Network Security : Implement StrictOrigin and StrictOriginWhenCrossOr…

…igin

Referer policy strict-origin and strict-origin-when-cross-origin changes have been implemented. Relevant unit test cases have been added. Enum for RefererPolicy has been added to hyper codebase and v 0.9.11 of hyper contains these changes.

This commit also contains changes related to upgrade of hyper from v0.9.10 to v0.9.11. Other dependencies changed are rayon, utils, num_cpus.

components/msg/constellation_msg.rs

@@ -316,4 +316,6 @@ pub enum ReferrerPolicy {
     SameOrigin,
     OriginWhenCrossOrigin,
     UnsafeUrl,
+    StrictOrigin,
+    StrictOriginWhenCrossOrigin
 }

components/net/http_loader.rs

@@ -437,6 +437,27 @@ fn no_referrer_when_downgrade_header(referrer_url: Url, url: Url) -> Option<Url>
     return strip_url(referrer_url, false);
 }
 
+/// https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin
+fn strict_origin(referrer_url: Url, url: Url) -> Option<Url> {
+    if referrer_url.scheme() == "https" && url.scheme() != "https" {
+        return None;
+    }
+    return strip_url(referrer_url, true);
+}
+
+/// https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-strict-origin-when-cross-origin
+fn strict_origin_when_cross_origin(referrer_url: Url, url: Url) -> Option<Url> {
+    let cross_origin = referrer_url.origin() != url.origin();
+    if referrer_url.scheme() == "https" && url.scheme() != "https" {
+        return None;
+    } else {
+        if cross_origin {
+            return strip_url(referrer_url, true);
+        }
+        return strip_url(referrer_url, false);
+    }
+}
+
 /// https://w3c.github.io/webappsec-referrer-policy/#strip-url
 fn strip_url(mut referrer_url: Url, origin_only: bool) -> Option<Url> {
     if referrer_url.scheme() == "https" || referrer_url.scheme() == "http" {
@@ -467,6 +488,8 @@ pub fn determine_request_referrer(headers: &mut Headers,
             Some(ReferrerPolicy::SameOrigin) => if cross_origin { None } else { strip_url(ref_url, false) },
             Some(ReferrerPolicy::UnsafeUrl) => strip_url(ref_url, false),
             Some(ReferrerPolicy::OriginWhenCrossOrigin) => strip_url(ref_url, cross_origin),
+            Some(ReferrerPolicy::StrictOrigin) => strict_origin(ref_url, url),
+            Some(ReferrerPolicy::StrictOriginWhenCrossOrigin) => strict_origin_when_cross_origin(ref_url, url),
             Some(ReferrerPolicy::NoReferrerWhenDowngrade) | None =>
                 no_referrer_when_downgrade_header(ref_url, url),
         };

components/script/dom/document.rs

@@ -3010,6 +3010,8 @@ pub fn determine_policy_for_token(token: &str) -> Option<ReferrerPolicy> {
         "default" | "no-referrer-when-downgrade" => Some(ReferrerPolicy::NoReferrerWhenDowngrade),
         "origin" => Some(ReferrerPolicy::Origin),
         "same-origin" => Some(ReferrerPolicy::SameOrigin),
+        "strict-origin" => Some(ReferrerPolicy::StrictOrigin),
+        "strict-origin-when-cross-origin" => Some(ReferrerPolicy::StrictOriginWhenCrossOrigin),
         "origin-when-cross-origin" => Some(ReferrerPolicy::OriginWhenCrossOrigin),
         "always" | "unsafe-url" => Some(ReferrerPolicy::UnsafeUrl),
         "" => Some(ReferrerPolicy::NoReferrer),

components/script/dom/request.rs

@@ -822,6 +822,9 @@ impl Into<MsgReferrerPolicy> for ReferrerPolicy {
             ReferrerPolicy::Origin => MsgReferrerPolicy::Origin,
             ReferrerPolicy::Origin_when_cross_origin => MsgReferrerPolicy::OriginWhenCrossOrigin,
             ReferrerPolicy::Unsafe_url => MsgReferrerPolicy::UnsafeUrl,
+            ReferrerPolicy::Strict_origin => MsgReferrerPolicy::StrictOrigin,
+            ReferrerPolicy::Strict_origin_when_cross_origin =>
+                MsgReferrerPolicy::StrictOriginWhenCrossOrigin,
         }
     }
 }
@@ -836,6 +839,9 @@ impl Into<ReferrerPolicy> for MsgReferrerPolicy {
             MsgReferrerPolicy::SameOrigin => ReferrerPolicy::Origin,
             MsgReferrerPolicy::OriginWhenCrossOrigin => ReferrerPolicy::Origin_when_cross_origin,
             MsgReferrerPolicy::UnsafeUrl => ReferrerPolicy::Unsafe_url,
+            MsgReferrerPolicy::StrictOrigin => ReferrerPolicy::Strict_origin,
+            MsgReferrerPolicy::StrictOriginWhenCrossOrigin =>
+                ReferrerPolicy::Strict_origin_when_cross_origin,
         }
     }
 }

components/script/dom/webidls/Request.webidl

@@ -104,5 +104,7 @@ enum ReferrerPolicy {
   "no-referrer-when-downgrade",
   "origin",
   "origin-when-cross-origin",
-  "unsafe-url"
+  "unsafe-url",
+  "strict-origin",
+  "strict-origin-when-cross-origin"
 };

components/script/script_thread.rs

@@ -1756,6 +1756,10 @@ impl ScriptThread {
                     ReferrerPolicy::OriginWhenCrossOrigin,
                 ReferrerPolicyHeader::UnsafeUrl =>
                     ReferrerPolicy::UnsafeUrl,
+                ReferrerPolicyHeader::StrictOrigin =>
+                    ReferrerPolicy::StrictOrigin,
+                ReferrerPolicyHeader::StrictOriginWhenCrossOrigin =>
+                    ReferrerPolicy::StrictOriginWhenCrossOrigin,
             })
         } else {
             None

components/style/Cargo.toml

@@ -39,7 +39,7 @@ matches = "0.1"
 nsstring_vendor = {path = "gecko_bindings/nsstring_vendor", optional = true}
 num-integer = "0.1.32"
 num-traits = "0.1.32"
-num_cpus = "0.2.2"
+num_cpus = "1.1.0"
 ordered-float = "0.2.2"
 owning_ref = "0.2.2"
 parking_lot = "0.3.3"

components/util/Cargo.toml

@@ -22,7 +22,7 @@ getopts = "0.2.11"
 heapsize = "0.3.0"
 lazy_static = "0.2"
 log = "0.3.5"
-num_cpus = "0.2.2"
+num_cpus = "1.1.0"
 rustc-serialize = "0.3"
 serde = {version = "0.8", optional = true}
 serde_derive = {version = "0.8", optional = true}