chrome_frame/urlmon_url_request.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome_frame/urlmon_url_request.h"
   6
   7 #include <urlmon.h>
   8 #include <wininet.h>
   9
  10 #include "base/bind.h"
  11 #include "base/bind_helpers.h"
  12 #include "base/logging.h"
  13 #include "base/memory/scoped_ptr.h"
  14 #include "base/message_loop.h"
  15 #include "base/string_number_conversions.h"
  16 #include "base/stringprintf.h"
  17 #include "base/threading/platform_thread.h"
  18 #include "base/utf_string_conversions.h"
  19 #include "chrome/common/automation_messages.h"
  20 #include "chrome_frame/bind_context_info.h"
  21 #include "chrome_frame/chrome_frame_activex_base.h"
  22 #include "chrome_frame/extra_system_apis.h"
  23 #include "chrome_frame/html_utils.h"
  24 #include "chrome_frame/urlmon_upload_data_stream.h"
  25 #include "chrome_frame/urlmon_url_request_private.h"
  26 #include "chrome_frame/utils.h"
  27 #include "net/base/load_flags.h"
  28 #include "net/http/http_response_headers.h"
  29 #include "net/http/http_util.h"
  30
  31 #define IS_HTTP_SUCCESS_CODE(code) (code >= 200 && code <= 299)
  32
  33 UrlmonUrlRequest::UrlmonUrlRequest()
  34     : pending_read_size_(0),
  35       headers_received_(false),
  36       calling_delegate_(0),
  37       thread_(NULL),
  38       parent_window_(NULL),
  39       privileged_mode_(false),
  40       pending_(false),
  41       is_expecting_download_(true),
  42       cleanup_transaction_(false) {
  43   DVLOG(1) << __FUNCTION__ << me();
  44 }
  45
  46 UrlmonUrlRequest::~UrlmonUrlRequest() {
  47   DVLOG(1) << __FUNCTION__ << me();
  48 }
  49
  50 std::string UrlmonUrlRequest::me() const {
  51   return base::StringPrintf(" id: %i Obj: %X ", id(), this);
  52 }
  53
  54 bool UrlmonUrlRequest::Start() {
  55   DVLOG(1) << __FUNCTION__ << me() << url();
  56   DCHECK(thread_ == 0 || thread_ == base::PlatformThread::CurrentId());
  57   thread_ = base::PlatformThread::CurrentId();
  58   status_.Start();
  59   // Initialize the net::HostPortPair structure from the url initially. We may
  60   // not receive the ip address of the host if the request is satisfied from
  61   // the cache.
  62   socket_address_ = net::HostPortPair::FromURL(GURL(url()));
  63   // The UrlmonUrlRequest instance can get destroyed in the context of
  64   // StartAsyncDownload if BindToStorage finishes synchronously with an error.
  65   // Grab a reference to protect against this.
  66   scoped_refptr<UrlmonUrlRequest> ref(this);
  67   HRESULT hr = StartAsyncDownload();
  68   if (FAILED(hr) && status_.get_state() != UrlmonUrlRequest::Status::DONE) {
  69     status_.Done();
  70     status_.set_result(net::URLRequestStatus::FAILED, HresultToNetError(hr));
  71     NotifyDelegateAndDie();
  72   }
  73   return true;
  74 }
  75
  76 void UrlmonUrlRequest::Stop() {
  77   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
  78   DCHECK((status_.get_state() != Status::DONE) == (binding_ != NULL));
  79   Status::State state = status_.get_state();
  80   delegate_ = NULL;
  81
  82   // If DownloadInHost is already requested, we will quit soon anyway.
  83   if (terminate_requested())
  84     return;
  85
  86   switch (state) {
  87     case Status::WORKING:
  88       status_.Cancel();
  89       if (binding_)
  90         binding_->Abort();
  91       break;
  92
  93     case Status::ABORTING:
  94       status_.Cancel();
  95       break;
  96
  97     case Status::DONE:
  98       status_.Cancel();
  99       NotifyDelegateAndDie();
 100       break;
 101   }
 102 }
 103
 104 bool UrlmonUrlRequest::Read(int bytes_to_read) {
 105   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 106   DCHECK_GE(bytes_to_read, 0);
 107   DCHECK_EQ(0, calling_delegate_);
 108   DVLOG(1) << __FUNCTION__ << me();
 109
 110   is_expecting_download_ = false;
 111
 112   // Re-entrancy check. Thou shall not call Read() while process OnReadComplete!
 113   DCHECK_EQ(0u, pending_read_size_);
 114   if (pending_read_size_ != 0)
 115     return false;
 116
 117   DCHECK((status_.get_state() != Status::DONE) == (binding_ != NULL));
 118   if (status_.get_state() == Status::ABORTING)
 119     return true;
 120
 121   // Send data if available.
 122   size_t bytes_copied = 0;
 123   if ((bytes_copied = SendDataToDelegate(bytes_to_read))) {
 124     DVLOG(1) << __FUNCTION__ << me() << " bytes read: " << bytes_copied;
 125     return true;
 126   }
 127
 128   if (status_.get_state() == Status::WORKING) {
 129     DVLOG(1) << __FUNCTION__ << me() << " pending: " << bytes_to_read;
 130     pending_read_size_ = bytes_to_read;
 131   } else {
 132     DVLOG(1) << __FUNCTION__ << me() << " Response finished.";
 133     NotifyDelegateAndDie();
 134   }
 135
 136   return true;
 137 }
 138
 139 HRESULT UrlmonUrlRequest::InitPending(const GURL& url, IMoniker* moniker,
 140                                       IBindCtx* bind_context,
 141                                       bool enable_frame_busting,
 142                                       bool privileged_mode,
 143                                       HWND notification_window,
 144                                       IStream* cache) {
 145   DVLOG(1) << __FUNCTION__ << me() << url.spec();
 146   DCHECK(bind_context_ == NULL);
 147   DCHECK(moniker_ == NULL);
 148   DCHECK(cache_ == NULL);
 149   DCHECK(thread_ == 0 || thread_ == base::PlatformThread::CurrentId());
 150   thread_ = base::PlatformThread::CurrentId();
 151   bind_context_ = bind_context;
 152   moniker_ = moniker;
 153   enable_frame_busting_ = enable_frame_busting;
 154   privileged_mode_ = privileged_mode;
 155   parent_window_ = notification_window;
 156   cache_ = cache;
 157   set_url(url.spec());
 158   set_pending(true);
 159
 160   // Request has already started and data is fetched. We will get the
 161   // GetBindInfo call as per contract but the return values are
 162   // ignored. So just set "get" as a method to make our GetBindInfo
 163   // implementation happy.
 164   method_ = "get";
 165   return S_OK;
 166 }
 167
 168 void UrlmonUrlRequest::TerminateBind(const TerminateBindCallback& callback) {
 169   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 170   DVLOG(1) << __FUNCTION__ << me();
 171   cleanup_transaction_ = false;
 172   if (status_.get_state() == Status::DONE) {
 173     // Binding is stopped. Note result could be an error.
 174     callback.Run(moniker_, bind_context_, upload_data_,
 175                  request_headers_.c_str());
 176   } else {
 177     // WORKING (ABORTING?). Save the callback.
 178     // Now we will return INET_TERMINATE_BIND from ::OnDataAvailable() and in
 179     // ::OnStopBinding will invoke the callback passing our moniker and
 180     // bind context.
 181     terminate_bind_callback_ = callback;
 182     if (pending_data_) {
 183       // For downloads to work correctly, we must induce a call to
 184       // OnDataAvailable so that we can download INET_E_TERMINATED_BIND and
 185       // get IE into the correct state.
 186       // To accomplish this we read everything that's readily available in
 187       // the current stream.  Once we've reached the end of the stream we
 188       // should get E_PENDING back and then later we'll get that call
 189       // to OnDataAvailable.
