blob: 959325f62cd3649ea45ed8d8331d332648597f21 [file] [log] [blame]
[email protected]144a8102012-01-14 01:05:311// Copyright (c) 2012 The Chromium Authors. All rights reserved.
license.botbf09a502008-08-24 00:55:552// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
initial.commit09911bf2008-07-26 23:55:294
[email protected]b6583592012-01-25 19:52:335#include "content/browser/site_instance_impl.h"
initial.commit09911bf2008-07-26 23:55:296
creis0b49fa12017-07-10 16:31:117#include "base/command_line.h"
Alex Moshchuk4479b97c2017-10-17 23:20:328#include "base/debug/crash_logging.h"
alexmos3b9ad102017-05-26 23:41:089#include "base/macros.h"
avicb129c02017-05-03 06:49:2910#include "base/memory/ptr_util.h"
[email protected]39365212011-02-24 01:01:0011#include "content/browser/browsing_instance.h"
[email protected]b9535422012-02-09 01:47:5912#include "content/browser/child_process_security_policy_impl.h"
[email protected]c02f1ba2014-02-03 06:53:5313#include "content/browser/frame_host/debug_urls.h"
nick9f34e2892016-01-12 21:01:0714#include "content/browser/frame_host/frame_tree_node.h"
[email protected]f3b1a082011-11-18 00:34:3015#include "content/browser/renderer_host/render_process_host_impl.h"
[email protected]4c3a23582012-08-18 08:54:3416#include "content/browser/storage_partition_impl.h"
Charlie Reisa2e1ab52017-12-06 00:03:1317#include "content/common/site_isolation_policy.h"
[email protected]87f3c082011-10-19 18:07:4418#include "content/public/browser/content_browser_client.h"
[email protected]f3b1a082011-11-18 00:34:3019#include "content/public/browser/render_process_host_factory.h"
[email protected]41fb79a52012-06-29 16:34:3320#include "content/public/browser/web_ui_controller_factory.h"
creis0b49fa12017-07-10 16:31:1121#include "content/public/common/content_switches.h"
[email protected]a1d29162011-10-14 17:14:0322#include "content/public/common/url_constants.h"
clamy7fced7b2017-11-16 19:52:4323#include "content/public/common/url_utils.h"
[email protected]be28b5f42012-07-20 11:31:2524#include "net/base/registry_controlled_domains/registry_controlled_domain.h"
initial.commit09911bf2008-07-26 23:55:2925
[email protected]46488322012-10-30 03:22:2026namespace content {
[email protected]b6583592012-01-25 19:52:3327
avib7348942015-12-25 20:57:1028int32_t SiteInstanceImpl::next_site_instance_id_ = 1;
[email protected]992db4c2011-05-12 15:37:1529
[email protected]b6583592012-01-25 19:52:3330SiteInstanceImpl::SiteInstanceImpl(BrowsingInstance* browsing_instance)
[email protected]992db4c2011-05-12 15:37:1531 : id_(next_site_instance_id_++),
creiscce56cd2014-09-29 22:45:2232 active_frame_count_(0),
[email protected]992db4c2011-05-12 15:37:1533 browsing_instance_(browsing_instance),
nickd5bbd0b2016-03-31 19:52:4434 process_(nullptr),
35 has_site_(false),
Tsuyoshi Horoeb576e62017-06-28 06:00:4136 process_reuse_policy_(ProcessReusePolicy::DEFAULT),
37 is_for_service_worker_(false) {
[email protected]4566f132009-03-12 01:55:1338 DCHECK(browsing_instance);
[email protected]4566f132009-03-12 01:55:1339}
40
[email protected]b6583592012-01-25 19:52:3341SiteInstanceImpl::~SiteInstanceImpl() {
[email protected]46488322012-10-30 03:22:2042 GetContentClient()->browser()->SiteInstanceDeleting(this);
[email protected]056ad2a2011-07-12 02:13:5543
[email protected]40bfaf32013-11-19 01:35:4344 if (process_)
45 process_->RemoveObserver(this);
46
initial.commit09911bf2008-07-26 23:55:2947 // Now that no one is referencing us, we can safely remove ourselves from
48 // the BrowsingInstance. Any future visits to a page from this site
49 // (within the same BrowsingInstance) can safely create a new SiteInstance.
