blob: 0f7b70d2682e447984c47f8822390e34a5519fbd [file] [log] [blame]
[email protected]144a8102012-01-14 01:05:311// Copyright (c) 2012 The Chromium Authors. All rights reserved.
license.botbf09a502008-08-24 00:55:552// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
initial.commit09911bf2008-07-26 23:55:294
[email protected]b6583592012-01-25 19:52:335#include "content/browser/site_instance_impl.h"
initial.commit09911bf2008-07-26 23:55:296
Lukasz Anforowicz48097c42017-12-15 00:23:387#include <string>
8
creis0b49fa12017-07-10 16:31:119#include "base/command_line.h"
Alex Moshchuk4479b97c2017-10-17 23:20:3210#include "base/debug/crash_logging.h"
alexmos3b9ad102017-05-26 23:41:0811#include "base/macros.h"
[email protected]39365212011-02-24 01:01:0012#include "content/browser/browsing_instance.h"
[email protected]b9535422012-02-09 01:47:5913#include "content/browser/child_process_security_policy_impl.h"
[email protected]c02f1ba2014-02-03 06:53:5314#include "content/browser/frame_host/debug_urls.h"
nick9f34e2892016-01-12 21:01:0715#include "content/browser/frame_host/frame_tree_node.h"
[email protected]f3b1a082011-11-18 00:34:3016#include "content/browser/renderer_host/render_process_host_impl.h"
[email protected]4c3a23582012-08-18 08:54:3417#include "content/browser/storage_partition_impl.h"
[email protected]87f3c082011-10-19 18:07:4418#include "content/public/browser/content_browser_client.h"
[email protected]f3b1a082011-11-18 00:34:3019#include "content/public/browser/render_process_host_factory.h"
Nick Carterbf6264a52018-04-06 02:39:3320#include "content/public/browser/site_isolation_policy.h"
[email protected]41fb79a52012-06-29 16:34:3321#include "content/public/browser/web_ui_controller_factory.h"
creis0b49fa12017-07-10 16:31:1122#include "content/public/common/content_switches.h"
[email protected]a1d29162011-10-14 17:14:0323#include "content/public/common/url_constants.h"
clamy7fced7b2017-11-16 19:52:4324#include "content/public/common/url_utils.h"
[email protected]be28b5f42012-07-20 11:31:2525#include "net/base/registry_controlled_domains/registry_controlled_domain.h"
initial.commit09911bf2008-07-26 23:55:2926
[email protected]46488322012-10-30 03:22:2027namespace content {
[email protected]b6583592012-01-25 19:52:3328
avib7348942015-12-25 20:57:1029int32_t SiteInstanceImpl::next_site_instance_id_ = 1;
[email protected]992db4c2011-05-12 15:37:1530
Alex Moshchuk1656c672018-04-28 01:48:3431using CheckOriginLockResult =
32 ChildProcessSecurityPolicyImpl::CheckOriginLockResult;
33
[email protected]b6583592012-01-25 19:52:3334SiteInstanceImpl::SiteInstanceImpl(BrowsingInstance* browsing_instance)
[email protected]992db4c2011-05-12 15:37:1535 : id_(next_site_instance_id_++),
creiscce56cd2014-09-29 22:45:2236 active_frame_count_(0),
[email protected]992db4c2011-05-12 15:37:1537 browsing_instance_(browsing_instance),
nickd5bbd0b2016-03-31 19:52:4438 process_(nullptr),
Lukasz Anforowicz3caa8372018-06-05 17:22:0739 can_associate_with_spare_process_(true),
nickd5bbd0b2016-03-31 19:52:4440 has_site_(false),
Tsuyoshi Horoeb576e62017-06-28 06:00:4141 process_reuse_policy_(ProcessReusePolicy::DEFAULT),
42 is_for_service_worker_(false) {
[email protected]4566f132009-03-12 01:55:1343 DCHECK(browsing_instance);
[email protected]4566f132009-03-12 01:55:1344}
45
[email protected]b6583592012-01-25 19:52:3346SiteInstanceImpl::~SiteInstanceImpl() {
[email protected]46488322012-10-30 03:22:2047 GetContentClient()->browser()->SiteInstanceDeleting(this);
[email protected]056ad2a2011-07-12 02:13:5548
[email protected]40bfaf32013-11-19 01:35:4349 if (process_)
50 process_->RemoveObserver(this);
51
initial.commit09911bf2008-07-26 23:55:2952 // Now that no one is referencing us, we can safely remove ourselves from
53 // the BrowsingInstance. Any future visits to a page from this site
54 // (within the same BrowsingInstance) can safely create a new SiteInstance.