 190       std::string data;
 191       base::win::ScopedComPtr<IStream> read_stream(pending_data_);
 192       HRESULT hr;
 193       while ((hr = ReadStream(read_stream, 0xffff, &data)) == S_OK) {
 194         // Just drop the data.
 195       }
 196       DLOG_IF(WARNING, hr != E_PENDING) << __FUNCTION__ <<
 197           base::StringPrintf(" expected E_PENDING but got 0x%08X", hr);
 198     }
 199   }
 200 }
 201
 202 size_t UrlmonUrlRequest::SendDataToDelegate(size_t bytes_to_read) {
 203   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 204   DCHECK_NE(id(), -1);
 205   DCHECK_GT(bytes_to_read, 0U);
 206   size_t bytes_copied = 0;
 207   if (delegate_) {
 208     std::string read_data;
 209     if (cache_) {
 210       HRESULT hr = ReadStream(cache_, bytes_to_read, &read_data);
 211       if (hr == S_FALSE || read_data.length() < bytes_to_read) {
 212         DVLOG(1) << __FUNCTION__ << me() << "all cached data read";
 213         cache_.Release();
 214       }
 215     }
 216
 217     if (read_data.empty() && pending_data_) {
 218       size_t pending_data_read_save = pending_read_size_;
 219       pending_read_size_ = 0;
 220
 221       // AddRef the stream while we call Read to avoid a potential issue
 222       // where we can get a call to OnDataAvailable while inside Read and
 223       // in our OnDataAvailable call, we can release the stream object
 224       // while still using it.
 225       base::win::ScopedComPtr<IStream> pending(pending_data_);
 226       HRESULT hr = ReadStream(pending, bytes_to_read, &read_data);
 227       if (read_data.empty())
 228         pending_read_size_ = pending_data_read_save;
 229       // If we received S_FALSE it indicates that there is no more data in the
 230       // stream. Clear it to ensure that OnStopBinding correctly sends over the
 231       // response end notification to chrome.
 232       if (hr == S_FALSE)
 233         pending_data_.Release();
 234     }
 235
 236     bytes_copied = read_data.length();
 237
 238     if (bytes_copied) {
 239       ++calling_delegate_;
 240       DCHECK_NE(id(), -1);
 241       // The delegate can go away in the middle of ReadStream
 242       if (delegate_)
 243         delegate_->OnReadComplete(id(), read_data);
 244       --calling_delegate_;
 245     }
 246   } else {
 247     DLOG(ERROR) << __FUNCTION__ << me() << "no delegate";
 248   }
 249
 250   return bytes_copied;
 251 }
 252
 253 STDMETHODIMP UrlmonUrlRequest::OnStartBinding(DWORD reserved,
 254                                               IBinding* binding) {
 255   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 256   binding_ = binding;
 257   if (pending_) {
 258     response_headers_ = GetHttpHeadersFromBinding(binding_);
 259     DCHECK(!response_headers_.empty());
 260   }
 261   return S_OK;
 262 }
 263
 264 STDMETHODIMP UrlmonUrlRequest::GetPriority(LONG *priority) {
 265   if (!priority)
 266     return E_POINTER;
 267   *priority = THREAD_PRIORITY_NORMAL;
 268   return S_OK;
 269 }
 270
 271 STDMETHODIMP UrlmonUrlRequest::OnLowResource(DWORD reserved) {
 272   return S_OK;
 273 }
 274
 275 STDMETHODIMP UrlmonUrlRequest::OnProgress(ULONG progress, ULONG max_progress,
 276     ULONG status_code, LPCWSTR status_text) {
 277   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 278
 279   if (status_.get_state() != Status::WORKING)
 280     return S_OK;
 281
 282   // Ignore any notifications received while we are in the pending state
 283   // waiting for the request to be initiated by Chrome.
 284   if (pending_ && status_code != BINDSTATUS_REDIRECTING)
 285     return S_OK;
 286
 287   if (!delegate_) {
 288     DVLOG(1) << "Invalid delegate";
 289     return S_OK;
 290   }
 291
 292   switch (status_code) {
 293     case BINDSTATUS_CONNECTING: {
 294       if (status_text) {
 295         socket_address_.set_host(WideToUTF8(status_text));
 296       }
 297       break;
 298     }
 299
 300     case BINDSTATUS_REDIRECTING: {
 301       // If we receive a redirect for the initial pending request initiated
 302       // when our document loads we should stash it away and inform Chrome
 303       // accordingly when it requests data for the original URL.
 304       base::win::ScopedComPtr<BindContextInfo> info;
 305       BindContextInfo::FromBindContext(bind_context_, info.Receive());
 306       DCHECK(info);
 307       GURL previously_redirected(info ? info->GetUrl() : std::wstring());
 308       if (GURL(status_text) != previously_redirected) {
 309         DVLOG(1) << __FUNCTION__ << me() << "redirect from " << url()
 310                  << " to " << status_text;
 311         // Fetch the redirect status as they aren't all equal (307 in particular
 312         // retains the HTTP request verb).
 313         int http_code = GetHttpResponseStatusFromBinding(binding_);
 314         status_.SetRedirected(http_code, WideToUTF8(status_text));
 315         // Abort. We will inform Chrome in OnStopBinding callback.
 316         binding_->Abort();
 317         return E_ABORT;
 318       }
 319       break;
 320     }
 321
 322     case BINDSTATUS_COOKIE_SENT:
 323       delegate_->AddPrivacyDataForUrl(url(), "", COOKIEACTION_READ);
 324       break;
 325
 326     case BINDSTATUS_COOKIE_SUPPRESSED:
 327       delegate_->AddPrivacyDataForUrl(url(), "", COOKIEACTION_SUPPRESS);
 328       break;
 329
 330     case BINDSTATUS_COOKIE_STATE_ACCEPT:
 331       delegate_->AddPrivacyDataForUrl(url(), "", COOKIEACTION_ACCEPT);
 332       break;
 333
 334     case BINDSTATUS_COOKIE_STATE_REJECT:
 335       delegate_->AddPrivacyDataForUrl(url(), "", COOKIEACTION_REJECT);
 336       break;
 337
 338     case BINDSTATUS_COOKIE_STATE_LEASH:
 339       delegate_->AddPrivacyDataForUrl(url(), "", COOKIEACTION_LEASH);
 340       break;
 341
 342     case BINDSTATUS_COOKIE_STATE_DOWNGRADE:
 343       delegate_->AddPrivacyDataForUrl(url(), "", COOKIEACTION_DOWNGRADE);
 344       break;
 345
 346     case BINDSTATUS_COOKIE_STATE_UNKNOWN:
 347       NOTREACHED() << L"Unknown cookie state received";
 348       break;
 349
 350     default:
 351       DVLOG(1) << __FUNCTION__ << me()
 352                << base::StringPrintf(L"code: %i status: %ls", status_code,
 353                                      status_text);
 354       break;
 355   }
 356
 357   return S_OK;
 358 }
 359
 360 STDMETHODIMP UrlmonUrlRequest::OnStopBinding(HRESULT result, LPCWSTR error) {
 361   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 362   DVLOG(1) << __FUNCTION__ << me()
 363            << "- Request stopped, Result: " << std::hex << result;
 364   DCHECK(status_.get_state() == Status::WORKING ||
 365          status_.get_state() == Status::ABORTING);
 366
 367   Status::State state = status_.get_state();
 368
 369   // Mark we a are done.
 370   status_.Done();
 371
 372   if (result == INET_E_TERMINATED_BIND) {
 373     if (terminate_requested()) {
 374       terminate_bind_callback_.Run(moniker_, bind_context_, upload_data_,
 375                                    request_headers_.c_str());
 376     } else {
 377       cleanup_transaction_ = true;
 378     }
 379     // We may have returned INET_E_TERMINATED_BIND from OnDataAvailable.
