HTTP_SCHEME) \
CORS_TEST_REDIRECT_POST(name##HttpSchemeToCustomStandardScheme, mode, \
HTTP_SCHEME, CUSTOM_STANDARD_SCHEME) \
CORS_TEST_REDIRECT_POST(name##HttpSchemeToCustomNonStandardScheme, mode, \
HTTP_SCHEME, CUSTOM_NONSTANDARD_SCHEME) \
CORS_TEST_REDIRECT_POST(name##CustomStandardSchemeToServer, mode, \
CUSTOM_STANDARD_SCHEME, SERVER) \
CORS_TEST_REDIRECT_POST(name##CustomStandardSchemeToHttpScheme, mode, \
CUSTOM_STANDARD_SCHEME, HTTP_SCHEME) \
CORS_TEST_REDIRECT_POST(name##CustomStandardSchemeToCustomStandardScheme, \
mode, CUSTOM_STANDARD_SCHEME, \
CUSTOM_STANDARD_SCHEME) \
CORS_TEST_REDIRECT_POST(name##CustomStandardSchemeToCustomNonStandardScheme, \
mode, CUSTOM_STANDARD_SCHEME, \
CUSTOM_NONSTANDARD_SCHEME) \
CORS_TEST_REDIRECT_POST(name##CustomNonStandardSchemeToServer, mode, \
CUSTOM_NONSTANDARD_SCHEME, SERVER) \
CORS_TEST_REDIRECT_POST(name##CustomNonStandardSchemeToHttpScheme, mode, \
CUSTOM_NONSTANDARD_SCHEME, HTTP_SCHEME) \
CORS_TEST_REDIRECT_POST(name##CustomNonStandardSchemeToCustomStandardScheme, \
mode, CUSTOM_NONSTANDARD_SCHEME, \
CUSTOM_STANDARD_SCHEME) \
CORS_TEST_REDIRECT_POST( \
name##CustomNonStandardSchemeToCustomNonStandardScheme, mode, \
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_NONSTANDARD_SCHEME)
// Redirect GET requests.
CORS_TEST_REDIRECT_POST_ALL(302, MODE_302)
CORS_TEST_REDIRECT_POST_ALL(307, MODE_307)