55 if (has_site_)
dchengbccd6b82016-03-30 16:24:1956 browsing_instance_->UnregisterSiteInstance(this);
57}
58
Nasko Oskovdeb6c7ea2017-11-30 18:18:1159// static
dchengbccd6b82016-03-30 16:24:1960scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::Create(
61 BrowserContext* browser_context) {
kylecharda69d882017-10-04 05:49:5262 return base::WrapRefCounted(
dchengbccd6b82016-03-30 16:24:1963 new SiteInstanceImpl(new BrowsingInstance(browser_context)));
64}
65
Nasko Oskovdeb6c7ea2017-11-30 18:18:1166// static
dchengbccd6b82016-03-30 16:24:1967scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForURL(
68 BrowserContext* browser_context,
69 const GURL& url) {
70 // This will create a new SiteInstance and BrowsingInstance.
71 scoped_refptr<BrowsingInstance> instance(
72 new BrowsingInstance(browser_context));
73 return instance->GetSiteInstanceForURL(url);
initial.commit09911bf2008-07-26 23:55:2974}
75
Nasko Oskovdeb6c7ea2017-11-30 18:18:1176// static
77bool SiteInstanceImpl::ShouldAssignSiteForURL(const GURL& url) {
78 // about:blank should not "use up" a new SiteInstance. The SiteInstance can
79 // still be used for a normal web site.
80 if (url == url::kAboutBlankURL)
81 return false;
82
83 // The embedder will then have the opportunity to determine if the URL
84 // should "use up" the SiteInstance.
85 return GetContentClient()->browser()->ShouldAssignSiteForURL(url);
86}
87
Nicolas Pena7c7847f2018-05-30 01:36:0588// static
89bool SiteInstanceImpl::IsOriginLockASite(const GURL& lock_url) {
90 return lock_url.has_scheme() && lock_url.has_host();
91}
92
avib7348942015-12-25 20:57:1093int32_t SiteInstanceImpl::GetId() {
[email protected]b6583592012-01-25 19:52:3394 return id_;
95}
96
97bool SiteInstanceImpl::HasProcess() const {
Ivan Kotenkov2c0d2bb32017-11-01 15:41:2898 if (process_ != nullptr)
[email protected]41fb79a52012-06-29 16:34:3399 return true;
100
101 // If we would use process-per-site for this site, also check if there is an
102 // existing process that we would use if GetProcess() were called.
[email protected]46488322012-10-30 03:22:20103 BrowserContext* browser_context =
[email protected]41fb79a52012-06-29 16:34:33104 browsing_instance_->browser_context();
105 if (has_site_ &&
[email protected]1ae93fb12013-06-14 03:38:56106 RenderProcessHost::ShouldUseProcessPerSite(browser_context, site_) &&
[email protected]41fb79a52012-06-29 16:34:33107 RenderProcessHostImpl::GetProcessHostForSite(browser_context, site_)) {
108 return true;
109 }
110
111 return false;
[email protected]5ab79b02010-04-26 16:47:11112}
113
[email protected]41fb79a52012-06-29 16:34:33114RenderProcessHost* SiteInstanceImpl::GetProcess() {
[email protected]08c8ec7e2010-07-11 17:14:48115 // TODO(erikkay) It would be nice to ensure that the renderer type had been
116 // properly set before we get here. The default tab creation case winds up
117 // with no site set at this point, so it will default to TYPE_NORMAL. This
118 // may not be correct, so we'll wind up potentially creating a process that
119 // we then throw away, or worse sharing a process with the wrong process type.
120 // See crbug.com/43448.
121
initial.commit09911bf2008-07-26 23:55:29122 // Create a new process if ours went away or was reused.
[email protected]4566f132009-03-12 01:55:13123 if (!process_) {
[email protected]4c3a23582012-08-18 08:54:34124 BrowserContext* browser_context = browsing_instance_->browser_context();
[email protected]41fb79a52012-06-29 16:34:33125
clamy63960c32017-05-10 22:57:07126 // Check if the ProcessReusePolicy should be updated.
127 bool should_use_process_per_site =
creisa9f04ba2017-05-19 22:27:42128 has_site_ &&
129 RenderProcessHost::ShouldUseProcessPerSite(browser_context, site_);
clamy63960c32017-05-10 22:57:07130 if (should_use_process_per_site) {
131 process_reuse_policy_ = ProcessReusePolicy::PROCESS_PER_SITE;
132 } else if (process_reuse_policy_ == ProcessReusePolicy::PROCESS_PER_SITE) {
133 process_reuse_policy_ = ProcessReusePolicy::DEFAULT;
[email protected]41fb79a52012-06-29 16:34:33134 }
135
clamy63960c32017-05-10 22:57:07136 process_ = RenderProcessHostImpl::GetProcessHostForSiteInstance(
137 browser_context, this);
avi6d686db2017-01-06 02:28:57138
[email protected]41fb79a52012-06-29 16:34:33139 CHECK(process_);
[email protected]40bfaf32013-11-19 01:35:43140 process_->AddObserver(this);
[email protected]41fb79a52012-06-29 16:34:33141
142 // If we are using process-per-site, we need to register this process
143 // for the current site so that we can find it again. (If no site is set
144 // at this time, we will register it in SetSite().)