 380     result = S_OK;
 381   }
 382
 383   if (state == Status::WORKING) {
 384     status_.set_result(result);
 385
 386     if (FAILED(result)) {
 387       int http_code = GetHttpResponseStatusFromBinding(binding_);
 388       // For certain requests like empty POST requests the server can return
 389       // back a HTTP success code in the range 200 to 299. We need to flag
 390       // these requests as succeeded.
 391       if (IS_HTTP_SUCCESS_CODE(http_code)) {
 392         // If this DCHECK fires it means that the server returned a HTTP
 393         // success code outside the standard range 200-206. We need to confirm
 394         // if the following code path is correct.
 395         DCHECK_LE(http_code, 206);
 396         status_.set_result(S_OK);
 397         std::string headers = GetHttpHeadersFromBinding(binding_);
 398         OnResponse(0, UTF8ToWide(headers).c_str(), NULL, NULL);
 399       } else if (net::HttpResponseHeaders::IsRedirectResponseCode(http_code) &&
 400                  result == E_ACCESSDENIED) {
 401         // Special case. If the last request was a redirect and the current OS
 402         // error value is E_ACCESSDENIED, that means an unsafe redirect was
 403         // attempted. In that case, correct the OS error value to be the more
 404         // specific ERR_UNSAFE_REDIRECT error value.
 405         status_.set_result(net::URLRequestStatus::FAILED,
 406                            net::ERR_UNSAFE_REDIRECT);
 407       }
 408     }
 409
 410     // The code below seems easy but it is not. :)
 411     // The network policy in Chrome network is that error code/end_of_stream
 412     // should be returned only as a result of read (or start) request.
 413     // Here are the possible cases:
 414     // pending_data_|pending_read
 415     //     FALSE  |FALSE   => EndRequest if no headers, otherwise wait for Read.
 416     //     FALSE  |TRUE    => EndRequest.
 417     //     TRUE   |FALSE   => Wait for Read.
 418     //     TRUE   |TRUE    => Something went wrong!!
 419
 420     if (pending_data_) {
 421       DCHECK_EQ(pending_read_size_, 0UL);
 422       ReleaseBindings();
 423       return S_OK;
 424     }
 425
 426     if (headers_received_ && pending_read_size_ == 0) {
 427       ReleaseBindings();
 428       return S_OK;
 429     }
 430
 431     // No headers or there is a pending read from Chrome.
 432     NotifyDelegateAndDie();
 433     return S_OK;
 434   }
 435
 436   // Status::ABORTING
 437   if (status_.was_redirected()) {
 438     // Just release bindings here. Chrome will issue EndRequest(request_id)
 439     // after processing headers we had provided.
 440     if (!pending_) {
 441       std::string headers = GetHttpHeadersFromBinding(binding_);
 442       OnResponse(0, UTF8ToWide(headers).c_str(), NULL, NULL);
 443     }
 444     ReleaseBindings();
 445     return S_OK;
 446   }
 447
 448   // Stop invoked.
 449   NotifyDelegateAndDie();
 450   return S_OK;
 451 }
 452
 453 STDMETHODIMP UrlmonUrlRequest::GetBindInfo(DWORD* bind_flags,
 454                                            BINDINFO* bind_info) {
 455   if ((bind_info == NULL) || (bind_info->cbSize == 0) || (bind_flags == NULL))
 456     return E_INVALIDARG;
 457
 458   *bind_flags = BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA;
 459
 460   bind_info->dwOptionsFlags = INTERNET_FLAG_NO_AUTO_REDIRECT;
 461   bind_info->dwOptions = BINDINFO_OPTIONS_WININETFLAG;
 462
 463   // TODO(ananta)
 464   // Look into whether the other load flags need to be supported in chrome
 465   // frame.
 466   if (load_flags_ & net::LOAD_VALIDATE_CACHE)
 467     *bind_flags |= BINDF_RESYNCHRONIZE;
 468
 469   if (load_flags_ & net::LOAD_BYPASS_CACHE)
 470     *bind_flags |= BINDF_GETNEWESTVERSION;
 471
 472   if (LowerCaseEqualsASCII(method(), "get")) {
 473     bind_info->dwBindVerb = BINDVERB_GET;
 474   } else if (LowerCaseEqualsASCII(method(), "post")) {
 475     bind_info->dwBindVerb = BINDVERB_POST;
 476   } else if (LowerCaseEqualsASCII(method(), "put")) {
 477     bind_info->dwBindVerb = BINDVERB_PUT;
 478   } else {
 479     std::wstring verb(ASCIIToWide(StringToUpperASCII(method())));
 480     bind_info->dwBindVerb = BINDVERB_CUSTOM;
 481     bind_info->szCustomVerb = reinterpret_cast<wchar_t*>(
 482         ::CoTaskMemAlloc((verb.length() + 1) * sizeof(wchar_t)));
 483     lstrcpyW(bind_info->szCustomVerb, verb.c_str());
 484   }
 485
 486   if (bind_info->dwBindVerb == BINDVERB_POST ||
 487       bind_info->dwBindVerb == BINDVERB_PUT ||
 488       post_data_len() > 0) {
 489     // Bypass caching proxies on upload requests and avoid writing responses to
 490     // the browser's cache.
 491     *bind_flags |= BINDF_GETNEWESTVERSION | BINDF_PRAGMA_NO_CACHE;
 492
 493     // Attempt to avoid storing the response for upload requests.
 494     // See http://crbug.com/55918
 495     if (resource_type_ != ResourceType::MAIN_FRAME)
 496       *bind_flags |= BINDF_NOWRITECACHE;
 497
 498     // Initialize the STGMEDIUM.
 499     memset(&bind_info->stgmedData, 0, sizeof(STGMEDIUM));
 500     bind_info->grfBindInfoF = 0;
 501
 502     if (bind_info->dwBindVerb != BINDVERB_CUSTOM)
 503       bind_info->szCustomVerb = NULL;
 504
 505     if ((post_data_len() || is_chunked_upload()) &&
 506         get_upload_data(&bind_info->stgmedData.pstm) == S_OK) {
 507       bind_info->stgmedData.tymed = TYMED_ISTREAM;
 508       if (!is_chunked_upload()) {
 509         bind_info->cbstgmedData = static_cast<DWORD>(post_data_len());
 510       }
 511       DVLOG(1) << __FUNCTION__ << me() << method()
 512                << " request with " << base::Int64ToString(post_data_len())
 513                << " bytes. url=" << url();
 514     } else {
 515       DVLOG(1) << __FUNCTION__ << me() << "POST request with no data!";
 516     }
 517   }
 518   return S_OK;
 519 }
 520
 521 STDMETHODIMP UrlmonUrlRequest::OnDataAvailable(DWORD flags, DWORD size,
 522                                                FORMATETC* formatetc,
 523                                                STGMEDIUM* storage) {
 524   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 525   DVLOG(1) << __FUNCTION__ << me() << "bytes available: " << size;
 526
 527   if (terminate_requested()) {
 528     DVLOG(1) << " Download requested. INET_E_TERMINATED_BIND returned";
 529     return INET_E_TERMINATED_BIND;
 530   }
 531
 532   if (!storage || (storage->tymed != TYMED_ISTREAM)) {
 533     NOTREACHED();
 534     return E_INVALIDARG;
 535   }
 536
 537   IStream* read_stream = storage->pstm;
 538   if (!read_stream) {
 539     NOTREACHED();
 540     return E_UNEXPECTED;
 541   }
 542
 543   // Some requests such as HEAD have zero data.
