OLD | NEW |
| (Empty) |
1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef CHROME_BROWSER_RENDERER_HOST_RENDERER_SECURITY_POLICY_H_ | |
6 #define CHROME_BROWSER_RENDERER_HOST_RENDERER_SECURITY_POLICY_H_ | |
7 | |
8 #include <string> | |
9 #include <map> | |
10 #include <set> | |
11 | |
12 #include "base/basictypes.h" | |
13 #include "base/file_path.h" | |
14 #include "base/lock.h" | |
15 #include "base/singleton.h" | |
16 | |
17 class FilePath; | |
18 class GURL; | |
19 | |
20 // The RendererSecurityPolicy class is used to grant and revoke security | |
21 // capabilities for renderers. For example, it restricts whether a renderer | |
22 // is permmitted to loaded file:// URLs based on whether the renderer has ever | |
23 // been commanded to load file:// URLs by the browser. | |
24 // | |
25 // RendererSecurityPolicy is a singleton that may be used on any thread. | |
26 // | |
27 class RendererSecurityPolicy { | |
28 public: | |
29 // Object can only be created through GetInstance() so the constructor is | |
30 // private. | |
31 ~RendererSecurityPolicy(); | |
32 | |
33 // There is one global RendererSecurityPolicy object for the entire browser | |
34 // processes. The object returned by this method may be accessed on any | |
35 // thread. | |
36 static RendererSecurityPolicy* GetInstance(); | |
37 | |
38 // Web-safe schemes can be requested by any renderer. Once a web-safe scheme | |
39 // has been registered, any renderer processes can request URLs with that | |
40 // scheme. There is no mechanism for revoking web-safe schemes. | |
41 void RegisterWebSafeScheme(const std::string& scheme); | |
42 | |
43 // Returns true iff |scheme| has been registered as a web-safe scheme. | |
44 bool IsWebSafeScheme(const std::string& scheme); | |
45 | |
46 // Pseudo schemes are treated differently than other schemes because they | |
47 // cannot be requested like normal URLs. There is no mechanism for revoking | |
48 // pseudo schemes. | |
49 void RegisterPseudoScheme(const std::string& scheme); | |
50 | |
51 // Returns true iff |scheme| has been registered as pseudo scheme. | |
52 bool IsPseudoScheme(const std::string& scheme); | |
53 | |
54 // Upon creation, render processes should register themselves by calling this | |
55 // this method exactly once. | |
56 void Add(int renderer_id); | |
57 | |
58 // Upon destruction, render processess should unregister themselves by caling | |
59 // this method exactly once. | |
60 void Remove(int renderer_id); | |
61 | |
62 // Whenever the browser processes commands the renderer to request a URL, it | |
63 // should call this method to grant the renderer process the capability to | |
64 // request the URL. | |
65 void GrantRequestURL(int renderer_id, const GURL& url); | |
66 | |
67 // Whenever the user picks a file from a <input type="file"> element, the | |
68 // browser should call this function to grant the renderer the capability to | |
69 // upload the file to the web. | |
70 void GrantUploadFile(int renderer_id, const FilePath& file); | |
71 | |
72 // Whenever the browser processes commands the renderer to run web inspector, | |
73 // it should call this method to grant the renderer process the capability to | |
74 // run the inspector. | |
75 void GrantInspectElement(int renderer_id); | |
76 | |
77 // Grant this renderer the ability to use DOM UI Bindings. | |
78 void GrantDOMUIBindings(int renderer_id); | |
79 | |
80 // Before servicing a renderer's request for a URL, the browser should call | |
81 // this method to determine whether the renderer has the capability to | |
82 // request the URL. | |
83 bool CanRequestURL(int renderer_id, const GURL& url); | |
84 | |
85 // Before servicing a renderer's request to upload a file to the web, the | |
86 // browser should call this method to determine whether the renderer has the | |
87 // capability to upload the requested file. | |
88 bool CanUploadFile(int renderer_id, const FilePath& file); | |
89 | |
90 // Returns true of the specified renderer_id has been granted DOMUIBindings. | |
91 // The browser should check this property before assuming the renderer is | |
92 // allowed to use DOMUIBindings. | |
93 bool HasDOMUIBindings(int renderer_id); | |
94 | |
95 private: | |
96 class SecurityState; | |
97 | |
98 typedef std::set<std::string> SchemeSet; | |
99 typedef std::map<int, SecurityState*> SecurityStateMap; | |
100 | |
101 // Obtain an instance of RendererSecurityPolicy via GetInstance(). | |
102 RendererSecurityPolicy(); | |
103 friend struct DefaultSingletonTraits<RendererSecurityPolicy>; | |
104 | |
105 // You must acquire this lock before reading or writing any members of this | |
106 // class. You must not block while holding this lock. | |
107 Lock lock_; | |
108 | |
109 // These schemes are white-listed for all renderers. This set is protected | |
110 // by |lock_|. | |
111 SchemeSet web_safe_schemes_; | |
112 | |
113 // These schemes do not actually represent retrievable URLs. For example, | |
114 // the the URLs in the "about" scheme are aliases to other URLs. This set is | |
115 // protected by |lock_|. | |
116 SchemeSet pseudo_schemes_; | |
117 | |
118 // This map holds a SecurityState for each renderer process. The key for the | |
119 // map is the ID of the RenderProcessHost. The SecurityState objects are | |
120 // owned by this object and are protected by |lock_|. References to them must | |
121 // not escape this class. | |
122 SecurityStateMap security_state_; | |
123 | |
124 DISALLOW_COPY_AND_ASSIGN(RendererSecurityPolicy); | |
125 }; | |
126 | |
127 #endif // CHROME_BROWSER_RENDERER_HOST_RENDERER_SECURITY_POLICY_H_ | |
OLD | NEW |