50 if (has_site_)
dchengbccd6b82016-03-30 16:24:1951 browsing_instance_->UnregisterSiteInstance(this);
52}
53
Nasko Oskovdeb6c7ea2017-11-30 18:18:1154// static
dchengbccd6b82016-03-30 16:24:1955scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::Create(
56 BrowserContext* browser_context) {
kylecharda69d882017-10-04 05:49:5257 return base::WrapRefCounted(
dchengbccd6b82016-03-30 16:24:1958 new SiteInstanceImpl(new BrowsingInstance(browser_context)));
59}
60
Nasko Oskovdeb6c7ea2017-11-30 18:18:1161// static
dchengbccd6b82016-03-30 16:24:1962scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForURL(
63 BrowserContext* browser_context,
64 const GURL& url) {
65 // This will create a new SiteInstance and BrowsingInstance.
66 scoped_refptr<BrowsingInstance> instance(
67 new BrowsingInstance(browser_context));
68 return instance->GetSiteInstanceForURL(url);
initial.commit09911bf2008-07-26 23:55:2969}
70
Nasko Oskovdeb6c7ea2017-11-30 18:18:1171// static
72bool SiteInstanceImpl::ShouldAssignSiteForURL(const GURL& url) {
73 // about:blank should not "use up" a new SiteInstance. The SiteInstance can
74 // still be used for a normal web site.
75 if (url == url::kAboutBlankURL)
76 return false;
77
78 // The embedder will then have the opportunity to determine if the URL
79 // should "use up" the SiteInstance.
80 return GetContentClient()->browser()->ShouldAssignSiteForURL(url);
81}
82
avib7348942015-12-25 20:57:1083int32_t SiteInstanceImpl::GetId() {
[email protected]b6583592012-01-25 19:52:3384 return id_;
85}
86
87bool SiteInstanceImpl::HasProcess() const {
Ivan Kotenkov2c0d2bb32017-11-01 15:41:2888 if (process_ != nullptr)
[email protected]41fb79a52012-06-29 16:34:3389 return true;
90
91 // If we would use process-per-site for this site, also check if there is an
92 // existing process that we would use if GetProcess() were called.
[email protected]46488322012-10-30 03:22:2093 BrowserContext* browser_context =
[email protected]41fb79a52012-06-29 16:34:3394 browsing_instance_->browser_context();
95 if (has_site_ &&
[email protected]1ae93fb12013-06-14 03:38:5696 RenderProcessHost::ShouldUseProcessPerSite(browser_context, site_) &&
[email protected]41fb79a52012-06-29 16:34:3397 RenderProcessHostImpl::GetProcessHostForSite(browser_context, site_)) {
98 return true;
99 }
100
101 return false;
[email protected]5ab79b02010-04-26 16:47:11102}
103
[email protected]41fb79a52012-06-29 16:34:33104RenderProcessHost* SiteInstanceImpl::GetProcess() {
[email protected]08c8ec7e2010-07-11 17:14:48105 // TODO(erikkay) It would be nice to ensure that the renderer type had been
106 // properly set before we get here. The default tab creation case winds up
107 // with no site set at this point, so it will default to TYPE_NORMAL. This
108 // may not be correct, so we'll wind up potentially creating a process that
109 // we then throw away, or worse sharing a process with the wrong process type.
110 // See crbug.com/43448.
111
initial.commit09911bf2008-07-26 23:55:29112 // Create a new process if ours went away or was reused.
[email protected]4566f132009-03-12 01:55:13113 if (!process_) {
[email protected]4c3a23582012-08-18 08:54:34114 BrowserContext* browser_context = browsing_instance_->browser_context();
[email protected]41fb79a52012-06-29 16:34:33115
clamy63960c32017-05-10 22:57:07116 // Check if the ProcessReusePolicy should be updated.
117 bool should_use_process_per_site =
creisa9f04ba2017-05-19 22:27:42118 has_site_ &&
119 RenderProcessHost::ShouldUseProcessPerSite(browser_context, site_);
clamy63960c32017-05-10 22:57:07120 if (should_use_process_per_site) {
121 process_reuse_policy_ = ProcessReusePolicy::PROCESS_PER_SITE;
122 } else if (process_reuse_policy_ == ProcessReusePolicy::PROCESS_PER_SITE) {
123 process_reuse_policy_ = ProcessReusePolicy::DEFAULT;
[email protected]41fb79a52012-06-29 16:34:33124 }
125
clamy63960c32017-05-10 22:57:07126 process_ = RenderProcessHostImpl::GetProcessHostForSiteInstance(
127 browser_context, this);
avi6d686db2017-01-06 02:28:57128
[email protected]41fb79a52012-06-29 16:34:33129 CHECK(process_);
[email protected]40bfaf32013-11-19 01:35:43130 process_->AddObserver(this);
[email protected]41fb79a52012-06-29 16:34:33131
132 // If we are using process-per-site, we need to register this process
133 // for the current site so that we can find it again. (If no site is set
134 // at this time, we will register it in SetSite().)
