Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #10760 from brave/referrer-onion-18071
Strip referrer and origin headers in xorigin requests from a .onion
- Loading branch information
Showing
17 changed files
with
380 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
/* Copyright 2021 The Brave Authors. All rights reserved. | ||
* This Source Code Form is subject to the terms of the Mozilla Public | ||
* License, v. 2.0. If a copy of the MPL was not distributed with this file, | ||
* You can obtain one at https://mozilla.org/MPL/2.0/. */ | ||
|
||
#include "net/url_request/url_request_job.h" | ||
|
||
// Strip referrer for cross-origin requests from a .onion hostname. | ||
// This also affects the Origin header outside of CORS requests. | ||
#define ComputeReferrerForPolicy \ | ||
ComputeReferrerForPolicy( \ | ||
ReferrerPolicy policy, const GURL& original_referrer, \ | ||
const GURL& destination, bool* same_origin_out_for_metrics) { \ | ||
if (base::EndsWith(original_referrer.host_piece(), ".onion", \ | ||
base::CompareCase::INSENSITIVE_ASCII) && \ | ||
!url::IsSameOriginWith(original_referrer, destination)) { \ | ||
return GURL(); \ | ||
} \ | ||
return ComputeReferrerForPolicy_Chromium( \ | ||
policy, original_referrer, destination, same_origin_out_for_metrics); \ | ||
} \ | ||
GURL URLRequestJob::ComputeReferrerForPolicy_Chromium | ||
|
||
#include "../../../../net/url_request/url_request_job.cc" | ||
|
||
#undef ComputeReferrerForPolicy |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
/* Copyright 2021 The Brave Authors. All rights reserved. | ||
* This Source Code Form is subject to the terms of the Mozilla Public | ||
* License, v. 2.0. If a copy of the MPL was not distributed with this file, | ||
* You can obtain one at https://mozilla.org/MPL/2.0/. */ | ||
|
||
#ifndef BRAVE_CHROMIUM_SRC_NET_URL_REQUEST_URL_REQUEST_JOB_H_ | ||
#define BRAVE_CHROMIUM_SRC_NET_URL_REQUEST_URL_REQUEST_JOB_H_ | ||
|
||
#define ComputeReferrerForPolicy \ | ||
ComputeReferrerForPolicy( \ | ||
ReferrerPolicy policy, const GURL& original_referrer, \ | ||
const GURL& destination, bool* same_origin_out_for_metrics = nullptr); \ | ||
static GURL ComputeReferrerForPolicy_Chromium | ||
|
||
#include "../../../../net/url_request/url_request_job.h" | ||
|
||
#undef ComputeReferrerForPolicy | ||
|
||
#endif // BRAVE_CHROMIUM_SRC_NET_URL_REQUEST_URL_REQUEST_JOB_H_ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
include_rules = [ | ||
"+../../../../../services/network/cors", | ||
] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,18 @@ | ||
/* Copyright 2021 The Brave Authors. All rights reserved. | ||
* This Source Code Form is subject to the terms of the Mozilla Public | ||
* License, v. 2.0. If a copy of the MPL was not distributed with this file, | ||
* You can obtain one at https://mozilla.org/MPL/2.0/. */ | ||
|
||
// Nullify the Origin header for cross-origin CORS requests | ||
// originating from a .onion address. | ||
#define BRAVE_CORS_URL_LOADER_START_REQUEST \ | ||
if (base::EndsWith(request_.request_initiator->host(), ".onion", \ | ||
base::CompareCase::INSENSITIVE_ASCII) && \ | ||
!request_.request_initiator->IsSameOriginWith( \ | ||
url::Origin::Create(request_.url))) { \ | ||
request_.headers.SetHeader(net::HttpRequestHeaders::kOrigin, \ | ||
url::Origin().Serialize()); \ | ||
} else /* NOLINT */ | ||
|
||
#include "../../../../../services/network/cors/cors_url_loader.cc" | ||
#undef BRAVE_CORS_URL_LOADER_START_REQUEST |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.