 544   if (size > 0)
 545     pending_data_ = read_stream;
 546
 547   if (pending_read_size_) {
 548     size_t bytes_copied = SendDataToDelegate(pending_read_size_);
 549     DVLOG(1) << __FUNCTION__ << me() << "size read: " << bytes_copied;
 550   } else {
 551     DVLOG(1) << __FUNCTION__ << me() << "- waiting for remote read";
 552   }
 553
 554   if (BSCF_LASTDATANOTIFICATION & flags) {
 555     if (!is_expecting_download_ || pending()) {
 556       DVLOG(1) << __FUNCTION__ << me() << "EOF";
 557       return S_OK;
 558     }
 559     // Always return INET_E_TERMINATED_BIND to allow bind context reuse
 560     // if DownloadToHost is suddenly requested.
 561     DVLOG(1) << __FUNCTION__ << " EOF: INET_E_TERMINATED_BIND returned";
 562     return INET_E_TERMINATED_BIND;
 563   }
 564   return S_OK;
 565 }
 566
 567 STDMETHODIMP UrlmonUrlRequest::OnObjectAvailable(REFIID iid, IUnknown* object) {
 568   // We are calling BindToStorage on the moniker we should always get called
 569   // back on OnDataAvailable and should never get OnObjectAvailable
 570   NOTREACHED();
 571   return E_NOTIMPL;
 572 }
 573
 574 STDMETHODIMP UrlmonUrlRequest::BeginningTransaction(const wchar_t* url,
 575     const wchar_t* current_headers, DWORD reserved,
 576     wchar_t** additional_headers) {
 577   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 578   if (!additional_headers) {
 579     NOTREACHED();
 580     return E_POINTER;
 581   }
 582
 583   DVLOG(1) << __FUNCTION__ << me() << "headers: \n" << current_headers;
 584
 585   if (status_.get_state() == Status::ABORTING) {
 586     // At times the BINDSTATUS_REDIRECTING notification which is sent to the
 587     // IBindStatusCallback interface does not have an accompanying HTTP
 588     // redirect status code, i.e. the attempt to query the HTTP status code
 589     // from the binding returns 0, 200, etc which are invalid redirect codes.
 590     // We don't want urlmon to follow redirects. We return E_ABORT in our
 591     // IBindStatusCallback::OnProgress function and also abort the binding.
 592     // However urlmon still tries to establish a transaction with the
 593     // redirected URL which confuses the web server.
 594     // Fix is to abort the attempted transaction.
 595     DLOG(WARNING) << __FUNCTION__ << me()
 596                   << ": Aborting connection to URL:"
 597                   << url
 598                   << " as the binding has been aborted";
 599     return E_ABORT;
 600   }
 601
 602   HRESULT hr = S_OK;
 603
 604   std::string new_headers;
 605   if (is_chunked_upload()) {
 606     new_headers = base::StringPrintf("Transfer-Encoding: chunked\r\n");
 607   }
 608
 609   if (!extra_headers().empty()) {
 610     // TODO(robertshield): We may need to sanitize headers on POST here.
 611     new_headers += extra_headers();
 612   }
 613
 614   if (!referrer().empty()) {
 615     // Referrer is famously misspelled in HTTP:
 616     new_headers += base::StringPrintf("Referer: %s\r\n", referrer().c_str());
 617   }
 618
 619   // In the rare case if "User-Agent" string is already in |current_headers|.
 620   // We send Chrome's user agent in requests initiated within ChromeFrame to
 621   // enable third party content in pages rendered in ChromeFrame to correctly
 622   // send content for Chrome as the third party content may not be equipped to
 623   // identify chromeframe as the user agent. This also ensures that the user
 624   // agent reported in scripts in chrome frame is consistent with that sent
 625   // in outgoing requests.
 626   std::string user_agent = http_utils::AddChromeFrameToUserAgentValue(
 627       http_utils::GetChromeUserAgent());
 628   new_headers += ReplaceOrAddUserAgent(current_headers, user_agent);
 629
 630   if (!new_headers.empty()) {
 631     *additional_headers = reinterpret_cast<wchar_t*>(
 632         CoTaskMemAlloc((new_headers.size() + 1) * sizeof(wchar_t)));
 633
 634     if (*additional_headers == NULL) {
 635       NOTREACHED();
 636       hr = E_OUTOFMEMORY;
 637     } else {
 638       lstrcpynW(*additional_headers, ASCIIToWide(new_headers).c_str(),
 639                 new_headers.size());
 640     }
 641   }
 642   request_headers_ = new_headers;
 643   return hr;
 644 }
 645
 646 STDMETHODIMP UrlmonUrlRequest::OnResponse(DWORD dwResponseCode,
 647     const wchar_t* response_headers, const wchar_t* request_headers,
 648     wchar_t** additional_headers) {
 649   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 650   DVLOG(1) << __FUNCTION__ << me() << "headers: \n" << response_headers;
 651
 652   if (!delegate_) {
 653     DLOG(WARNING) << "Invalid delegate";
 654     return S_OK;
 655   }
 656
 657   std::string raw_headers = WideToUTF8(response_headers);
 658
 659   delegate_->AddPrivacyDataForUrl(url(), "", 0);
 660
 661   // Security check for frame busting headers. We don't honor the headers
 662   // as-such, but instead simply kill requests which we've been asked to
 663   // look for if they specify a value for "X-Frame-Options" other than
 664   // "ALLOWALL" (the others are "deny" and "sameorigin"). This puts the onus
 665   // on the user of the UrlRequest to specify whether or not requests should
 666   // be inspected. For ActiveDocuments, the answer is "no", since WebKit's
 667   // detection/handling is sufficient and since ActiveDocuments cannot be
 668   // hosted as iframes. For NPAPI and ActiveX documents, the Initialize()
 669   // function of the PluginUrlRequest object allows them to specify how they'd
 670   // like requests handled. Both should set enable_frame_busting_ to true to
 671   // avoid CSRF attacks. Should WebKit's handling of this ever change, we will
 672   // need to re-visit how and when frames are killed to better mirror a policy
 673   // which may do something other than kill the sub-document outright.
 674
 675   // NOTE(slightlyoff): We don't use net::HttpResponseHeaders here because
 676   //    of lingering ICU/base_noicu issues.
 677   if (enable_frame_busting_) {
 678     if (http_utils::HasFrameBustingHeader(raw_headers)) {
 679       DLOG(ERROR) << "X-Frame-Options header other than ALLOWALL " <<
 680           "detected, navigation canceled";
 681       return E_FAIL;
 682     }
 683   }
 684
 685   DVLOG(1) << __FUNCTION__ << me() << "Calling OnResponseStarted";
 686
 687   // Inform the delegate.
 688   headers_received_ = true;
 689   DCHECK_NE(id(), -1);
 690   delegate_->OnResponseStarted(id(),
 691                     "",                   // mime_type
 692                     raw_headers.c_str(),  // headers
 693                     0,                    // size
 694                     base::Time(),         // last_modified
 695                     status_.get_redirection().utf8_url,
 696                     status_.get_redirection().http_code,
 697                     socket_address_);
 698   return S_OK;
 699 }
 700
 701 STDMETHODIMP UrlmonUrlRequest::GetWindow(const GUID& guid_reason,
 702                                          HWND* parent_window) {
 703   if (!parent_window)
 704     return E_INVALIDARG;
 705
 706 #ifndef NDEBUG
 707   wchar_t guid[40] = {0};
 708   ::StringFromGUID2(guid_reason, guid, arraysize(guid));
 709   const wchar_t* str = guid;
 710   if (guid_reason == IID_IAuthenticate)
 711     str = L"IAuthenticate";
 712   else if (guid_reason == IID_IHttpSecurity)
 713     str = L"IHttpSecurity";
 714   else if (guid_reason == IID_IWindowForBindingUI)
 715     str = L"IWindowForBindingUI";
 716   DVLOG(1) << __FUNCTION__ << me() << "GetWindow: " << str;
 717 #endif
 718   // We should return a non-NULL HWND as parent. Otherwise no dialog is shown.
