Add hooks to content to request permission to connect to the PPAPI broker.

content/renderer/pepper/pepper_plugin_delegate_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/pepper_plugin_delegate_impl.h"
 
 #include <cmath>
 #include <cstddef>
 #include <map>
 #include <queue>
@@ skipping 395 matching lines @@
   const FilePath& broker_path = plugin_module->path();
 
   scoped_refptr<PepperBrokerImpl> broker =
       new PepperBrokerImpl(plugin_module, this);
 
   int request_id =
       pending_connect_broker_.Add(new scoped_refptr<PepperBrokerImpl>(broker));
 
   // Have the browser start the broker process for us.
   IPC::Message* msg =
       new ViewHostMsg_OpenChannelToPpapiBroker(render_view_->routing_id(),

[ddorwin, 2012/08/12 22:51:16]

Ideally, this would cause the user prompt. Instantiating the broker process and
providing a channel to it is the most important thing security-wise. After that,
a compromised renderer can bypass the checks for individual instances. IIRC, we
might need to eliminate this channel and send all traffic for all connects
through the browser.

[Bernhard Bauer, 2012/08/13 09:02:12]

I guess that would mean using a new channel for every broker connection (like we
do for NPAPI plug-in channels) instead of using a single broker channel for the
PluginModule?

[ddorwin, 2012/08/13 22:27:04]

You would need to somehow be able to refcount the uses of the broker. This could
be accomplished with a channel, though I don't think it would be used for
anything since the pipe would be returned at the same time.

                                                request_id,
                                                broker_path);
   if (!render_view_->Send(msg)) {
     pending_connect_broker_.Remove(request_id);
     return scoped_refptr<PepperBrokerImpl>();
   }
 
   return broker;
 }
 
@@ skipping 21 matching lines @@
 // the raw pointer to the broker. Assumes maximum of one copy of broker exists.
 bool PepperPluginDelegateImpl::StopWaitingForBrokerConnection(
     PepperBrokerImpl* broker) {
   for (BrokerMap::iterator i(&pending_connect_broker_);
        !i.IsAtEnd(); i.Advance()) {
     if (i.GetCurrentValue()->get() == broker) {
       pending_connect_broker_.Remove(i.GetCurrentKey());
       return true;
     }
   }
+
   return false;
 }
 
 void PepperPluginDelegateImpl::ViewWillInitiatePaint() {
   // Notify all of our instances that we started painting. This is used for
   // internal bookkeeping only, so we know that the set can not change under
   // us.
   for (std::set<webkit::ppapi::PluginInstance*>::iterator i =
            active_instances_.begin();
        i != active_instances_.end(); ++i)
@@ skipping 313 matching lines @@
       AsWeakPtr(), device_id, static_cast<int>(sample_rate),
       static_cast<int>(sample_count), client);
 }
 
 // If a broker has not already been created for this plugin, creates one.
 webkit::ppapi::PluginDelegate::Broker*
 PepperPluginDelegateImpl::ConnectToBroker(
     webkit::ppapi::PPB_Broker_Impl* client) {
   DCHECK(client);
 
-  // If a broker needs to be created, this will ensure it does not get deleted
-  // before Connect() adds a reference.
-  scoped_refptr<PepperBrokerImpl> broker_impl;
-
   webkit::ppapi::PluginModule* plugin_module =
       webkit::ppapi::ResourceHelper::GetPluginModule(client);
   if (!plugin_module)
     return NULL;
 
-  webkit::ppapi::PluginDelegate::Broker* broker = plugin_module->GetBroker();
-  if (!broker) {
-    broker_impl = CreateBroker(plugin_module);
-    if (!broker_impl.get())
+  scoped_refptr<PepperBrokerImpl> broker =
+      static_cast<PepperBrokerImpl*>(plugin_module->GetBroker());
+  if (!broker.get()) {
+    broker = CreateBroker(plugin_module);
+    if (!broker.get())
       return NULL;
-    broker = broker_impl;
   }
 
-  // Adds a reference, ensuring not deleted when broker_impl goes out of scope.
+  int request_id = pending_permission_requests_.Add(
+      new base::WeakPtr<webkit::ppapi::PPB_Broker_Impl>(client->AsWeakPtr()));
+  if (!render_view_->Send(
+          new ViewHostMsg_RequestPpapiBrokerPermission(

[ddorwin, 2012/08/12 22:51:16]

Ideally, this would instantiate the broker if necessary and create the
broker-instance pipe. This would enforce user permissions.
Also, since the path below can be faked, combining this with the current
ViewHostMsg_OpenChannelToPpapiBroker functionality in the browser would ensure
that the real path being instantiated is shown.

+              render_view_->routing_id(),
+              request_id,
+              client->GetDocumentUrl(),
+              plugin_module->path()))) {
+    return NULL;
+  }
+
+  // Adds a reference, ensuring that the broker is not deleted when
+  // |broker| goes out of scope.
   broker->Connect(client);
+
   return broker;
 }
 
+void PepperPluginDelegateImpl::OnPpapiBrokerPermissionResult(
+    int request_id,
+    bool result) {
+  base::WeakPtr<webkit::ppapi::PPB_Broker_Impl> client =
+      *(pending_permission_requests_.Lookup(request_id));
+  if (client) {
+    webkit::ppapi::PluginModule* plugin_module =
+        webkit::ppapi::ResourceHelper::GetPluginModule(client);
+    PepperBrokerImpl* broker =
+        static_cast<PepperBrokerImpl*>(plugin_module->GetBroker());
+    broker->OnBrokerPermissionResult(client, result);
+  }
+
+  pending_permission_requests_.Remove(request_id);
+}
+
 bool PepperPluginDelegateImpl::AsyncOpenFile(
     const FilePath& path,
     int flags,
     const AsyncOpenFileCallback& callback) {
   int message_id = pending_async_open_files_.Add(
       new AsyncOpenFileCallback(callback));
   IPC::Message* msg = new ViewHostMsg_AsyncOpenFile(
       render_view_->routing_id(), path, flags, message_id);
   return render_view_->Send(msg);
 }
@@ skipping 954 matching lines @@
   else
     return render_view_->mouse_lock_dispatcher();
 }
 
 webkit_glue::ClipboardClient*
     PepperPluginDelegateImpl::CreateClipboardClient() const {
   return new RendererClipboardClient;
 }
 
 }  // namespace content