Diff
Modified: trunk/LayoutTests/ChangeLog (194336 => 194337)
--- trunk/LayoutTests/ChangeLog 2015-12-21 19:49:45 UTC (rev 194336)
+++ trunk/LayoutTests/ChangeLog 2015-12-21 19:54:46 UTC (rev 194337)
@@ -1,3 +1,14 @@
+2015-12-21 Antti Koivisto <[email protected]>
+
+ Limit cached redirect chain length
+ https://bugs.webkit.org/show_bug.cgi?id=152477
+
+ Reviewed by Andreas Kling.
+
+ * http/tests/cache/disk-cache/redirect-chain-limits-expected.txt: Added.
+ * http/tests/cache/disk-cache/redirect-chain-limits.html: Added.
+ * http/tests/cache/disk-cache/resources/redirect-chain.phpl: Added.
+
2015-12-21 Ryan Haddad <[email protected]>
Marking webaudio/audiocontext-state-interrupted.html as a flaky crasher on mac-wk1
Added: trunk/LayoutTests/http/tests/cache/disk-cache/redirect-chain-limits-expected.txt (0 => 194337)
--- trunk/LayoutTests/http/tests/cache/disk-cache/redirect-chain-limits-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/cache/disk-cache/redirect-chain-limits-expected.txt 2015-12-21 19:54:46 UTC (rev 194337)
@@ -0,0 +1,29 @@
+Test the limits of redirect chain length.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Redirect chain length: 1
+Response status code: 200
+Response source: Disk cache
+
+Redirect chain length: 5
+Response status code: 200
+Response source: Disk cache
+
+Redirect chain length: 6
+Response status code: 200
+Response source: Network
+
+Redirect chain length: 20
+Response status code: 200
+Response source: Network
+
+Redirect chain length: 40
+Response status code: 0
+Response source: Null response
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/http/tests/cache/disk-cache/redirect-chain-limits.html (0 => 194337)
--- trunk/LayoutTests/http/tests/cache/disk-cache/redirect-chain-limits.html (rev 0)
+++ trunk/LayoutTests/http/tests/cache/disk-cache/redirect-chain-limits.html 2015-12-21 19:54:46 UTC (rev 194337)
@@ -0,0 +1,48 @@
+<script src=""
+<script>
+window.jsTestIsAsync = true;
+
+description("Test the limits of redirect chain length.");
+
+function redirectChain(length, uniqueId, onload)
+{
+ internals.clearMemoryCache()
+
+ var url = "" + length + "&uniqueId=" + uniqueId;
+
+ xhr = new XMLHttpRequest();
+ xhr._onload_ = onload;
+ xhr._onerror_ = onload;
+ xhr._onabort_ = onload;
+ xhr.open("get", url, true);
+
+ xhr.send();
+}
+
+function testRedirectChain(length, completionHandler)
+{
+ var uniqueId = Math.floor(Math.random() * 1000000000000);
+ redirectChain(length, uniqueId, (ev) => {
+ redirectChain(length, uniqueId, (ev) => {
+ debug("Redirect chain length: " + length)
+ debug("Response status code: " + ev.target.status);
+ debug("Response source: " + internals.xhrResponseSource(ev.target));
+ debug("");
+ completionHandler();
+ });
+ });
+}
+
+testRedirectChain(1, () => {
+ testRedirectChain(5, () => {
+ testRedirectChain(6, () => {
+ testRedirectChain(20, () => {
+ testRedirectChain(40, () => {
+ finishJSTest();
+ });
+ });
+ });
+ });
+});
+</script>
+<script src=""
Added: trunk/LayoutTests/http/tests/cache/disk-cache/resources/redirect-chain.php (0 => 194337)
--- trunk/LayoutTests/http/tests/cache/disk-cache/resources/redirect-chain.php (rev 0)
+++ trunk/LayoutTests/http/tests/cache/disk-cache/resources/redirect-chain.php 2015-12-21 19:54:46 UTC (rev 194337)
@@ -0,0 +1,13 @@
+<?
+$length = $_GET['length'];
+if ($length == 0) {
+ header('Status: 200');
+ header('Cache-Control: max-age=100');
+ exit();
+}
+$length = $length - 1;
+
+header('Status: 302');
+header('Cache-Control: max-age=100');
+header('Location: redirect-chain.php?length=' . $length . '&uniqueId=' . $_GET['uniqueId'] . '&random=' . rand());
+?>
Modified: trunk/Source/WebKit2/ChangeLog (194336 => 194337)
--- trunk/Source/WebKit2/ChangeLog 2015-12-21 19:49:45 UTC (rev 194336)
+++ trunk/Source/WebKit2/ChangeLog 2015-12-21 19:54:46 UTC (rev 194337)
@@ -1,3 +1,23 @@
+2015-12-21 Antti Koivisto <[email protected]>
+
+ Limit cached redirect chain length
+ https://bugs.webkit.org/show_bug.cgi?id=152477
+
+ Reviewed by Andreas Kling.