clamy63960c32017-05-10 22:57:07135 if (process_reuse_policy_ == ProcessReusePolicy::PROCESS_PER_SITE &&
136 has_site_) {
[email protected]41fb79a52012-06-29 16:34:33137 RenderProcessHostImpl::RegisterProcessHostForSite(browser_context,
138 process_, site_);
139 }
initial.commit09911bf2008-07-26 23:55:29140
naskob8744d22014-08-28 17:07:43141 TRACE_EVENT2("navigation", "SiteInstanceImpl::GetProcess",
142 "site id", id_, "process id", process_->GetID());
[email protected]46488322012-10-30 03:22:20143 GetContentClient()->browser()->SiteInstanceGotProcess(this);
[email protected]6f371442011-11-09 06:45:46144
[email protected]313b80bd2011-11-23 03:49:10145 if (has_site_)
alexmos13fe1962017-06-28 04:25:12146 LockToOriginIfNeeded();
initial.commit09911bf2008-07-26 23:55:29147 }
[email protected]4566f132009-03-12 01:55:13148 DCHECK(process_);
initial.commit09911bf2008-07-26 23:55:29149
[email protected]4566f132009-03-12 01:55:13150 return process_;
initial.commit09911bf2008-07-26 23:55:29151}
152
[email protected]b6583592012-01-25 19:52:33153void SiteInstanceImpl::SetSite(const GURL& url) {
naskob8744d22014-08-28 17:07:43154 TRACE_EVENT2("navigation", "SiteInstanceImpl::SetSite",
155 "site id", id_, "url", url.possibly_invalid_spec());
initial.commit09911bf2008-07-26 23:55:29156 // A SiteInstance's site should not change.
157 // TODO(creis): When following links or script navigations, we can currently
158 // render pages from other sites in this SiteInstance. This will eventually
159 // be fixed, but until then, we should still not set the site of a
160 // SiteInstance more than once.
161 DCHECK(!has_site_);
162
163 // Remember that this SiteInstance has been used to load a URL, even if the
164 // URL is invalid.
165 has_site_ = true;
[email protected]4c3a23582012-08-18 08:54:34166 BrowserContext* browser_context = browsing_instance_->browser_context();
[email protected]41fb79a52012-06-29 16:34:33167 site_ = GetSiteForURL(browser_context, url);
Alex Moshchuk25c64bb2017-12-02 02:50:11168 original_url_ = url;
initial.commit09911bf2008-07-26 23:55:29169
170 // Now that we have a site, register it with the BrowsingInstance. This
171 // ensures that we won't create another SiteInstance for this site within
172 // the same BrowsingInstance, because all same-site pages within a
173 // BrowsingInstance can script each other.
174 browsing_instance_->RegisterSiteInstance(this);
[email protected]313b80bd2011-11-23 03:49:10175
clamy63960c32017-05-10 22:57:07176 // Update the process reuse policy based on the site.
177 bool should_use_process_per_site =
178 RenderProcessHost::ShouldUseProcessPerSite(browser_context, site_);
179 if (should_use_process_per_site) {
180 process_reuse_policy_ = ProcessReusePolicy::PROCESS_PER_SITE;
181 }
182
[email protected]41fb79a52012-06-29 16:34:33183 if (process_) {
alexmos13fe1962017-06-28 04:25:12184 LockToOriginIfNeeded();
[email protected]41fb79a52012-06-29 16:34:33185
186 // Ensure the process is registered for this site if necessary.
clamy63960c32017-05-10 22:57:07187 if (should_use_process_per_site) {
[email protected]41fb79a52012-06-29 16:34:33188 RenderProcessHostImpl::RegisterProcessHostForSite(
189 browser_context, process_, site_);
190 }
191 }
initial.commit09911bf2008-07-26 23:55:29192}
193
[email protected]77ab17312012-09-28 15:34:59194const GURL& SiteInstanceImpl::GetSiteURL() const {
[email protected]b6583592012-01-25 19:52:33195 return site_;
196}
197
198bool SiteInstanceImpl::HasSite() const {
199 return has_site_;
200}
201
202bool SiteInstanceImpl::HasRelatedSiteInstance(const GURL& url) {
initial.commit09911bf2008-07-26 23:55:29203 return browsing_instance_->HasSiteInstance(url);
204}
205
dchengbccd6b82016-03-30 16:24:19206scoped_refptr<SiteInstance> SiteInstanceImpl::GetRelatedSiteInstance(
207 const GURL& url) {
initial.commit09911bf2008-07-26 23:55:29208 return browsing_instance_->GetSiteInstanceForURL(url);
209}
210
[email protected]14392a52012-05-02 20:28:44211bool SiteInstanceImpl::IsRelatedSiteInstance(const SiteInstance* instance) {
[email protected]fc72bb12013-06-02 21:13:46212 return browsing_instance_.get() == static_cast<const SiteInstanceImpl*>(
213 instance)->browsing_instance_.get();
[email protected]14392a52012-05-02 20:28:44214}
215
[email protected]d5072a82014-05-15 05:50:18216size_t SiteInstanceImpl::GetRelatedActiveContentsCount() {
217 return browsing_instance_->active_contents_count();
218}
219
[email protected]f88628d02012-11-11 17:58:59220bool SiteInstanceImpl::HasWrongProcessForURL(const GURL& url) {
[email protected]d292d8a2011-05-25 03:47:11221 // Having no process isn't a problem, since we'll assign it correctly.