clamy63960c32017-05-10 22:57:07145 if (process_reuse_policy_ == ProcessReusePolicy::PROCESS_PER_SITE &&
146 has_site_) {
[email protected]41fb79a52012-06-29 16:34:33147 RenderProcessHostImpl::RegisterProcessHostForSite(browser_context,
148 process_, site_);
149 }
initial.commit09911bf2008-07-26 23:55:29150
naskob8744d22014-08-28 17:07:43151 TRACE_EVENT2("navigation", "SiteInstanceImpl::GetProcess",
152 "site id", id_, "process id", process_->GetID());
[email protected]46488322012-10-30 03:22:20153 GetContentClient()->browser()->SiteInstanceGotProcess(this);
[email protected]6f371442011-11-09 06:45:46154
[email protected]313b80bd2011-11-23 03:49:10155 if (has_site_)
alexmos13fe1962017-06-28 04:25:12156 LockToOriginIfNeeded();
initial.commit09911bf2008-07-26 23:55:29157 }
[email protected]4566f132009-03-12 01:55:13158 DCHECK(process_);
initial.commit09911bf2008-07-26 23:55:29159
[email protected]4566f132009-03-12 01:55:13160 return process_;
initial.commit09911bf2008-07-26 23:55:29161}
162
Lukasz Anforowicz3caa8372018-06-05 17:22:07163bool SiteInstanceImpl::CanAssociateWithSpareProcess() {
164 return can_associate_with_spare_process_;
165}
166
167void SiteInstanceImpl::PreventAssociationWithSpareProcess() {
168 can_associate_with_spare_process_ = false;
169}
170
[email protected]b6583592012-01-25 19:52:33171void SiteInstanceImpl::SetSite(const GURL& url) {
naskob8744d22014-08-28 17:07:43172 TRACE_EVENT2("navigation", "SiteInstanceImpl::SetSite",
173 "site id", id_, "url", url.possibly_invalid_spec());
initial.commit09911bf2008-07-26 23:55:29174 // A SiteInstance's site should not change.
175 // TODO(creis): When following links or script navigations, we can currently
176 // render pages from other sites in this SiteInstance. This will eventually
177 // be fixed, but until then, we should still not set the site of a
178 // SiteInstance more than once.
179 DCHECK(!has_site_);
180
181 // Remember that this SiteInstance has been used to load a URL, even if the
182 // URL is invalid.
183 has_site_ = true;
[email protected]4c3a23582012-08-18 08:54:34184 BrowserContext* browser_context = browsing_instance_->browser_context();
[email protected]41fb79a52012-06-29 16:34:33185 site_ = GetSiteForURL(browser_context, url);
Alex Moshchuk25c64bb2017-12-02 02:50:11186 original_url_ = url;
initial.commit09911bf2008-07-26 23:55:29187
188 // Now that we have a site, register it with the BrowsingInstance. This
189 // ensures that we won't create another SiteInstance for this site within
190 // the same BrowsingInstance, because all same-site pages within a
191 // BrowsingInstance can script each other.
192 browsing_instance_->RegisterSiteInstance(this);
[email protected]313b80bd2011-11-23 03:49:10193
clamy63960c32017-05-10 22:57:07194 // Update the process reuse policy based on the site.
195 bool should_use_process_per_site =
196 RenderProcessHost::ShouldUseProcessPerSite(browser_context, site_);
197 if (should_use_process_per_site) {
198 process_reuse_policy_ = ProcessReusePolicy::PROCESS_PER_SITE;
199 }
200
[email protected]41fb79a52012-06-29 16:34:33201 if (process_) {
alexmos13fe1962017-06-28 04:25:12202 LockToOriginIfNeeded();
[email protected]41fb79a52012-06-29 16:34:33203
204 // Ensure the process is registered for this site if necessary.