 719   // TODO(iyengar): This hits when running the URL request tests.
 720   DLOG_IF(WARNING, !::IsWindow(parent_window_))
 721       << "UrlmonUrlRequest::GetWindow - no window!";
 722   *parent_window = parent_window_;
 723   return S_OK;
 724 }
 725
 726 STDMETHODIMP UrlmonUrlRequest::Authenticate(HWND* parent_window,
 727                                             LPWSTR* user_name,
 728                                             LPWSTR* password) {
 729   if (!parent_window)
 730     return E_INVALIDARG;
 731
 732   if (privileged_mode_)
 733     return E_ACCESSDENIED;
 734
 735   DCHECK(::IsWindow(parent_window_));
 736   *parent_window = parent_window_;
 737   return S_OK;
 738 }
 739
 740 STDMETHODIMP UrlmonUrlRequest::OnSecurityProblem(DWORD problem) {
 741   // Urlmon notifies the client of authentication problems, certificate
 742   // errors, etc by querying the object implementing the IBindStatusCallback
 743   // interface for the IHttpSecurity interface. If this interface is not
 744   // implemented then Urlmon checks for the problem codes defined below
 745   // and performs actions as defined below:-
 746   // It invokes the ReportProgress method of the protocol sink with
 747   // these problem codes and eventually invokes the ReportResult method
 748   // on the protocol sink which ends up in a call to the OnStopBinding
 749   // method of the IBindStatusCallBack interface.
 750
 751   // MSHTML's implementation of the IBindStatusCallback interface does not
 752   // implement the IHttpSecurity interface. However it handles the
 753   // OnStopBinding call with a HRESULT of 0x800c0019 and navigates to
 754   // an interstitial page which presents the user with a choice of whether
 755   // to abort the navigation.
 756
 757   // In our OnStopBinding implementation we stop the navigation and inform
 758   // Chrome about the result. Ideally Chrome should behave in a manner similar
 759   // to IE, i.e. display the SSL error interstitial page and if the user
 760   // decides to proceed anyway we would turn off SSL warnings for that
 761   // particular navigation and allow IE to download the content.
 762   // We would need to return the certificate information to Chrome for display
 763   // purposes. Currently we only return a dummy certificate to Chrome.
 764   // At this point we decided that it is a lot of work at this point and
 765   // decided to go with the easier option of implementing the IHttpSecurity
 766   // interface and replicating the checks performed by Urlmon. This
 767   // causes Urlmon to display a dialog box on the same lines as IE6.
 768   DVLOG(1) << __FUNCTION__ << me() << "Security problem : " << problem;
 769
 770   // On IE6 the default IBindStatusCallback interface does not implement the
 771   // IHttpSecurity interface and thus causes IE to put up a certificate error
 772   // dialog box. We need to emulate this behavior for sites with mismatched
 773   // certificates to work.
 774   if (GetIEVersion() == IE_6)
 775     return S_FALSE;
 776
 777   HRESULT hr = E_ABORT;
 778
 779   switch (problem) {
 780     case ERROR_INTERNET_SEC_CERT_REV_FAILED: {
 781       hr = RPC_E_RETRY;
 782       break;
 783     }
 784
 785     case ERROR_INTERNET_SEC_CERT_DATE_INVALID:
 786     case ERROR_INTERNET_SEC_CERT_CN_INVALID:
 787     case ERROR_INTERNET_INVALID_CA: {
 788       hr = S_FALSE;
 789       break;
 790     }
 791
 792     default: {
 793       NOTREACHED() << "Unhandled security problem : " << problem;
 794       break;
 795     }
 796   }
 797   return hr;
 798 }
 799
 800 HRESULT UrlmonUrlRequest::StartAsyncDownload() {
 801   DVLOG(1) << __FUNCTION__ << me() << url();
 802   HRESULT hr = E_FAIL;
 803   DCHECK((moniker_ && bind_context_) || (!moniker_ && !bind_context_));
 804
 805   if (!moniker_.get()) {
 806     std::wstring wide_url = UTF8ToWide(url());
 807     hr = CreateURLMonikerEx(NULL, wide_url.c_str(), moniker_.Receive(),
 808                             URL_MK_UNIFORM);
 809     if (FAILED(hr)) {
 810       NOTREACHED() << "CreateURLMonikerEx failed. Error: " << hr;
 811       return hr;
 812     }
 813   }
 814
 815   if (bind_context_.get() == NULL)  {
 816     hr = ::CreateAsyncBindCtxEx(NULL, 0, this, NULL,
 817                                 bind_context_.Receive(), 0);
 818     DCHECK(SUCCEEDED(hr)) << "CreateAsyncBindCtxEx failed. Error: " << hr;
 819   } else {
 820     // Use existing bind context.
 821     hr = ::RegisterBindStatusCallback(bind_context_, this, NULL, 0);
 822     DCHECK(SUCCEEDED(hr)) << "RegisterBindStatusCallback failed. Error: " << hr;
 823   }
 824
 825   if (SUCCEEDED(hr)) {
 826     base::win::ScopedComPtr<IStream> stream;
 827
 828     // BindToStorage may complete synchronously.
 829     // We still get all the callbacks - OnStart/StopBinding, this may result
 830     // in destruction of our object. It's fine but we access some members
 831     // below for debug info. :)
 832     base::win::ScopedComPtr<IHttpSecurity> self(this);
 833
 834     // Inform our moniker patch this binding should not be tortured.
 835     base::win::ScopedComPtr<BindContextInfo> info;
 836     BindContextInfo::FromBindContext(bind_context_, info.Receive());
 837     DCHECK(info);
 838     if (info)
 839       info->set_chrome_request(true);
 840
 841     hr = moniker_->BindToStorage(bind_context_, NULL, __uuidof(IStream),
 842                                  reinterpret_cast<void**>(stream.Receive()));
 843     if (hr == S_OK)
 844       DCHECK(binding_ != NULL || status_.get_state() == Status::DONE);
 845
 846     if (FAILED(hr)) {
 847       // TODO(joshia): Look into. This currently fails for:
 848       // http://user2:secret@localhost:1337/auth-basic?set-cookie-if-challenged
 849       // when running the UrlRequest unit tests.
 850       DLOG(ERROR) << __FUNCTION__ << me() <<
 851           base::StringPrintf("IUrlMoniker::BindToStorage failed 0x%08X.", hr);
 852       // In most cases we'll get a MK_E_SYNTAX error here but if we abort
 853       // the navigation ourselves such as in the case of seeing something
 854       // else than ALLOWALL in X-Frame-Options.
 855     }
 856   }
 857
 858   DLOG_IF(ERROR, FAILED(hr)) << me() <<
 859       base::StringPrintf(L"StartAsyncDownload failed: 0x%08X", hr);
 860
 861   return hr;
 862 }
 863
 864 void UrlmonUrlRequest::NotifyDelegateAndDie() {
 865   DCHECK_EQ(thread_, base::PlatformThread::CurrentId());
 866   DVLOG(1) << __FUNCTION__ << me();
 867
 868   PluginUrlRequestDelegate* delegate = delegate_;
 869   delegate_ = NULL;
 870   ReleaseBindings();
 871   TerminateTransaction();
 872   if (delegate && id() != -1) {
 873     net::URLRequestStatus result = status_.get_result();
 874     delegate->OnResponseEnd(id(), result);
 875   } else {
 876     DLOG(WARNING) << __FUNCTION__ << me() << "no delegate";
 877   }
 878 }
 879
 880 void UrlmonUrlRequest::TerminateTransaction() {
 881   if (cleanup_transaction_ && bind_context_ && moniker_) {
 882     // We return INET_E_TERMINATED_BIND from our OnDataAvailable implementation
 883     // to ensure that the transaction stays around if Chrome decides to issue
 884     // a download request when it finishes inspecting the headers received in
 885     // OnResponse. However this causes the urlmon transaction object to leak.