[email protected]f88628d02012-11-11 17:58:59222 // Note that HasProcess() may return true if process_ is null, in
223 // process-per-site cases where there's an existing process available.
224 // We want to use such a process in the IsSuitableHost check, so we
225 // may end up assigning process_ in the GetProcess() call below.
226 if (!HasProcess())
[email protected]d292d8a2011-05-25 03:47:11227 return false;
228
[email protected]144a8102012-01-14 01:05:31229 // If the URL to navigate to can be associated with any site instance,
230 // we want to keep it in the same process.
[email protected]c02f1ba2014-02-03 06:53:53231 if (IsRendererDebugURL(url))
[email protected]144a8102012-01-14 01:05:31232 return false;
233
alexmos13fe1962017-06-28 04:25:12234 // Any process can host an about:blank URL. This check avoids a process
235 // transfer for browser-initiated navigations to about:blank in a dedicated
236 // process; without it, IsSuitableHost would consider this process unsuitable
237 // for about:blank when it compares origin locks. Renderer-initiated
238 // navigations will handle about:blank navigations elsewhere and leave them
239 // in the source SiteInstance, along with about:srcdoc and data:.
240 if (url == url::kAboutBlankURL)
241 return false;
242
[email protected]88aae972011-12-16 01:14:18243 // If the site URL is an extension (e.g., for hosted apps or WebUI) but the
[email protected]d292d8a2011-05-25 03:47:11244 // process is not (or vice versa), make sure we notice and fix it.
[email protected]2a5221b2011-09-27 23:07:31245 GURL site_url = GetSiteForURL(browsing_instance_->browser_context(), url);
[email protected]88aae972011-12-16 01:14:18246 return !RenderProcessHostImpl::IsSuitableHost(
[email protected]f88628d02012-11-11 17:58:59247 GetProcess(), browsing_instance_->browser_context(), site_url);
[email protected]d292d8a2011-05-25 03:47:11248}
249
nickd5bbd0b2016-03-31 19:52:44250scoped_refptr<SiteInstanceImpl>
251SiteInstanceImpl::GetDefaultSubframeSiteInstance() {
252 return browsing_instance_->GetDefaultSubframeSiteInstance();
253}
254
nickd30fd962015-07-27 21:51:08255bool SiteInstanceImpl::RequiresDedicatedProcess() {
256 if (!has_site_)
257 return false;
nickd5bbd0b2016-03-31 19:52:44258
259 return DoesSiteRequireDedicatedProcess(GetBrowserContext(), site_);
nickd30fd962015-07-27 21:51:08260}
261
avi85cacb72016-10-26 22:39:33262bool SiteInstanceImpl::IsDefaultSubframeSiteInstance() const {
clamy63960c32017-05-10 22:57:07263 return process_reuse_policy_ ==
264 ProcessReusePolicy::USE_DEFAULT_SUBFRAME_PROCESS;
avi85cacb72016-10-26 22:39:33265}
266
nick9f34e2892016-01-12 21:01:07267void SiteInstanceImpl::IncrementActiveFrameCount() {
268 active_frame_count_++;
269}
270
271void SiteInstanceImpl::DecrementActiveFrameCount() {
ericwilligers254597b2016-10-17 10:32:31272 if (--active_frame_count_ == 0) {
273 for (auto& observer : observers_)
274 observer.ActiveFrameCountIsZero(this);
275 }
nick9f34e2892016-01-12 21:01:07276}
277
[email protected]d5072a82014-05-15 05:50:18278void SiteInstanceImpl::IncrementRelatedActiveContentsCount() {
279 browsing_instance_->increment_active_contents_count();
280}
281
282void SiteInstanceImpl::DecrementRelatedActiveContentsCount() {
283 browsing_instance_->decrement_active_contents_count();
284}
285
nick9f34e2892016-01-12 21:01:07286void SiteInstanceImpl::AddObserver(Observer* observer) {
287 observers_.AddObserver(observer);
288}
289
290void SiteInstanceImpl::RemoveObserver(Observer* observer) {
291 observers_.RemoveObserver(observer);
292}
293
[email protected]4c3a23582012-08-18 08:54:34294BrowserContext* SiteInstanceImpl::GetBrowserContext() const {
[email protected]72daaa92012-01-18 13:39:02295 return browsing_instance_->browser_context();