clamy63960c32017-05-10 22:57:07205 if (should_use_process_per_site) {
[email protected]41fb79a52012-06-29 16:34:33206 RenderProcessHostImpl::RegisterProcessHostForSite(
207 browser_context, process_, site_);
208 }
209 }
initial.commit09911bf2008-07-26 23:55:29210}
211
[email protected]77ab17312012-09-28 15:34:59212const GURL& SiteInstanceImpl::GetSiteURL() const {
[email protected]b6583592012-01-25 19:52:33213 return site_;
214}
215
216bool SiteInstanceImpl::HasSite() const {
217 return has_site_;
218}
219
220bool SiteInstanceImpl::HasRelatedSiteInstance(const GURL& url) {
initial.commit09911bf2008-07-26 23:55:29221 return browsing_instance_->HasSiteInstance(url);
222}
223
dchengbccd6b82016-03-30 16:24:19224scoped_refptr<SiteInstance> SiteInstanceImpl::GetRelatedSiteInstance(
225 const GURL& url) {
initial.commit09911bf2008-07-26 23:55:29226 return browsing_instance_->GetSiteInstanceForURL(url);
227}
228
[email protected]14392a52012-05-02 20:28:44229bool SiteInstanceImpl::IsRelatedSiteInstance(const SiteInstance* instance) {
[email protected]fc72bb12013-06-02 21:13:46230 return browsing_instance_.get() == static_cast<const SiteInstanceImpl*>(
231 instance)->browsing_instance_.get();
[email protected]14392a52012-05-02 20:28:44232}
233
[email protected]d5072a82014-05-15 05:50:18234size_t SiteInstanceImpl::GetRelatedActiveContentsCount() {
235 return browsing_instance_->active_contents_count();
236}
237
[email protected]f88628d02012-11-11 17:58:59238bool SiteInstanceImpl::HasWrongProcessForURL(const GURL& url) {
[email protected]d292d8a2011-05-25 03:47:11239 // Having no process isn't a problem, since we'll assign it correctly.
[email protected]f88628d02012-11-11 17:58:59240 // Note that HasProcess() may return true if process_ is null, in
241 // process-per-site cases where there's an existing process available.
242 // We want to use such a process in the IsSuitableHost check, so we
243 // may end up assigning process_ in the GetProcess() call below.
244 if (!HasProcess())
[email protected]d292d8a2011-05-25 03:47:11245 return false;
246
[email protected]144a8102012-01-14 01:05:31247 // If the URL to navigate to can be associated with any site instance,
248 // we want to keep it in the same process.
[email protected]c02f1ba2014-02-03 06:53:53249 if (IsRendererDebugURL(url))
[email protected]144a8102012-01-14 01:05:31250 return false;
251
alexmos13fe1962017-06-28 04:25:12252 // Any process can host an about:blank URL. This check avoids a process
253 // transfer for browser-initiated navigations to about:blank in a dedicated
254 // process; without it, IsSuitableHost would consider this process unsuitable
255 // for about:blank when it compares origin locks. Renderer-initiated
256 // navigations will handle about:blank navigations elsewhere and leave them
257 // in the source SiteInstance, along with about:srcdoc and data:.
258 if (url == url::kAboutBlankURL)
259 return false;
260
[email protected]88aae972011-12-16 01:14:18261 // If the site URL is an extension (e.g., for hosted apps or WebUI) but the
[email protected]d292d8a2011-05-25 03:47:11262 // process is not (or vice versa), make sure we notice and fix it.
[email protected]2a5221b2011-09-27 23:07:31263 GURL site_url = GetSiteForURL(browsing_instance_->browser_context(), url);
[email protected]88aae972011-12-16 01:14:18264 return !RenderProcessHostImpl::IsSuitableHost(
[email protected]f88628d02012-11-11 17:58:59265 GetProcess(), browsing_instance_->browser_context(), site_url);
[email protected]d292d8a2011-05-25 03:47:11266}
267
nickd5bbd0b2016-03-31 19:52:44268scoped_refptr<SiteInstanceImpl>
269SiteInstanceImpl::GetDefaultSubframeSiteInstance() {
270 return browsing_instance_->GetDefaultSubframeSiteInstance();
271}
272
nickd30fd962015-07-27 21:51:08273bool SiteInstanceImpl::RequiresDedicatedProcess() {
274 if (!has_site_)
275 return false;
nickd5bbd0b2016-03-31 19:52:44276
277 return DoesSiteRequireDedicatedProcess(GetBrowserContext(), site_);
nickd30fd962015-07-27 21:51:08278}
279
avi85cacb72016-10-26 22:39:33280bool SiteInstanceImpl::IsDefaultSubframeSiteInstance() const {
clamy63960c32017-05-10 22:57:07281 return process_reuse_policy_ ==
282 ProcessReusePolicy::USE_DEFAULT_SUBFRAME_PROCESS;
avi85cacb72016-10-26 22:39:33283}
284
nick9f34e2892016-01-12 21:01:07285void SiteInstanceImpl::IncrementActiveFrameCount() {
286 active_frame_count_++;
287}
288
289void SiteInstanceImpl::DecrementActiveFrameCount() {
ericwilligers254597b2016-10-17 10:32:31290 if (--active_frame_count_ == 0) {
291 for (auto& observer : observers_)
292 observer.ActiveFrameCountIsZero(this);
293 }
nick9f34e2892016-01-12 21:01:07294}
295