 886     // To workaround this we save away the IInternetProtocol interface which is
 887     // implemented by the urlmon CTransaction object in our BindContextInfo
 888     // instance which is maintained per bind context. Invoking Terminate
 889     // on this with the special flags 0x2000000 cleanly releases the
 890     // transaction.
 891     static const int kUrlmonTerminateTransactionFlags = 0x2000000;
 892     base::win::ScopedComPtr<BindContextInfo> info;
 893     BindContextInfo::FromBindContext(bind_context_, info.Receive());
 894     DCHECK(info);
 895     if (info && info->protocol()) {
 896       info->protocol()->Terminate(kUrlmonTerminateTransactionFlags);
 897     }
 898   }
 899   bind_context_.Release();
 900 }
 901
 902 void UrlmonUrlRequest::ReleaseBindings() {
 903   binding_.Release();
 904   // Do not release bind_context here!
 905   // We may get DownloadToHost request and therefore we want the bind_context
 906   // to be available.
 907   if (bind_context_)
 908     ::RevokeBindStatusCallback(bind_context_, this);
 909 }
 910
 911 net::Error UrlmonUrlRequest::HresultToNetError(HRESULT hr) {
 912   const int kInvalidHostName = 0x8007007b;
 913   // Useful reference:
 914   // http://msdn.microsoft.com/en-us/library/ms775145(VS.85).aspx
 915
 916   net::Error ret = net::ERR_UNEXPECTED;
 917
 918   switch (hr) {
 919     case S_OK:
 920       ret = net::OK;
 921       break;
 922
 923     case MK_E_SYNTAX:
 924       ret = net::ERR_INVALID_URL;
 925       break;
 926
 927     case INET_E_CANNOT_CONNECT:
 928       ret = net::ERR_CONNECTION_FAILED;
 929       break;
 930
 931     case INET_E_DOWNLOAD_FAILURE:
 932     case INET_E_CONNECTION_TIMEOUT:
 933     case E_ABORT:
 934       ret = net::ERR_CONNECTION_ABORTED;
 935       break;
 936
 937     case INET_E_DATA_NOT_AVAILABLE:
 938       ret = net::ERR_EMPTY_RESPONSE;
 939       break;
 940
 941     case INET_E_RESOURCE_NOT_FOUND:
 942       // To behave more closely to the chrome network stack, we translate this
 943       // error value as tunnel connection failed.  This error value is tested
 944       // in the ProxyTunnelRedirectTest and UnexpectedServerAuthTest tests.
 945       ret = net::ERR_TUNNEL_CONNECTION_FAILED;
 946       break;
 947
 948     // The following error codes can be returned while processing an invalid
 949     // url. http://msdn.microsoft.com/en-us/library/bb250493(v=vs.85).aspx
 950     case INET_E_INVALID_URL:
 951     case INET_E_UNKNOWN_PROTOCOL:
 952     case INET_E_REDIRECT_FAILED:
 953     case INET_E_SECURITY_PROBLEM:
 954     case kInvalidHostName:
 955     case E_INVALIDARG:
 956     case E_OUTOFMEMORY:
 957       ret = net::ERR_INVALID_URL;
 958       break;
 959
 960     case INET_E_INVALID_CERTIFICATE:
 961       ret = net::ERR_CERT_INVALID;
 962       break;
 963
 964     case E_ACCESSDENIED:
 965       ret = net::ERR_ACCESS_DENIED;
 966       break;
 967
 968     default:
 969       DLOG(WARNING)
 970           << base::StringPrintf("TODO: translate HRESULT 0x%08X to net::Error",
 971                                 hr);
 972       break;
 973   }
 974   return ret;
 975 }
 976
 977
 978 PluginUrlRequestManager::ThreadSafeFlags
 979     UrlmonUrlRequestManager::GetThreadSafeFlags() {
 980   return PluginUrlRequestManager::NOT_THREADSAFE;
 981 }
 982
 983 void UrlmonUrlRequestManager::SetInfoForUrl(const std::wstring& url,
 984                                             IMoniker* moniker, LPBC bind_ctx) {
 985   CComObject<UrlmonUrlRequest>* new_request = NULL;
 986   CComObject<UrlmonUrlRequest>::CreateInstance(&new_request);
 987   if (new_request) {
 988     GURL start_url(url);
 989     DCHECK(start_url.is_valid());
 990     DCHECK(pending_request_ == NULL);
 991
 992     base::win::ScopedComPtr<BindContextInfo> info;
 993     BindContextInfo::FromBindContext(bind_ctx, info.Receive());
 994     DCHECK(info);
 995     IStream* cache = info ? info->cache() : NULL;
 996     pending_request_ = new_request;
 997     pending_request_->InitPending(start_url, moniker, bind_ctx,
 998                                   enable_frame_busting_, privileged_mode_,
 999                                   notification_window_, cache);
1000     // Start the request
1001     bool is_started = pending_request_->Start();
1002     DCHECK(is_started);
1003   }
1004 }
1005
1006 void UrlmonUrlRequestManager::StartRequest(int request_id,
1007     const AutomationURLRequest& request_info) {
1008   DVLOG(1) << __FUNCTION__ << " id: " << request_id;
1009
1010   if (stopping_) {
1011     DLOG(WARNING) << __FUNCTION__ << " request not started (stopping)";
1012     return;
1013   }
1014
1015   DCHECK(request_map_.find(request_id) == request_map_.end());
1016 #ifndef NDEBUG
1017   if (background_worker_thread_enabled_) {
1018     base::AutoLock lock(background_resource_map_lock_);
1019     DCHECK(background_request_map_.find(request_id) ==
1020            background_request_map_.end());
1021   }
1022 #endif  // NDEBUG
1023   DCHECK(GURL(request_info.url).is_valid());
1024
1025   // Non frame requests like sub resources, images, etc are handled on the
1026   // background thread.
1027   if (background_worker_thread_enabled_ &&
1028       !ResourceType::IsFrame(
1029           static_cast<ResourceType::Type>(request_info.resource_type))) {
1030     DLOG(INFO) << "Downloading resource type "
1031                << request_info.resource_type
1032                << " on background thread";
1033     background_thread_->message_loop()->PostTask(
1034         FROM_HERE,
1035         base::Bind(&UrlmonUrlRequestManager::StartRequestHelper,
1036                    base::Unretained(this), request_id, request_info,
1037                    &background_request_map_, &background_resource_map_lock_));
1038     return;
1039   }
1040   StartRequestHelper(request_id, request_info, &request_map_, NULL);
1041 }
1042
1043 void UrlmonUrlRequestManager::StartRequestHelper(
1044     int request_id,
1045     const AutomationURLRequest& request_info,
1046     RequestMap* request_map,
1047     base::Lock* request_map_lock) {
1048   DCHECK(request_map);
1049   scoped_refptr<UrlmonUrlRequest> new_request;
1050   bool is_started = false;
1051   if (pending_request_) {
1052     if (pending_request_->url() != request_info.url) {
1053       DLOG(INFO) << __FUNCTION__
1054                  << "Received url request for url:"
1055                  << request_info.url
1056                  << ". Stopping pending url request for url:"
1057                  << pending_request_->url();
1058       pending_request_->Stop();
1059       pending_request_ = NULL;
1060     } else {
1061       new_request.swap(pending_request_);
1062       is_started = true;
1063       DVLOG(1) << __FUNCTION__ << new_request->me()
1064                << " assigned id " << request_id;
1065     }
1066   }
1067
1068   if (!is_started) {
1069     CComObject<UrlmonUrlRequest>* created_request = NULL;
1070     CComObject<UrlmonUrlRequest>::CreateInstance(&created_request);
1071     new_request = created_request;
1072   }
1073
1074   new_request->Initialize(static_cast<PluginUrlRequestDelegate*>(this),
1075       request_id,
1076       request_info.url,
1077       request_info.method,
1078       request_info.referrer,
1079       request_info.extra_request_headers,
1080       request_info.upload_data,
1081       static_cast<ResourceType::Type>(request_info.resource_type),
1082       enable_frame_busting_,
1083       request_info.load_flags);
1084   new_request->set_parent_window(notification_window_);
1085   new_request->set_privileged_mode(privileged_mode_);
1086
1087   if (request_map_lock)
1088     request_map_lock->Acquire();
1089
1090   (*request_map)[request_id] = new_request;
1091
1092   if (request_map_lock)
1093     request_map_lock->Release();
1094
1095   if (!is_started) {
1096     // Freshly created, start now.
