Issue 1562 - Improve detecting of XmlHttmlRequest requests

src/plugin/PluginWbPassThrough.cpp

Index: src/plugin/PluginWbPassThrough.cpp
===================================================================
--- a/src/plugin/PluginWbPassThrough.cpp
+++ b/src/plugin/PluginWbPassThrough.cpp
@@ -20,21 +20,21 @@
         "</body>"
     "</html>";
 
-  template <class T>
-  T ExtractHttpHeader(const T& allHeaders, const T& targetHeaderNameWithColon, const T& delimiter)
-  {
-    auto targetHeaderBeginsAt = allHeaders.find(targetHeaderNameWithColon);
-    if (targetHeaderBeginsAt == T::npos)
-    {
-      return T();
-    }
-    targetHeaderBeginsAt += targetHeaderNameWithColon.length();
-    auto targetHeaderEndsAt = allHeaders.find(delimiter, targetHeaderBeginsAt);
-    if (targetHeaderEndsAt == T::npos)
-    {
-      return T();
-    }
-    return allHeaders.substr(targetHeaderBeginsAt, targetHeaderEndsAt - targetHeaderBeginsAt);
+  template <class T>
+  T ExtractHttpHeader(const T& allHeaders, const T& targetHeaderNameWithColon, const T& delimiter)
+  {
+    auto targetHeaderBeginsAt = allHeaders.find(targetHeaderNameWithColon);
+    if (targetHeaderBeginsAt == T::npos)
+    {
+      return T();
+    }
+    targetHeaderBeginsAt += targetHeaderNameWithColon.length();
+    auto targetHeaderEndsAt = allHeaders.find(delimiter, targetHeaderBeginsAt);
+    if (targetHeaderEndsAt == T::npos)
+    {
+      return T();
+    }
+    return allHeaders.substr(targetHeaderBeginsAt, targetHeaderEndsAt - targetHeaderBeginsAt);
   }
 
   std::string ExtractHttpAcceptHeader(IInternetProtocol* internetProtocol)
@@ -63,6 +63,18 @@
     }
     return ExtractHttpHeader<std::string>(buf, "Accept:", "\r\n");
   }
+
+  bool IsXmlHttpRequest(const std::wstring& additionalHeaders)
+  {
+    auto requestedWithHeader = ExtractHttpHeader<std::wstring>(additionalHeaders, L"X-Requested-With:", L"\n");
+    if(TrimString(requestedWithHeader) == L"XMLHttpRequest")
+    {
+      return true;
+    }
+    // CORS
+    auto originHeader = ExtractHttpHeader<std::wstring>(additionalHeaders, L"Origin:", L"\n");
+    return !TrimString(originHeader).empty();
+  }
 }
 
 WBPassthruSink::WBPassthruSink()
@@ -289,34 +301,39 @@
   // There doesn't seem to be any other way to get this header before the request has been made.
   HRESULT nativeHr = httpNegotiate ? httpNegotiate->BeginningTransaction(szURL, szHeaders, dwReserved, pszAdditionalHeaders) : S_OK;
 
-  if (pszAdditionalHeaders && *pszAdditionalHeaders)
-  {
-    m_boundDomain = ExtractHttpHeader<std::wstring>(*pszAdditionalHeaders, L"Referer:", L"\n");
-  }
+  if (pszAdditionalHeaders && *pszAdditionalHeaders)
+  {
+    m_boundDomain = ExtractHttpHeader<std::wstring>(*pszAdditionalHeaders, L"Referer:", L"\n");
+  }
   m_boundDomain = TrimString(m_boundDomain);
   CPluginTab* tab = CPluginClass::GetTab(::GetCurrentThreadId());
   CPluginClient* client = CPluginClient::GetInstance();
 
-  if (tab && client)
-  {
-    CString documentUrl = tab->GetDocumentUrl();
-    // Page is identical to document => don't block
-    if (documentUrl == ToCString(src))
-    {
-      return nativeHr;
-    }
-    else if (CPluginSettings::GetInstance()->IsPluginEnabled() && !client->IsWhitelistedUrl(std::wstring(documentUrl)))
-    {
-      if (tab->IsFrameCached(ToCString(src)))
-      {
-        m_contentType = CFilter::contentTypeSubdocument;
-      }
-    }
+  if (tab && client)
+  {
+    CString documentUrl = tab->GetDocumentUrl();
+    // Page is identical to document => don't block
+    if (documentUrl == ToCString(src))
+    {
+      return nativeHr;
+    }
+    else if (CPluginSettings::GetInstance()->IsPluginEnabled() && !client->IsWhitelistedUrl(std::wstring(documentUrl)))
+    {
+      if (tab->IsFrameCached(ToCString(src)))
+      {
+        m_contentType = CFilter::contentTypeSubdocument;
+      }
+    }
   }
 
   if (IsFlashRequest(pszAdditionalHeaders))
   {
-    m_contentType = CFilter::EContentType::contentTypeObjectSubrequest; 
+    m_contentType = CFilter::EContentType::contentTypeObjectSubrequest;
+  }
+
+  if (pszAdditionalHeaders && IsXmlHttpRequest(*pszAdditionalHeaders))
+  {
+    m_contentType = CFilter::EContentType::contentTypeXmlHttpRequest;
   }
 
   m_blockedInTransaction = client->ShouldBlock(szURL, m_contentType, m_boundDomain, /*debug flag but must be set*/true);