[email protected]d5072a82014-05-15 05:50:18296void SiteInstanceImpl::IncrementRelatedActiveContentsCount() {
297 browsing_instance_->increment_active_contents_count();
298}
299
300void SiteInstanceImpl::DecrementRelatedActiveContentsCount() {
301 browsing_instance_->decrement_active_contents_count();
302}
303
nick9f34e2892016-01-12 21:01:07304void SiteInstanceImpl::AddObserver(Observer* observer) {
305 observers_.AddObserver(observer);
306}
307
308void SiteInstanceImpl::RemoveObserver(Observer* observer) {
309 observers_.RemoveObserver(observer);
310}
311
[email protected]4c3a23582012-08-18 08:54:34312BrowserContext* SiteInstanceImpl::GetBrowserContext() const {
[email protected]72daaa92012-01-18 13:39:02313 return browsing_instance_->browser_context();
314}
315
nickcc0d9142015-10-14 16:27:10316// static
dchengbccd6b82016-03-30 16:24:19317scoped_refptr<SiteInstance> SiteInstance::Create(
318 BrowserContext* browser_context) {
319 return SiteInstanceImpl::Create(browser_context);
initial.commit09911bf2008-07-26 23:55:29320}
321
nickcc0d9142015-10-14 16:27:10322// static
dchengbccd6b82016-03-30 16:24:19323scoped_refptr<SiteInstance> SiteInstance::CreateForURL(
324 BrowserContext* browser_context,
325 const GURL& url) {
326 return SiteInstanceImpl::CreateForURL(browser_context, url);
[email protected]d8a96622009-05-07 19:21:16327}
328
nickcc0d9142015-10-14 16:27:10329// static
Nasko Oskovdeb6c7ea2017-11-30 18:18:11330bool SiteInstance::ShouldAssignSiteForURL(const GURL& url) {
331 return SiteInstanceImpl::ShouldAssignSiteForURL(url);
332}
333
334// static
[email protected]399583b2012-12-11 09:33:42335bool SiteInstance::IsSameWebSite(BrowserContext* browser_context,
[email protected]855d7d572014-08-02 11:18:17336 const GURL& real_src_url,
337 const GURL& real_dest_url) {
Alex Moshchuk25c64bb2017-12-02 02:50:11338 return SiteInstanceImpl::IsSameWebSite(browser_context, real_src_url,
339 real_dest_url, true);
340}
341
342bool SiteInstanceImpl::IsSameWebSite(BrowserContext* browser_context,
343 const GURL& real_src_url,
344 const GURL& real_dest_url,
345 bool should_compare_effective_urls) {
346 GURL src_url =
347 should_compare_effective_urls
348 ? SiteInstanceImpl::GetEffectiveURL(browser_context, real_src_url)
349 : real_src_url;
350 GURL dest_url =
351 should_compare_effective_urls
352 ? SiteInstanceImpl::GetEffectiveURL(browser_context, real_dest_url)
353 : real_dest_url;
[email protected]399583b2012-12-11 09:33:42354
355 // We infer web site boundaries based on the registered domain name of the
356 // top-level page and the scheme. We do not pay attention to the port if
357 // one is present, because pages served from different ports can still
358 // access each other if they change their document.domain variable.
359
360 // Some special URLs will match the site instance of any other URL. This is
361 // done before checking both of them for validity, since we want these URLs
362 // to have the same site instance as even an invalid one.
[email protected]855d7d572014-08-02 11:18:17363 if (IsRendererDebugURL(src_url) || IsRendererDebugURL(dest_url))
[email protected]399583b2012-12-11 09:33:42364 return true;
365
366 // If either URL is invalid, they aren't part of the same site.
[email protected]855d7d572014-08-02 11:18:17367 if (!src_url.is_valid() || !dest_url.is_valid())
[email protected]399583b2012-12-11 09:33:42368 return false;
369
[email protected]855d7d572014-08-02 11:18:17370 // If the destination url is just a blank page, we treat them as part of the
371 // same site.
372 GURL blank_page(url::kAboutBlankURL);
373 if (dest_url == blank_page)
374 return true;
375
Alex Moshchuka308c9b2018-02-08 20:58:14376 // If the source and destination URLs are equal excluding the hash, they have
377 // the same site. This matters for file URLs, where SameDomainOrHost() would
378 // otherwise return false below.
379 if (src_url.EqualsIgnoringRef(dest_url))
380 return true;
381
Daniel Cheng88186bd52017-10-20 08:14:46382 url::Origin src_origin = url::Origin::Create(src_url);
383 url::Origin dest_origin = url::Origin::Create(dest_url);
alexmos3b9ad102017-05-26 23:41:08384
[email protected]399583b2012-12-11 09:33:42385 // If the schemes differ, they aren't part of the same site.
alexmoscbf995782017-06-01 03:13:13386 if (src_origin.scheme() != dest_origin.scheme())
[email protected]399583b2012-12-11 09:33:42387 return false;
388
alexmos4bc26322017-07-01 00:57:14389 if (!net::registry_controlled_domains::SameDomainOrHost(
390 src_origin, dest_origin,
391 net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES)) {
392 return false;
393 }
394
395 // If the sites are the same, check isolated origins. If either URL matches
396 // an isolated origin, compare origins rather than sites.