1097     new_request->Start();
1098   } else {
1099     // Request is already underway, call OnResponse so that the
1100     // other side can start reading.
1101     DCHECK(!new_request->response_headers().empty());
1102     new_request->OnResponse(
1103         0, UTF8ToWide(new_request->response_headers()).c_str(), NULL, NULL);
1104   }
1105 }
1106
1107 void UrlmonUrlRequestManager::ReadRequest(int request_id, int bytes_to_read) {
1108   DVLOG(1) << __FUNCTION__ << " id: " << request_id;
1109   // if we fail to find the request in the normal map and the background
1110   // request map, it may mean that the request could have failed with a
1111   // network error.
1112   scoped_refptr<UrlmonUrlRequest> request = LookupRequest(request_id,
1113                                                           &request_map_);
1114   if (request) {
1115     request->Read(bytes_to_read);
1116   } else if (background_worker_thread_enabled_) {
1117     base::AutoLock lock(background_resource_map_lock_);
1118     request = LookupRequest(request_id, &background_request_map_);
1119     if (request) {
1120       background_thread_->message_loop()->PostTask(
1121           FROM_HERE, base::Bind(base::IgnoreResult(&UrlmonUrlRequest::Read),
1122                                 request.get(), bytes_to_read));
1123     }
1124   }
1125   if (!request)
1126     DLOG(ERROR) << __FUNCTION__ << " no request found for " << request_id;
1127 }
1128
1129 void UrlmonUrlRequestManager::DownloadRequestInHost(int request_id) {
1130   DVLOG(1) << __FUNCTION__ << " " << request_id;
1131   if (!IsWindow(notification_window_)) {
1132     NOTREACHED() << "Cannot handle download if we don't have anyone to hand it "
1133                     "to.";
1134     return;
1135   }
1136
1137   scoped_refptr<UrlmonUrlRequest> request(LookupRequest(request_id,
1138                                                         &request_map_));
1139   if (request) {
1140     DownloadRequestInHostHelper(request);
1141   } else if (background_worker_thread_enabled_) {
1142     base::AutoLock lock(background_resource_map_lock_);
1143     request = LookupRequest(request_id, &background_request_map_);
1144     if (request) {
1145       background_thread_->message_loop()->PostTask(
1146           FROM_HERE,
1147           base::Bind(&UrlmonUrlRequestManager::DownloadRequestInHostHelper,
1148                      base::Unretained(this), request.get()));
1149     }
1150   }
1151   if (!request)
1152     DLOG(ERROR) << __FUNCTION__ << " no request found for " << request_id;
1153 }
1154
1155 void UrlmonUrlRequestManager::DownloadRequestInHostHelper(
1156     UrlmonUrlRequest* request) {
1157   DCHECK(request);
1158   UrlmonUrlRequest::TerminateBindCallback callback =
1159       base::Bind(&UrlmonUrlRequestManager::BindTerminated,
1160                  base::Unretained(this));
1161   request->TerminateBind(callback);
1162 }
1163
1164 void UrlmonUrlRequestManager::BindTerminated(IMoniker* moniker,
1165                                              IBindCtx* bind_ctx,
1166                                              IStream* post_data,
1167                                              const char* request_headers) {
1168   DownloadInHostParams* download_params = new DownloadInHostParams;
1169   download_params->bind_ctx = bind_ctx;
1170   download_params->moniker = moniker;
1171   download_params->post_data = post_data;
1172   if (request_headers) {
1173     download_params->request_headers = request_headers;
1174   }
1175   ::PostMessage(notification_window_, WM_DOWNLOAD_IN_HOST,
1176         reinterpret_cast<WPARAM>(download_params), 0);
1177 }
1178
1179 void UrlmonUrlRequestManager::GetCookiesForUrl(const GURL& url, int cookie_id) {
1180   DWORD cookie_size = 0;
1181   bool success = true;
1182   std::string cookie_string;
1183
1184   int32 cookie_action = COOKIEACTION_READ;
1185   BOOL result = InternetGetCookieA(url.spec().c_str(), NULL, NULL,
1186                                    &cookie_size);
1187   DWORD error = 0;
1188   if (cookie_size) {
1189     scoped_array<char> cookies(new char[cookie_size + 1]);
1190     if (!InternetGetCookieA(url.spec().c_str(), NULL, cookies.get(),
1191                             &cookie_size)) {
1192       success = false;
1193       error = GetLastError();
1194       NOTREACHED() << "InternetGetCookie failed. Error: " << error;
1195     } else {
1196       cookie_string = cookies.get();
1197     }
1198   } else {
1199     success = false;
1200     error = GetLastError();
1201     DVLOG(1) << "InternetGetCookie failed. Error: " << error;
1202   }
1203
1204   OnCookiesRetrieved(success, url, cookie_string, cookie_id);
1205   if (!success && !error)
1206     cookie_action = COOKIEACTION_SUPPRESS;
1207
1208   AddPrivacyDataForUrl(url.spec(), "", cookie_action);
1209 }
1210
1211 void UrlmonUrlRequestManager::SetCookiesForUrl(const GURL& url,
1212                                                const std::string& cookie) {
1213   DCHECK(container_);
1214   // Grab a reference on the container to ensure that we don't get destroyed in
1215   // case the InternetSetCookie call below puts up a dialog box, which can
1216   // happen if the cookie policy is set to prompt.
