Use extensions socket permission for TCP/UDP socket APIs in Pepper

chrome/browser/chrome_content_browser_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chrome_content_browser_client.h"
 
 #include <set>
 #include <utility>
 #include <vector>
 
@@ skipping 60 matching lines @@
 #include "chrome/browser/ui/webui/chrome_web_ui_controller_factory.h"
 #include "chrome/browser/user_style_sheet_watcher.h"
 #include "chrome/browser/user_style_sheet_watcher_factory.h"
 #include "chrome/browser/view_type_utils.h"
 #include "chrome/common/child_process_logging.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_process_policy.h"
 #include "chrome/common/extensions/extension_set.h"
+#include "chrome/common/extensions/permissions/socket_permission.h"
 #include "chrome/common/logging_chrome.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/url_constants.h"
 #include "content/public/browser/browser_child_process_host.h"
 #include "content/public/browser/browser_main_parts.h"
 #include "content/public/browser/browser_ppapi_host.h"
 #include "content/public/browser/browser_url_handler.h"
 #include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/render_process_host.h"
@@ skipping 1587 matching lines @@
 }
 
 void ChromeContentBrowserClient::DidCreatePpapiPlugin(
     content::BrowserPpapiHost* browser_host) {
   browser_host->GetPpapiHost()->AddHostFactoryFilter(
       scoped_ptr<ppapi::host::HostFactory>(
           new ChromeBrowserPepperHostFactory(browser_host)));
 }
 
 bool ChromeContentBrowserClient::AllowPepperSocketAPI(
-    content::BrowserContext* browser_context, const GURL& url) {
+    content::BrowserContext* browser_context,
+    const GURL& url,
+    const SocketPermissionParam& params) {
   if (!url.is_valid())
     return false;
 
   std::string host = url.host();
   if (url.SchemeIs(kExtensionScheme) && allowed_socket_origins_.count(host))
     return true;
 
   Profile* profile = Profile::FromBrowserContext(browser_context);
   const Extension* extension = NULL;
   if (profile && profile->GetExtensionService()) {
@@ skipping 15 matching lines @@
     StringTokenizer t(allowed_list, ",");
     while (t.GetNext()) {
       if (t.token() == host)
         return true;
     }
   }
 
   if (!extension)
     return false;
 
-  if (extension->HasAPIPermission(APIPermission::kSocket))
+  extensions::SocketPermissionData::OperationType type =
+      extensions::SocketPermissionData::NONE;
+  switch (params.type) {
+    case SocketPermissionParam::TCP_CONNECT:
+      type = extensions::SocketPermissionData::TCP_CONNECT;
+      break;
+
+    case SocketPermissionParam::TCP_LISTEN:
+      type = extensions::SocketPermissionData::TCP_LISTEN;
+      break;
+
+    case SocketPermissionParam::UDP_BIND:
+      type = extensions::SocketPermissionData::UDP_BIND;
+      break;
+
+    case SocketPermissionParam::UDP_SEND_TO:
+      type = extensions::SocketPermissionData::UDP_SEND_TO;
+      break;
+
+    default:
+      NOTREACHED();
+  }

[miket_OOO, 2012/10/05 18:46:02]

This block seems like it could be a generally useful utility function.

[Dmitry Polukhin, 2012/10/08 09:50:35]

Done.

+
+  extensions::SocketPermission::CheckParam extension_params(
+      type, params.host, params.port);
+  if (extension->CheckAPIPermissionWithParam(APIPermission::kSocket,
+                                             &extension_params))
     return true;
 
   return false;
 }
 
 bool ChromeContentBrowserClient::AllowPepperPrivateFileAPI() {
   return CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kPpapiFlashInProcess);
 }
 
@@ skipping 63 matching lines @@
     partition_id = extension->id();
   }
 
   // Enforce that IsValidStoragePartitionId() implementation stays in sync.
   DCHECK(IsValidStoragePartitionId(browser_context, partition_id));
   return partition_id;
 }
 
 
 }  // namespace chrome