397 auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
398 url::Origin src_isolated_origin;
399 url::Origin dest_isolated_origin;
400 bool src_origin_is_isolated =
401 policy->GetMatchingIsolatedOrigin(src_origin, &src_isolated_origin);
402 bool dest_origin_is_isolated =
403 policy->GetMatchingIsolatedOrigin(dest_origin, &dest_isolated_origin);
404 if (src_origin_is_isolated || dest_origin_is_isolated) {
405 // Compare most specific matching origins to ensure that a subdomain of an
406 // isolated origin (e.g., https://subdomain.isolated.foo.com) also matches
407 // the isolated origin's site URL (e.g., https://isolated.foo.com).
408 return src_isolated_origin == dest_isolated_origin;
409 }
410
411 return true;
[email protected]399583b2012-12-11 09:33:42412}
413
nickcc0d9142015-10-14 16:27:10414// static
[email protected]399583b2012-12-11 09:33:42415GURL SiteInstance::GetSiteForURL(BrowserContext* browser_context,
416 const GURL& real_url) {
[email protected]25a9e8e532012-06-22 06:16:28417 // TODO(fsamuel, creis): For some reason appID is not recognized as a host.
[email protected]6eb1a11e2013-10-09 00:54:37418 if (real_url.SchemeIs(kGuestScheme))
[email protected]25a9e8e532012-06-22 06:16:28419 return real_url;
420
[email protected]b6583592012-01-25 19:52:33421 GURL url = SiteInstanceImpl::GetEffectiveURL(browser_context, real_url);
Daniel Cheng88186bd52017-10-20 08:14:46422 url::Origin origin = url::Origin::Create(url);
[email protected]3a8eecb2010-04-22 23:56:30423
alexmos4bc26322017-07-01 00:57:14424 // Isolated origins should use the full origin as their site URL. A subdomain
Alex Moshchukbb99a332017-11-22 04:49:57425 // of an isolated origin should also use that isolated origin's site URL. It
426 // is important to check |url| rather than |real_url| here, since some
427 // effective URLs (such as for NTP) need to be resolved prior to the isolated
428 // origin lookup.
alexmos3b9ad102017-05-26 23:41:08429 auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
alexmos4bc26322017-07-01 00:57:14430 url::Origin isolated_origin;
Lukasz Anforowicz217fd272018-03-07 21:41:43431 if (policy->GetMatchingIsolatedOrigin(origin, &isolated_origin))
alexmos4bc26322017-07-01 00:57:14432 return isolated_origin.GetURL();
alexmos3b9ad102017-05-26 23:41:08433
Lukasz Anforowicz48097c42017-12-15 00:23:38434 // If the url has a host, then determine the site. Skip file URLs to avoid a
435 // situation where site URL of file://localhost/ would mismatch Blink's origin
436 // (which ignores the hostname in this case - see https://crbug.com/776160).
437 if (!origin.host().empty() && origin.scheme() != url::kFileScheme) {
nick1dd47922016-04-29 16:44:48438 // Only keep the scheme and registered domain of |origin|.
439 std::string domain = net::registry_controlled_domains::GetDomainAndRegistry(
440 origin.host(),
441 net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
442 std::string site = origin.scheme();
443 site += url::kStandardSchemeSeparator;
444 site += domain.empty() ? origin.host() : domain;
445 return GURL(site);
initial.commit09911bf2008-07-26 23:55:29446 }
creisf60c2cd2014-12-18 00:41:02447
448 // If there is no host but there is a scheme, return the scheme.
449 // This is useful for cases like file URLs.
Lukasz Anforowicz217fd272018-03-07 21:41:43450 if (!origin.unique()) {
451 // Prefer to use the scheme of |origin| rather than |url|, to correctly
452 // cover blob: and filesystem: URIs (see also https://crbug.com/697111).
Lukasz Anforowiczd926a842018-03-09 01:50:45453 DCHECK(!origin.scheme().empty());
454 return GURL(origin.scheme() + ":");
455 } else if (url.has_scheme()) {
456 DCHECK(!url.scheme().empty());
creisf60c2cd2014-12-18 00:41:02457 return GURL(url.scheme() + ":");
Lukasz Anforowiczd926a842018-03-09 01:50:45458 }
creisf60c2cd2014-12-18 00:41:02459
460 // Otherwise the URL should be invalid; return an empty site.