296}
297
nickcc0d9142015-10-14 16:27:10298// static
dchengbccd6b82016-03-30 16:24:19299scoped_refptr<SiteInstance> SiteInstance::Create(
300 BrowserContext* browser_context) {
301 return SiteInstanceImpl::Create(browser_context);
initial.commit09911bf2008-07-26 23:55:29302}
303
nickcc0d9142015-10-14 16:27:10304// static
dchengbccd6b82016-03-30 16:24:19305scoped_refptr<SiteInstance> SiteInstance::CreateForURL(
306 BrowserContext* browser_context,
307 const GURL& url) {
308 return SiteInstanceImpl::CreateForURL(browser_context, url);
[email protected]d8a96622009-05-07 19:21:16309}
310
nickcc0d9142015-10-14 16:27:10311// static
Nasko Oskovdeb6c7ea2017-11-30 18:18:11312bool SiteInstance::ShouldAssignSiteForURL(const GURL& url) {
313 return SiteInstanceImpl::ShouldAssignSiteForURL(url);
314}
315
316// static
[email protected]399583b2012-12-11 09:33:42317bool SiteInstance::IsSameWebSite(BrowserContext* browser_context,
[email protected]855d7d572014-08-02 11:18:17318 const GURL& real_src_url,
319 const GURL& real_dest_url) {
Alex Moshchuk25c64bb2017-12-02 02:50:11320 return SiteInstanceImpl::IsSameWebSite(browser_context, real_src_url,
321 real_dest_url, true);
322}
323
324bool SiteInstanceImpl::IsSameWebSite(BrowserContext* browser_context,
325 const GURL& real_src_url,
326 const GURL& real_dest_url,
327 bool should_compare_effective_urls) {
328 GURL src_url =
329 should_compare_effective_urls
330 ? SiteInstanceImpl::GetEffectiveURL(browser_context, real_src_url)
331 : real_src_url;
332 GURL dest_url =
333 should_compare_effective_urls
334 ? SiteInstanceImpl::GetEffectiveURL(browser_context, real_dest_url)
335 : real_dest_url;
[email protected]399583b2012-12-11 09:33:42336
337 // We infer web site boundaries based on the registered domain name of the
338 // top-level page and the scheme. We do not pay attention to the port if
339 // one is present, because pages served from different ports can still
340 // access each other if they change their document.domain variable.
341
342 // Some special URLs will match the site instance of any other URL. This is
343 // done before checking both of them for validity, since we want these URLs
344 // to have the same site instance as even an invalid one.
[email protected]855d7d572014-08-02 11:18:17345 if (IsRendererDebugURL(src_url) || IsRendererDebugURL(dest_url))
[email protected]399583b2012-12-11 09:33:42346 return true;
347
348 // If either URL is invalid, they aren't part of the same site.
[email protected]855d7d572014-08-02 11:18:17349 if (!src_url.is_valid() || !dest_url.is_valid())
[email protected]399583b2012-12-11 09:33:42350 return false;
351
[email protected]855d7d572014-08-02 11:18:17352 // If the destination url is just a blank page, we treat them as part of the
353 // same site.
354 GURL blank_page(url::kAboutBlankURL);
355 if (dest_url == blank_page)
356 return true;
357
Daniel Cheng88186bd52017-10-20 08:14:46358 url::Origin src_origin = url::Origin::Create(src_url);
359 url::Origin dest_origin = url::Origin::Create(dest_url);
alexmos3b9ad102017-05-26 23:41:08360
[email protected]399583b2012-12-11 09:33:42361 // If the schemes differ, they aren't part of the same site.
alexmoscbf995782017-06-01 03:13:13362 if (src_origin.scheme() != dest_origin.scheme())
[email protected]399583b2012-12-11 09:33:42363 return false;
364
alexmos4bc26322017-07-01 00:57:14365 if (!net::registry_controlled_domains::SameDomainOrHost(
366 src_origin, dest_origin,
367 net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES)) {
368 return false;
369 }
370
371 // If the sites are the same, check isolated origins. If either URL matches
372 // an isolated origin, compare origins rather than sites.