1217   if (container_) {
1218     container_->AddRef();
1219   }
1220
1221   InternetCookieState cookie_state = static_cast<InternetCookieState>(
1222       InternetSetCookieExA(url.spec().c_str(), NULL, cookie.c_str(),
1223                            INTERNET_COOKIE_EVALUATE_P3P, NULL));
1224
1225   int32 cookie_action = MapCookieStateToCookieAction(cookie_state);
1226   AddPrivacyDataForUrl(url.spec(), "", cookie_action);
1227
1228   if (container_) {
1229     container_->Release();
1230   }
1231 }
1232
1233 void UrlmonUrlRequestManager::EndRequest(int request_id) {
1234   DVLOG(1) << __FUNCTION__ << " id: " << request_id;
1235   scoped_refptr<UrlmonUrlRequest> request = LookupRequest(request_id,
1236                                                           &request_map_);
1237   if (request) {
1238     request_map_.erase(request_id);
1239     request->Stop();
1240   } else if (background_worker_thread_enabled_) {
1241     base::AutoLock lock(background_resource_map_lock_);
1242     request = LookupRequest(request_id, &background_request_map_);
1243     if (request) {
1244       background_request_map_.erase(request_id);
1245       background_thread_->message_loop()->PostTask(
1246           FROM_HERE, base::Bind(&UrlmonUrlRequest::Stop, request.get()));
1247     }
1248   }
1249   if (!request)
1250     DLOG(ERROR) << __FUNCTION__ << " no request found for " << request_id;
1251 }
1252
1253 void UrlmonUrlRequestManager::StopAll() {
1254   DVLOG(1) << __FUNCTION__;
1255   if (stopping_)
1256     return;
1257
1258   stopping_ = true;
1259
1260   DVLOG(1) << __FUNCTION__ << " stopping " << request_map_.size()
1261            << " requests";
1262
1263   StopAllRequestsHelper(&request_map_, NULL);
1264
1265   if (background_worker_thread_enabled_) {
1266     DCHECK(background_thread_.get());
1267     background_thread_->message_loop()->PostTask(
1268         FROM_HERE, base::Bind(&UrlmonUrlRequestManager::StopAllRequestsHelper,
1269                               base::Unretained(this), &background_request_map_,
1270                               &background_resource_map_lock_));
1271     background_thread_->Stop();
1272     background_thread_.reset();
1273   }
1274 }
1275
1276 void UrlmonUrlRequestManager::StopAllRequestsHelper(
1277     RequestMap* request_map,
1278     base::Lock* request_map_lock) {
1279   DCHECK(request_map);
1280
1281   DVLOG(1) << __FUNCTION__ << " stopping " << request_map->size()
1282            << " requests";
1283
1284   if (request_map_lock)
1285     request_map_lock->Acquire();
1286
1287   for (RequestMap::iterator it = request_map->begin();
1288        it != request_map->end(); ++it) {
1289     DCHECK(it->second != NULL);
1290     it->second->Stop();
1291   }
1292   request_map->clear();
1293
1294   if (request_map_lock)
1295     request_map_lock->Release();
1296 }
1297
1298 void UrlmonUrlRequestManager::OnResponseStarted(int request_id,
1299     const char* mime_type, const char* headers, int size,
1300     base::Time last_modified, const std::string& redirect_url,
1301     int redirect_status, const net::HostPortPair& socket_address) {
1302   DCHECK_NE(request_id, -1);
1303   DVLOG(1) << __FUNCTION__;
1304
1305 #ifndef NDEBUG
1306   scoped_refptr<UrlmonUrlRequest> request = LookupRequest(request_id,
1307                                                           &request_map_);
1308   if (request == NULL && background_worker_thread_enabled_) {
1309     base::AutoLock lock(background_resource_map_lock_);
1310     request = LookupRequest(request_id, &background_request_map_);
1311   }
1312   DCHECK(request != NULL);
1313 #endif  // NDEBUG
1314   delegate_->OnResponseStarted(request_id, mime_type, headers, size,
1315       last_modified, redirect_url, redirect_status, socket_address);
1316 }
1317
1318 void UrlmonUrlRequestManager::OnReadComplete(int request_id,
1319                                              const std::string& data) {
1320   DCHECK_NE(request_id, -1);
1321   DVLOG(1) << __FUNCTION__ << " id: " << request_id;
1322 #ifndef NDEBUG
1323   scoped_refptr<UrlmonUrlRequest> request = LookupRequest(request_id,
1324                                                           &request_map_);
1325   if (request == NULL && background_worker_thread_enabled_) {
1326     base::AutoLock lock(background_resource_map_lock_);
1327     request = LookupRequest(request_id, &background_request_map_);
1328   }
1329   DCHECK(request != NULL);
1330 #endif  // NDEBUG
1331   delegate_->OnReadComplete(request_id, data);
1332   DVLOG(1) << __FUNCTION__ << " done id: " << request_id;
1333 }
1334
1335 void UrlmonUrlRequestManager::OnResponseEnd(
1336     int request_id,
1337     const net::URLRequestStatus& status) {
1338   DCHECK_NE(request_id, -1);
1339   DVLOG(1) << __FUNCTION__;
1340   DCHECK(status.status() != net::URLRequestStatus::CANCELED);
1341   RequestMap::size_type erased_count = request_map_.erase(request_id);
1342   if (erased_count != 1u && background_worker_thread_enabled_) {
1343     base::AutoLock lock(background_resource_map_lock_);
1344     erased_count = background_request_map_.erase(request_id);
1345     if (erased_count != 1u) {
1346       DLOG(WARNING) << __FUNCTION__
1347                     << " Failed to find request id:"
1348                     << request_id;
1349     }
1350   }
1351   delegate_->OnResponseEnd(request_id, status);
1352 }
1353
1354 void UrlmonUrlRequestManager::OnCookiesRetrieved(bool success, const GURL& url,
1355     const std::string& cookie_string, int cookie_id) {
1356   DCHECK(url.is_valid());
1357   delegate_->OnCookiesRetrieved(success, url, cookie_string, cookie_id);
1358 }
1359
1360 scoped_refptr<UrlmonUrlRequest> UrlmonUrlRequestManager::LookupRequest(
1361     int request_id, RequestMap* request_map) {
1362   RequestMap::iterator it = request_map->find(request_id);
1363   if (request_map->end() != it)
1364     return it->second;
1365   return NULL;
1366 }
1367
1368 UrlmonUrlRequestManager::UrlmonUrlRequestManager()
1369     : stopping_(false), notification_window_(NULL),
1370       privileged_mode_(false),
1371       container_(NULL),
1372       background_worker_thread_enabled_(true) {
1373   background_thread_.reset(new ResourceFetcherThread(
1374       "cf_iexplore_background_thread"));
1375   background_worker_thread_enabled_ =
1376       GetConfigBool(true, kUseBackgroundThreadForSubResources);
1377   if (background_worker_thread_enabled_) {
1378     base::Thread::Options options;
1379     options.message_loop_type = MessageLoop::TYPE_UI;
1380     background_thread_->StartWithOptions(options);
1381   }
1382 }
1383
1384 UrlmonUrlRequestManager::~UrlmonUrlRequestManager() {
1385   StopAll();
1386 }
1387
1388 void UrlmonUrlRequestManager::AddPrivacyDataForUrl(
1389     const std::string& url, const std::string& policy_ref,
1390     int32 flags) {
1391   DCHECK(!url.empty());
1392
1393   bool fire_privacy_event = false;
1394
1395   if (privacy_info_.privacy_records.empty())
1396     flags |= PRIVACY_URLISTOPLEVEL;
1397
1398   if (!privacy_info_.privacy_impacted) {
1399     if (flags & (COOKIEACTION_ACCEPT | COOKIEACTION_REJECT |
1400                  COOKIEACTION_DOWNGRADE)) {
1401       privacy_info_.privacy_impacted = true;
1402       fire_privacy_event = true;
1403     }
1404   }
1405
1406   PrivacyInfo::PrivacyEntry& privacy_entry =
1407       privacy_info_.privacy_records[UTF8ToWide(url)];
1408
1409   privacy_entry.flags |= flags;
1410   privacy_entry.policy_ref = UTF8ToWide(policy_ref);
1411
1412   if (fire_privacy_event && IsWindow(notification_window_)) {
1413     PostMessage(notification_window_, WM_FIRE_PRIVACY_CHANGE_NOTIFICATION, 1,
1414                 0);
1415   }
1416 }
1417
1418 UrlmonUrlRequestManager::ResourceFetcherThread::ResourceFetcherThread(
1419     const char* name) : base::Thread(name) {
1420 }
1421
1422 UrlmonUrlRequestManager::ResourceFetcherThread::~ResourceFetcherThread() {
1423   Stop();
1424 }
1425
1426 void UrlmonUrlRequestManager::ResourceFetcherThread::Init() {
1427   CoInitialize(NULL);
1428 }
1429
1430 void UrlmonUrlRequestManager::ResourceFetcherThread::CleanUp() {
1431   CoUninitialize();
1432 }