Lukasz Anforowicz217fd272018-03-07 21:41:43461 DCHECK(!url.is_valid()) << url;
creisf60c2cd2014-12-18 00:41:02462 return GURL();
initial.commit09911bf2008-07-26 23:55:29463}
464
nickcc0d9142015-10-14 16:27:10465// static
[email protected]4c3a23582012-08-18 08:54:34466GURL SiteInstanceImpl::GetEffectiveURL(BrowserContext* browser_context,
467 const GURL& url) {
Alex Moshchuka31c7882018-01-17 00:57:30468 return GetContentClient()->browser()->GetEffectiveURL(browser_context, url);
[email protected]3a8eecb2010-04-22 23:56:30469}
470
nickcc0d9142015-10-14 16:27:10471// static
Alex Moshchuk25c64bb2017-12-02 02:50:11472bool SiteInstanceImpl::HasEffectiveURL(BrowserContext* browser_context,
473 const GURL& url) {
474 return GetEffectiveURL(browser_context, url) != url;
475}
476
477// static
nickcc0d9142015-10-14 16:27:10478bool SiteInstanceImpl::DoesSiteRequireDedicatedProcess(
479 BrowserContext* browser_context,
nickdb193a12016-09-09 23:09:23480 const GURL& url) {
nickcc0d9142015-10-14 16:27:10481 // If --site-per-process is enabled, site isolation is enabled everywhere.
482 if (SiteIsolationPolicy::UseDedicatedProcessesForAllSites())
483 return true;
484
Nasko Oskovd83b5712018-05-04 04:50:57485 // Error pages in main frames do require isolation, however since this is
486 // missing the context whether this is for a main frame or not, that part
487 // is enforced in RenderFrameHostManager.
488 if (url.SchemeIs(kChromeErrorScheme))
489 return true;
490
alexmos3b9ad102017-05-26 23:41:08491 // Always require a dedicated process for isolated origins.
492 GURL site_url = GetSiteForURL(browser_context, url);
493 auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
Daniel Cheng88186bd52017-10-20 08:14:46494 if (policy->IsIsolatedOrigin(url::Origin::Create(site_url)))
alexmos3b9ad102017-05-26 23:41:08495 return true;
496
nickdb193a12016-09-09 23:09:23497 // Let the content embedder enable site isolation for specific URLs. Use the
498 // canonical site url for this check, so that schemes with nested origins
499 // (blob and filesystem) work properly.
Avi Drissman8c36df72017-12-11 21:19:20500 if (GetContentClient()->browser()->DoesSiteRequireDedicatedProcess(
nickdb193a12016-09-09 23:09:23501 browser_context, site_url)) {
nickcc0d9142015-10-14 16:27:10502 return true;
503 }
504
505 return false;
506}
507
alexmos13fe1962017-06-28 04:25:12508// static
509bool SiteInstanceImpl::ShouldLockToOrigin(BrowserContext* browser_context,
Alex Moshchuk9cf5a45d2017-08-14 18:50:57510 RenderProcessHost* host,
alexmos13fe1962017-06-28 04:25:12511 GURL site_url) {
creis0b49fa12017-07-10 16:31:11512 // Don't lock to origin in --single-process mode, since this mode puts
513 // cross-site pages into the same process.
Alex Moshchuk9cf5a45d2017-08-14 18:50:57514 if (host->run_renderer_in_process())
creis0b49fa12017-07-10 16:31:11515 return false;
516
alexmos13fe1962017-06-28 04:25:12517 if (!DoesSiteRequireDedicatedProcess(browser_context, site_url))
518 return false;
519
520 // Guest processes cannot be locked to their site because guests always have
521 // a fixed SiteInstance. The site of GURLs a guest loads doesn't match that
522 // SiteInstance. So we skip locking the guest process to the site.
523 // TODO(ncarter): Remove this exclusion once we can make origin lock per
524 // RenderFrame routing id.
525 if (site_url.SchemeIs(content::kGuestScheme))
526 return false;
527
528 // TODO(creis, nick) https://crbug.com/510588 Chrome UI pages use the same
529 // site (chrome://chrome), so they can't be locked because the site being
530 // loaded doesn't match the SiteInstance.
531 if (site_url.SchemeIs(content::kChromeUIScheme))
532 return false;
533
534 // TODO(creis, nick): Until we can handle sites with effective URLs at the
535 // call sites of ChildProcessSecurityPolicy::CanAccessDataForOrigin, we
536 // must give the embedder a chance to exempt some sites to avoid process
537 // kills.
538 if (!GetContentClient()->browser()->ShouldLockToOrigin(browser_context,
539 site_url)) {
540 return false;
541 }
542
543 return true;
544}
545
[email protected]40bfaf32013-11-19 01:35:43546void SiteInstanceImpl::RenderProcessHostDestroyed(RenderProcessHost* host) {
547 DCHECK_EQ(process_, host);
548 process_->RemoveObserver(this);
nickd5bbd0b2016-03-31 19:52:44549 process_ = nullptr;
[email protected]4566f132009-03-12 01:55:13550}
[email protected]313b80bd2011-11-23 03:49:10551
nick9f34e2892016-01-12 21:01:07552void SiteInstanceImpl::RenderProcessWillExit(RenderProcessHost* host) {
553 // TODO(nick): http://crbug.com/575400 - RenderProcessWillExit might not serve
554 // any purpose here.