373 auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
374 url::Origin src_isolated_origin;
375 url::Origin dest_isolated_origin;
376 bool src_origin_is_isolated =
377 policy->GetMatchingIsolatedOrigin(src_origin, &src_isolated_origin);
378 bool dest_origin_is_isolated =
379 policy->GetMatchingIsolatedOrigin(dest_origin, &dest_isolated_origin);
380 if (src_origin_is_isolated || dest_origin_is_isolated) {
381 // Compare most specific matching origins to ensure that a subdomain of an
382 // isolated origin (e.g., https://subdomain.isolated.foo.com) also matches
383 // the isolated origin's site URL (e.g., https://isolated.foo.com).
384 return src_isolated_origin == dest_isolated_origin;
385 }
386
387 return true;
[email protected]399583b2012-12-11 09:33:42388}
389
nickcc0d9142015-10-14 16:27:10390// static
[email protected]399583b2012-12-11 09:33:42391GURL SiteInstance::GetSiteForURL(BrowserContext* browser_context,
392 const GURL& real_url) {
[email protected]25a9e8e532012-06-22 06:16:28393 // TODO(fsamuel, creis): For some reason appID is not recognized as a host.
[email protected]6eb1a11e2013-10-09 00:54:37394 if (real_url.SchemeIs(kGuestScheme))
[email protected]25a9e8e532012-06-22 06:16:28395 return real_url;
396
[email protected]b6583592012-01-25 19:52:33397 GURL url = SiteInstanceImpl::GetEffectiveURL(browser_context, real_url);
Daniel Cheng88186bd52017-10-20 08:14:46398 url::Origin origin = url::Origin::Create(url);
[email protected]3a8eecb2010-04-22 23:56:30399
alexmos4bc26322017-07-01 00:57:14400 // Isolated origins should use the full origin as their site URL. A subdomain
Alex Moshchukbb99a332017-11-22 04:49:57401 // of an isolated origin should also use that isolated origin's site URL. It
402 // is important to check |url| rather than |real_url| here, since some
403 // effective URLs (such as for NTP) need to be resolved prior to the isolated
404 // origin lookup.
alexmos3b9ad102017-05-26 23:41:08405 auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
alexmos4bc26322017-07-01 00:57:14406 url::Origin isolated_origin;
Alex Moshchukbb99a332017-11-22 04:49:57407 if (policy->GetMatchingIsolatedOrigin(url::Origin::Create(url),
alexmos4bc26322017-07-01 00:57:14408 &isolated_origin)) {
409 return isolated_origin.GetURL();
410 }
alexmos3b9ad102017-05-26 23:41:08411
initial.commit09911bf2008-07-26 23:55:29412 // If the url has a host, then determine the site.
nick1dd47922016-04-29 16:44:48413 if (!origin.host().empty()) {
414 // Only keep the scheme and registered domain of |origin|.
415 std::string domain = net::registry_controlled_domains::GetDomainAndRegistry(
416 origin.host(),
417 net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
418 std::string site = origin.scheme();
419 site += url::kStandardSchemeSeparator;
420 site += domain.empty() ? origin.host() : domain;
421 return GURL(site);
initial.commit09911bf2008-07-26 23:55:29422 }
creisf60c2cd2014-12-18 00:41:02423
424 // If there is no host but there is a scheme, return the scheme.
425 // This is useful for cases like file URLs.
426 if (url.has_scheme())
427 return GURL(url.scheme() + ":");
428
429 // Otherwise the URL should be invalid; return an empty site.
430 DCHECK(!url.is_valid());
431 return GURL();
initial.commit09911bf2008-07-26 23:55:29432}
433
nickcc0d9142015-10-14 16:27:10434// static
[email protected]4c3a23582012-08-18 08:54:34435GURL SiteInstanceImpl::GetEffectiveURL(BrowserContext* browser_context,
436 const GURL& url) {
alexmos3b9ad102017-05-26 23:41:08437 auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
Alex Moshchukbb99a332017-11-22 04:49:57438 bool is_isolated_origin = policy->IsIsolatedOrigin(url::Origin::Create(url));
439 return GetContentClient()->browser()->GetEffectiveURL(browser_context, url,
440 is_isolated_origin);
[email protected]3a8eecb2010-04-22 23:56:30441}
442
nickcc0d9142015-10-14 16:27:10443// static
Alex Moshchuk25c64bb2017-12-02 02:50:11444bool SiteInstanceImpl::HasEffectiveURL(BrowserContext* browser_context,
445 const GURL& url) {
446 return GetEffectiveURL(browser_context, url) != url;
447}
448
449// static
nickcc0d9142015-10-14 16:27:10450bool SiteInstanceImpl::DoesSiteRequireDedicatedProcess(
451 BrowserContext* browser_context,
nickdb193a12016-09-09 23:09:23452 const GURL& url) {
nickcc0d9142015-10-14 16:27:10453 // If --site-per-process is enabled, site isolation is enabled everywhere.
