1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#include "chrome/browser/safe_browsing/ui_manager.h" 6 7#include "base/bind.h" 8#include "base/bind_helpers.h" 9#include "base/callback.h" 10#include "base/debug/leak_tracker.h" 11#include "base/stl_util.h" 12#include "base/strings/string_util.h" 13#include "base/threading/thread.h" 14#include "base/threading/thread_restrictions.h" 15#include "chrome/browser/browser_process.h" 16#include "chrome/browser/metrics/metrics_service.h" 17#include "chrome/browser/safe_browsing/malware_details.h" 18#include "chrome/browser/safe_browsing/ping_manager.h" 19#include "chrome/browser/safe_browsing/safe_browsing_blocking_page.h" 20#include "chrome/browser/safe_browsing/safe_browsing_service.h" 21#include "chrome/browser/tab_contents/tab_util.h" 22#include "chrome/common/url_constants.h" 23#include "content/public/browser/browser_thread.h" 24#include "content/public/browser/navigation_entry.h" 25#include "content/public/browser/notification_service.h" 26#include "content/public/browser/web_contents.h" 27#include "net/base/registry_controlled_domains/registry_controlled_domain.h" 28#include "net/url_request/url_request_context.h" 29#include "net/url_request/url_request_context_getter.h" 30 31using content::BrowserThread; 32using content::NavigationEntry; 33using content::WebContents; 34 35struct SafeBrowsingUIManager::WhiteListedEntry { 36 int render_process_host_id; 37 int render_view_id; 38 std::string domain; 39 SBThreatType threat_type; 40}; 41 42SafeBrowsingUIManager::UnsafeResource::UnsafeResource() 43 : is_subresource(false), 44 threat_type(SB_THREAT_TYPE_SAFE), 45 render_process_host_id(-1), 46 render_view_id(-1) { 47} 48 49SafeBrowsingUIManager::UnsafeResource::~UnsafeResource() { } 50 51SafeBrowsingUIManager::SafeBrowsingUIManager( 52 const scoped_refptr<SafeBrowsingService>& service) 53 : sb_service_(service) { 54} 55 56SafeBrowsingUIManager::~SafeBrowsingUIManager() { } 57 58void SafeBrowsingUIManager::StopOnIOThread(bool shutdown) { 59 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); 60 61 if (shutdown) 62 sb_service_ = NULL; 63} 64 65void SafeBrowsingUIManager::LogPauseDelay(base::TimeDelta time) { 66 UMA_HISTOGRAM_LONG_TIMES("SB2.Delay", time); 67} 68 69// Only report SafeBrowsing related stats when UMA is enabled. User must also 70// ensure that safe browsing is enabled from the calling profile. 71bool SafeBrowsingUIManager::CanReportStats() const { 72 const MetricsService* metrics = g_browser_process->metrics_service(); 73 return metrics && metrics->reporting_active(); 74} 75 76void SafeBrowsingUIManager::DisplayBlockingPage( 77 const GURL& url, 78 const GURL& original_url, 79 const std::vector<GURL>& redirect_urls, 80 bool is_subresource, 81 SBThreatType threat_type, 82 const UrlCheckCallback& callback, 83 int render_process_host_id, 84 int render_view_id) { 85 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); 86 UnsafeResource resource; 87 resource.url = url; 88 resource.original_url = original_url; 89 resource.redirect_urls = redirect_urls; 90 resource.is_subresource = is_subresource; 91 resource.threat_type = threat_type; 92 resource.callback = callback; 93 resource.render_process_host_id = render_process_host_id; 94 resource.render_view_id = render_view_id; 95 96 // The blocking page must be created from the UI thread. 97 BrowserThread::PostTask( 98 BrowserThread::UI, FROM_HERE, 99 base::Bind(&SafeBrowsingUIManager::DoDisplayBlockingPage, this, 100 resource)); 101} 102 103void SafeBrowsingUIManager::OnBlockingPageDone( 104 const std::vector<UnsafeResource>& resources, 105 bool proceed) { 106 for (std::vector<UnsafeResource>::const_iterator iter = resources.begin(); 107 iter != resources.end(); ++iter) { 108 const UnsafeResource& resource = *iter; 109 if (!resource.callback.is_null()) 110 resource.callback.Run(proceed); 111 112 if (proceed) { 113 BrowserThread::PostTask( 114 BrowserThread::UI, 115 FROM_HERE, 116 base::Bind(&SafeBrowsingUIManager::UpdateWhitelist, this, resource)); 117 } 118 } 119} 120 121void SafeBrowsingUIManager::DoDisplayBlockingPage( 122 const UnsafeResource& resource) { 123 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI)); 124 // Check if the user has already ignored our warning for this render_view 125 // and domain. 126 if (IsWhitelisted(resource)) { 127 if (!resource.callback.is_null()) { 128 BrowserThread::PostTask( 129 BrowserThread::IO, FROM_HERE, base::Bind(resource.callback, true)); 130 } 131 return; 132 } 133 134 // The tab might have been closed. 135 WebContents* web_contents = 136 tab_util::GetWebContentsByID(resource.render_process_host_id, 137 resource.render_view_id); 138 139 if (!web_contents) { 140 // The tab is gone and we did not have a chance at showing the interstitial. 141 // Just act as if "Don't Proceed" were chosen. 