Add test to ensure that URLs that redirect inside the PDF plugin fail to load
A URL that is passed to the PDF plugin should already have its redirects
resolved. If it doesn't, then the PDF that gets loaded may not have the same
origin as the one the PDF is assumed to be in. If that happens, it can cause
same origin policy violations. So redirects are disabled for requests made from
the plugin.
Redirects were disabled here: https://codereview.chromium.org/2409423004/.
There is one other place where we make a request in the plugin which has
disabled in this CL (the URLs that get loaded here are chrome internal
URLs so they should never trigger redirects anyway but this is done for
safety). This CL also adds some plumbing to ensure the redirect requests
trigger a document load failure message to be sent to JS so that we can
properly detect the load failure in tests.
BUG=653749
Review-Url: https://codereview.chromium.org/2455663004
Cr-Commit-Position: refs/heads/master@{#432293}
diff --git a/pdf/document_loader.cc b/pdf/document_loader.cc
index 67ac8ff..661e4ca 100644
--- a/pdf/document_loader.cc
+++ b/pdf/document_loader.cc
@@ -27,6 +27,17 @@
// Experimentally chosen value.
const int kChunkCloseDistance = 10;
+// Return true if the HTTP response of |loader| is a successful one and loading
+// should continue. 4xx error indicate subsequent requests will fail too.
+// e.g. resource has been removed from the server while loading it. 301
+// indicates a redirect was returned which won't be successful because we
+// disable following redirects for PDF loading (we assume they are already
+// resolved by the browser.
+bool ResponseStatusSuccess(const URLLoaderWrapper* loader) {
+ int32_t http_code = loader->GetStatusCode();
+ return (http_code < 400 && http_code != 301) || http_code >= 500;
+}
+
bool IsValidContentType(const std::string& type) {
return (base::EndsWith(type, "/pdf", base::CompareCase::INSENSITIVE_ASCII) ||
base::EndsWith(type, ".pdf", base::CompareCase::INSENSITIVE_ASCII) ||
@@ -65,6 +76,10 @@
DCHECK(url_.empty());
DCHECK(!loader_);
+ // Check that the initial response status is a valid one.
+ if (!ResponseStatusSuccess(loader.get()))
+ return false;
+
std::string type = loader->GetContentType();
// This happens for PDFs not loaded from http(s) sources.
@@ -244,13 +259,8 @@
return ReadComplete();
}
- int32_t http_code = loader_->GetStatusCode();
- if (http_code >= 400 && http_code < 500) {
- // Error accessing resource. 4xx error indicate subsequent requests
- // will fail too.
- // E.g. resource has been removed from the server while loading it.
+ if (!ResponseStatusSuccess(loader_.get()))
return ReadComplete();
- }
// Leave position untouched for multiparted responce for now, when we read the
// data we'll get it.