454 if (SiteIsolationPolicy::UseDedicatedProcessesForAllSites())
455 return true;
456
alexmos3b9ad102017-05-26 23:41:08457 // Always require a dedicated process for isolated origins.
458 GURL site_url = GetSiteForURL(browser_context, url);
459 auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
Daniel Cheng88186bd52017-10-20 08:14:46460 if (policy->IsIsolatedOrigin(url::Origin::Create(site_url)))
alexmos3b9ad102017-05-26 23:41:08461 return true;
462
nickdb193a12016-09-09 23:09:23463 // Let the content embedder enable site isolation for specific URLs. Use the
464 // canonical site url for this check, so that schemes with nested origins
465 // (blob and filesystem) work properly.
Avi Drissman8c36df72017-12-11 21:19:20466 if (GetContentClient()->browser()->DoesSiteRequireDedicatedProcess(
nickdb193a12016-09-09 23:09:23467 browser_context, site_url)) {
nickcc0d9142015-10-14 16:27:10468 return true;
469 }
470
471 return false;
472}
473
alexmos13fe1962017-06-28 04:25:12474// static
475bool SiteInstanceImpl::ShouldLockToOrigin(BrowserContext* browser_context,
Alex Moshchuk9cf5a45d2017-08-14 18:50:57476 RenderProcessHost* host,
alexmos13fe1962017-06-28 04:25:12477 GURL site_url) {
creis0b49fa12017-07-10 16:31:11478 // Don't lock to origin in --single-process mode, since this mode puts
479 // cross-site pages into the same process.
Alex Moshchuk9cf5a45d2017-08-14 18:50:57480 if (host->run_renderer_in_process())
creis0b49fa12017-07-10 16:31:11481 return false;
482
alexmos13fe1962017-06-28 04:25:12483 if (!DoesSiteRequireDedicatedProcess(browser_context, site_url))
484 return false;
485
486 // Guest processes cannot be locked to their site because guests always have
487 // a fixed SiteInstance. The site of GURLs a guest loads doesn't match that
488 // SiteInstance. So we skip locking the guest process to the site.
489 // TODO(ncarter): Remove this exclusion once we can make origin lock per
490 // RenderFrame routing id.
491 if (site_url.SchemeIs(content::kGuestScheme))
492 return false;
493
494 // TODO(creis, nick) https://crbug.com/510588 Chrome UI pages use the same
495 // site (chrome://chrome), so they can't be locked because the site being
496 // loaded doesn't match the SiteInstance.
497 if (site_url.SchemeIs(content::kChromeUIScheme))
498 return false;
499
500 // TODO(creis, nick): Until we can handle sites with effective URLs at the
501 // call sites of ChildProcessSecurityPolicy::CanAccessDataForOrigin, we
502 // must give the embedder a chance to exempt some sites to avoid process
503 // kills.
504 if (!GetContentClient()->browser()->ShouldLockToOrigin(browser_context,
505 site_url)) {
506 return false;
507 }
508
509 return true;
510}
511
[email protected]40bfaf32013-11-19 01:35:43512void SiteInstanceImpl::RenderProcessHostDestroyed(RenderProcessHost* host) {
513 DCHECK_EQ(process_, host);
514 process_->RemoveObserver(this);
nickd5bbd0b2016-03-31 19:52:44515 process_ = nullptr;
[email protected]4566f132009-03-12 01:55:13516}
[email protected]313b80bd2011-11-23 03:49:10517
nick9f34e2892016-01-12 21:01:07518void SiteInstanceImpl::RenderProcessWillExit(RenderProcessHost* host) {
519 // TODO(nick): http://crbug.com/575400 - RenderProcessWillExit might not serve
520 // any purpose here.
ericwilligers254597b2016-10-17 10:32:31521 for (auto& observer : observers_)
522 observer.RenderProcessGone(this);
nick9f34e2892016-01-12 21:01:07523}
524
525void SiteInstanceImpl::RenderProcessExited(RenderProcessHost* host,
526 base::TerminationStatus status,
527 int exit_code) {
ericwilligers254597b2016-10-17 10:32:31528 for (auto& observer : observers_)
529 observer.RenderProcessGone(this);
nick9f34e2892016-01-12 21:01:07530}
531
alexmos13fe1962017-06-28 04:25:12532void SiteInstanceImpl::LockToOriginIfNeeded() {
533 DCHECK(HasSite());
534
535 // From now on, this process should be considered "tainted" for future
536 // process reuse decisions:
537 // (1) If |site_| required a dedicated process, this SiteInstance's process
538 // can only host URLs for the same site.