142 std::vector<UnsafeResource> resources; 143 resources.push_back(resource); 144 BrowserThread::PostTask( 145 BrowserThread::IO, FROM_HERE, 146 base::Bind(&SafeBrowsingUIManager::OnBlockingPageDone, 147 this, resources, false)); 148 return; 149 } 150 151 if (resource.threat_type != SB_THREAT_TYPE_SAFE && 152 CanReportStats()) { 153 GURL page_url = web_contents->GetURL(); 154 GURL referrer_url; 155 NavigationEntry* entry = web_contents->GetController().GetActiveEntry(); 156 if (entry) 157 referrer_url = entry->GetReferrer().url; 158 159 // When the malicious url is on the main frame, and resource.original_url 160 // is not the same as the resource.url, that means we have a redirect from 161 // resource.original_url to resource.url. 162 // Also, at this point, page_url points to the _previous_ page that we 163 // were on. We replace page_url with resource.original_url and referrer 164 // with page_url. 165 if (!resource.is_subresource && 166 !resource.original_url.is_empty() && 167 resource.original_url != resource.url) { 168 referrer_url = page_url; 169 page_url = resource.original_url; 170 } 171 ReportSafeBrowsingHit(resource.url, page_url, referrer_url, 172 resource.is_subresource, resource.threat_type, 173 std::string() /* post_data */); 174 } 175 if (resource.threat_type != SB_THREAT_TYPE_SAFE) { 176 FOR_EACH_OBSERVER(Observer, observer_list_, OnSafeBrowsingHit(resource)); 177 } 178 SafeBrowsingBlockingPage::ShowBlockingPage(this, resource); 179} 180 181// A safebrowsing hit is sent after a blocking page for malware/phishing 182// or after the warning dialog for download urls, only for UMA users. 183void SafeBrowsingUIManager::ReportSafeBrowsingHit( 184 const GURL& malicious_url, 185 const GURL& page_url, 186 const GURL& referrer_url, 187 bool is_subresource, 188 SBThreatType threat_type, 189 const std::string& post_data) { 190 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI)); 191 if (!CanReportStats()) 192 return; 193 194 BrowserThread::PostTask( 195 BrowserThread::IO, FROM_HERE, 196 base::Bind(&SafeBrowsingUIManager::ReportSafeBrowsingHitOnIOThread, this, 197 malicious_url, page_url, referrer_url, is_subresource, 198 threat_type, post_data)); 199} 200 201void SafeBrowsingUIManager::AddObserver(Observer* observer) { 202 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI)); 203 observer_list_.AddObserver(observer); 204} 205 206void SafeBrowsingUIManager::RemoveObserver(Observer* observer) { 207 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI)); 208 observer_list_.RemoveObserver(observer); 209} 210 211void SafeBrowsingUIManager::ReportSafeBrowsingHitOnIOThread( 212 const GURL& malicious_url, 213 const GURL& page_url, 214 const GURL& referrer_url, 215 bool is_subresource, 216 SBThreatType threat_type, 217 const std::string& post_data) { 218 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); 219 220 // The service may delete the ping manager (i.e. when user disabling service, 221 // etc). This happens on the IO thread. 222 if (sb_service_.get() == NULL || sb_service_->ping_manager() == NULL) 223 return; 224 225 DVLOG(1) << "ReportSafeBrowsingHit: " << malicious_url << " " << page_url 226 << " " << referrer_url << " " << is_subresource << " " 227 << threat_type; 228 sb_service_->ping_manager()->ReportSafeBrowsingHit( 229 malicious_url, page_url, 230 referrer_url, is_subresource, 231 threat_type, post_data); 232} 233 234// If the user had opted-in to send MalwareDetails, this gets called 235// when the report is ready. 236void SafeBrowsingUIManager::SendSerializedMalwareDetails( 237 const std::string& serialized) { 238 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); 239 240 // The service may delete the ping manager (i.e. when user disabling service, 241 // etc). This happens on the IO thread. 242 if (sb_service_.get() == NULL || sb_service_->ping_manager() == NULL) 243 return; 244 245 if (!serialized.empty()) { 246 DVLOG(1) << "Sending serialized malware details."; 247 sb_service_->ping_manager()->ReportMalwareDetails(serialized); 248 } 249} 250 251void SafeBrowsingUIManager::UpdateWhitelist(const UnsafeResource& resource) { 252 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI)); 253 // Whitelist this domain and warning type for the given tab. 254 WhiteListedEntry entry; 255 entry.render_process_host_id = resource.render_process_host_id; 256 entry.render_view_id = resource.render_view_id; 257 entry.domain = net::registry_controlled_domains::GetDomainAndRegistry( 258 resource.url, 259 net::registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES); 260 entry.threat_type = resource.threat_type; 261 white_listed_entries_.push_back(entry); 262} 263 264bool SafeBrowsingUIManager::IsWhitelisted(const UnsafeResource& resource) { 265 DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI)); 266 // Check if the user has already ignored our warning for this render_view 267 // and domain. 268 for (size_t i = 0; i < white_listed_entries_.size(); ++i) { 269 const WhiteListedEntry& entry = white_listed_entries_[i]; 270 if (entry.render_process_host_id == resource.render_process_host_id && 271 entry.render_view_id == resource.render_view_id && 272 // Threat type must be the same or in the case of phishing they can 273 // either be client-side phishing URL or a SafeBrowsing phishing URL. 274 // If we show one type of phishing warning we don't want to show a 275 // second phishing warning. 276 (entry.threat_type == resource.threat_type || 277 (entry.threat_type == SB_THREAT_TYPE_URL_PHISHING && 278 resource.threat_type == SB_THREAT_TYPE_CLIENT_SIDE_PHISHING_URL) || 279 (entry.threat_type == SB_THREAT_TYPE_CLIENT_SIDE_PHISHING_URL && 280 resource.threat_type == SB_THREAT_TYPE_URL_PHISHING))) { 281 return entry.domain == 282 net::registry_controlled_domains::GetDomainAndRegistry( 283 resource.url, 284 net::registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES); 285 } 286 } 287 return false; 288} 289