ericwilligers254597b2016-10-17 10:32:31555 for (auto& observer : observers_)
556 observer.RenderProcessGone(this);
nick9f34e2892016-01-12 21:01:07557}
558
Bo Liu2a489402018-04-24 23:41:27559void SiteInstanceImpl::RenderProcessExited(
560 RenderProcessHost* host,
561 const ChildProcessTerminationInfo& info) {
ericwilligers254597b2016-10-17 10:32:31562 for (auto& observer : observers_)
563 observer.RenderProcessGone(this);
nick9f34e2892016-01-12 21:01:07564}
565
alexmos13fe1962017-06-28 04:25:12566void SiteInstanceImpl::LockToOriginIfNeeded() {
567 DCHECK(HasSite());
568
569 // From now on, this process should be considered "tainted" for future
570 // process reuse decisions:
571 // (1) If |site_| required a dedicated process, this SiteInstance's process
572 // can only host URLs for the same site.
573 // (2) Even if |site_| does not require a dedicated process, this
574 // SiteInstance's process still cannot be reused to host other sites
575 // requiring dedicated sites in the future.
576 // We can get here either when we commit a URL into a SiteInstance that does
577 // not yet have a site, or when we create a process for a SiteInstance with a
578 // preassigned site.
579 process_->SetIsUsed();
580
Alex Moshchuk47dd00f2017-10-10 17:15:23581 ChildProcessSecurityPolicyImpl* policy =
582 ChildProcessSecurityPolicyImpl::GetInstance();
583 auto lock_state = policy->CheckOriginLock(process_->GetID(), site_);
Alex Moshchuk9cf5a45d2017-08-14 18:50:57584 if (ShouldLockToOrigin(GetBrowserContext(), process_, site_)) {
Alex Moshchuk9cf5a45d2017-08-14 18:50:57585 // Sanity check that this won't try to assign an origin lock to a <webview>
586 // process, which can't be locked.
587 CHECK(!process_->IsForGuestsOnly());
588
Alex Moshchuk9cf5a45d2017-08-14 18:50:57589 switch (lock_state) {
Alex Moshchuk1656c672018-04-28 01:48:34590 case CheckOriginLockResult::NO_LOCK: {
Alex Moshchuk47dd00f2017-10-10 17:15:23591 // TODO(nick): When all sites are isolated, this operation provides
592 // strong protection. If only some sites are isolated, we need
593 // additional logic to prevent the non-isolated sites from requesting
594 // resources for isolated sites. https://crbug.com/509125
Nicolas Pena7c7847f2018-05-30 01:36:05595 process_->LockToOrigin(site_);
Alex Moshchuk9cf5a45d2017-08-14 18:50:57596 break;
597 }
Alex Moshchuk1656c672018-04-28 01:48:34598 case CheckOriginLockResult::HAS_WRONG_LOCK:
Alex Moshchuk9cf5a45d2017-08-14 18:50:57599 // We should never attempt to reassign a different origin lock to a
600 // process.
Robert Sesek1e07e372017-12-09 01:34:42601 base::debug::SetCrashKeyString(bad_message::GetRequestedSiteURLKey(),
602 site_.spec());
603 base::debug::SetCrashKeyString(
604 bad_message::GetKilledProcessOriginLockKey(),
Alex Moshchuk4479b97c2017-10-17 23:20:32605 policy->GetOriginLock(process_->GetID()).spec());
Alex Moshchuk54bf13042017-10-13 04:25:29606 CHECK(false) << "Trying to lock a process to " << site_
607 << " but the process is already locked to "
608 << policy->GetOriginLock(process_->GetID());
Alex Moshchuk9cf5a45d2017-08-14 18:50:57609 break;
Alex Moshchuk1656c672018-04-28 01:48:34610 case CheckOriginLockResult::HAS_EQUAL_LOCK:
Alex Moshchuk9cf5a45d2017-08-14 18:50:57611 // Process already has the right origin lock assigned. This case will
612 // happen for commits to |site_| after the first one.
613 break;
614 default:
615 NOTREACHED();
616 }
Alex Moshchuk47dd00f2017-10-10 17:15:23617 } else {
618 // If the site that we've just committed doesn't require a dedicated
619 // process, make sure we aren't putting it in a process for a site that
620 // does.
Alex Moshchuk1656c672018-04-28 01:48:34621 if (lock_state != CheckOriginLockResult::NO_LOCK) {
622 base::debug::SetCrashKeyString(bad_message::GetRequestedSiteURLKey(),
623 site_.spec());
624 base::debug::SetCrashKeyString(
625 bad_message::GetKilledProcessOriginLockKey(),
626 policy->GetOriginLock(process_->GetID()).spec());
627 CHECK(false) << "Trying to commit non-isolated site " << site_
628 << " in process locked to "
629 << policy->GetOriginLock(process_->GetID());
630 }
[email protected]313b80bd2011-11-23 03:49:10631 }
632}
[email protected]46488322012-10-30 03:22:20633
634} // namespace content