539 // (2) Even if |site_| does not require a dedicated process, this
540 // SiteInstance's process still cannot be reused to host other sites
541 // requiring dedicated sites in the future.
542 // We can get here either when we commit a URL into a SiteInstance that does
543 // not yet have a site, or when we create a process for a SiteInstance with a
544 // preassigned site.
545 process_->SetIsUsed();
546
Alex Moshchuk47dd00f2017-10-10 17:15:23547 ChildProcessSecurityPolicyImpl* policy =
548 ChildProcessSecurityPolicyImpl::GetInstance();
549 auto lock_state = policy->CheckOriginLock(process_->GetID(), site_);
Alex Moshchuk9cf5a45d2017-08-14 18:50:57550 if (ShouldLockToOrigin(GetBrowserContext(), process_, site_)) {
Alex Moshchuk9cf5a45d2017-08-14 18:50:57551 // Sanity check that this won't try to assign an origin lock to a <webview>
552 // process, which can't be locked.
553 CHECK(!process_->IsForGuestsOnly());
554
Alex Moshchuk9cf5a45d2017-08-14 18:50:57555 switch (lock_state) {
556 case ChildProcessSecurityPolicyImpl::CheckOriginLockResult::NO_LOCK: {
Alex Moshchuk47dd00f2017-10-10 17:15:23557 // TODO(nick): When all sites are isolated, this operation provides
558 // strong protection. If only some sites are isolated, we need
559 // additional logic to prevent the non-isolated sites from requesting
560 // resources for isolated sites. https://crbug.com/509125
Alex Moshchuk9cf5a45d2017-08-14 18:50:57561 policy->LockToOrigin(process_->GetID(), site_);
562 break;
563 }
564 case ChildProcessSecurityPolicyImpl::CheckOriginLockResult::
565 HAS_WRONG_LOCK:
566 // We should never attempt to reassign a different origin lock to a
567 // process.
Robert Sesek1e07e372017-12-09 01:34:42568 base::debug::SetCrashKeyString(bad_message::GetRequestedSiteURLKey(),
569 site_.spec());
570 base::debug::SetCrashKeyString(
571 bad_message::GetKilledProcessOriginLockKey(),
Alex Moshchuk4479b97c2017-10-17 23:20:32572 policy->GetOriginLock(process_->GetID()).spec());
Alex Moshchuk54bf13042017-10-13 04:25:29573 CHECK(false) << "Trying to lock a process to " << site_
574 << " but the process is already locked to "
575 << policy->GetOriginLock(process_->GetID());
Alex Moshchuk9cf5a45d2017-08-14 18:50:57576 break;
577 case ChildProcessSecurityPolicyImpl::CheckOriginLockResult::
578 HAS_EQUAL_LOCK:
579 // Process already has the right origin lock assigned. This case will
580 // happen for commits to |site_| after the first one.
581 break;
582 default:
583 NOTREACHED();
584 }
Alex Moshchuk47dd00f2017-10-10 17:15:23585 } else {
586 // If the site that we've just committed doesn't require a dedicated
587 // process, make sure we aren't putting it in a process for a site that
588 // does.
Robert Sesek1e07e372017-12-09 01:34:42589 base::debug::SetCrashKeyString(bad_message::GetRequestedSiteURLKey(),
590 site_.spec());
591 base::debug::SetCrashKeyString(
592 bad_message::GetKilledProcessOriginLockKey(),
Alex Moshchuk4479b97c2017-10-17 23:20:32593 policy->GetOriginLock(process_->GetID()).spec());
Alex Moshchuk47dd00f2017-10-10 17:15:23594 CHECK_EQ(lock_state,
Alex Moshchuk54bf13042017-10-13 04:25:29595 ChildProcessSecurityPolicyImpl::CheckOriginLockResult::NO_LOCK)
596 << "Trying to commit non-isolated site " << site_
597 << " in process locked to " << policy->GetOriginLock(process_->GetID());
[email protected]313b80bd2011-11-23 03:49:10598 }
599}
[email protected]46488322012-10-30 03:22:20600
601} // namespace content