+
+ Networking layer prevents cycles and limits the redirect chain length so creating cache cycles is difficult.
+ For robustness the network cache should still limit the maximum redirect chain length.
+
+ This patch adds a limit of five redirects both when storing and retrieving cache entries.
+
+ * NetworkProcess/NetworkResourceLoader.cpp:
+ (WebKit::NetworkResourceLoader::canUseCache):
+ (WebKit::NetworkResourceLoader::canUseCachedRedirect):
+ (WebKit::NetworkResourceLoader::willSendRedirectedRequest):
+ (WebKit::NetworkResourceLoader::continueWillSendRequest):
+ (WebKit::NetworkResourceLoader::dispatchWillSendRequestForCacheEntry):
+ * NetworkProcess/NetworkResourceLoader.h:
+
2015-12-21 Dan Bernstein <[email protected]>
Different and incorrect flags are passed to sendSync when accessibility is enabled, SpinRunLoopWhileWaitingForReply
Modified: trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp (194336 => 194337)
--- trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp 2015-12-21 19:49:45 UTC (rev 194336)
+++ trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.cpp 2015-12-21 19:54:46 UTC (rev 194337)
@@ -116,8 +116,22 @@
return false;
if (!request.url().protocolIsInHTTPFamily())
return false;
+
return true;
}
+
+bool NetworkResourceLoader::canUseCachedRedirect(const ResourceRequest& request) const
+{
+ if (!canUseCache(request))
+ return false;
+ // Limit cached redirects to avoid cycles and other trouble.
+ // Networking layer follows over 30 redirects but caching that many seems unnecessary.
+ static const unsigned maximumCachedRedirectCount { 5 };
+ if (m_redirectCount > maximumCachedRedirectCount)
+ return false;
+
+ return true;
+}
#endif
bool NetworkResourceLoader::isSynchronous() const
@@ -384,6 +398,8 @@
void NetworkResourceLoader::willSendRedirectedRequest(const ResourceRequest& request, const WebCore::ResourceRequest& redirectRequest, const ResourceResponse& redirectResponse)
{
+ ++m_redirectCount;
+
if (isSynchronous()) {
ResourceRequest overridenRequest = redirectRequest;
// FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
@@ -400,7 +416,7 @@
sendAbortingOnFailure(Messages::WebResourceLoader::WillSendRequest(redirectRequest, redirectResponse));
#if ENABLE(NETWORK_CACHE)
- if (canUseCache(request))
+ if (canUseCachedRedirect(request))
NetworkCache::singleton().storeRedirect(request, redirectResponse, redirectRequest);
#else
UNUSED_PARAM(request);
@@ -412,7 +428,8 @@
#if ENABLE(NETWORK_CACHE)
if (m_isWaitingContinueWillSendRequestForCachedRedirect) {
LOG(NetworkCache, "(NetworkProcess) Retrieving cached redirect");
- if (canUseCache(newRequest))
+
+ if (canUseCachedRedirect(newRequest))
retrieveCacheEntry(newRequest);
else
startNetworkLoad(newRequest);
@@ -535,6 +552,7 @@
ASSERT(entry->redirectRequest());
LOG(NetworkCache, "(NetworkProcess) Executing cached redirect");
+ ++m_redirectCount;
sendAbortingOnFailure(Messages::WebResourceLoader::WillSendRequest(*entry->redirectRequest(), entry->response()));
m_isWaitingContinueWillSendRequestForCachedRedirect = true;
}
Modified: trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.h (194336 => 194337)
--- trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.h 2015-12-21 19:49:45 UTC (rev 194336)
+++ trunk/Source/WebKit2/NetworkProcess/NetworkResourceLoader.h 2015-12-21 19:54:46 UTC (rev 194337)
@@ -61,10 +61,6 @@
NetworkLoad* networkLoad() const { return m_networkLoad.get(); }
-#if ENABLE(NETWORK_CACHE)
- bool canUseCache(const WebCore::ResourceRequest&) const;
-#endif
-
void start();
void abort();
@@ -116,6 +112,9 @@
virtual uint64_t messageSenderDestinationID() override { return m_parameters.identifier; }
#if ENABLE(NETWORK_CACHE)
+ bool canUseCache(const WebCore::ResourceRequest&) const;
+ bool canUseCachedRedirect(const WebCore::ResourceRequest&) const;
+
void retrieveCacheEntry(const WebCore::ResourceRequest&);
void didRetrieveCacheEntry(std::unique_ptr<NetworkCache::Entry>);
void validateCacheEntry(std::unique_ptr<NetworkCache::Entry>);
@@ -149,6 +148,7 @@
size_t m_bytesReceived { 0 };
size_t m_bufferedDataEncodedDataLength { 0 };
RefPtr<WebCore::SharedBuffer> m_bufferedData;
+ unsigned m_redirectCount { 0 };
std::unique_ptr<SynchronousLoadData> m_synchronousLoadData;
Vector<RefPtr<WebCore::BlobDataFileReference>> m_fileReferences;
