| OLD | NEW |
| (Empty) |
| 1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #ifndef CHROME_BROWSER_RENDERER_HOST_RENDERER_SECURITY_POLICY_H_ | |
| 6 #define CHROME_BROWSER_RENDERER_HOST_RENDERER_SECURITY_POLICY_H_ | |
| 7 | |
| 8 #include <string> | |
| 9 #include <map> | |
| 10 #include <set> | |
| 11 | |
| 12 #include "base/basictypes.h" | |
| 13 #include "base/file_path.h" | |
| 14 #include "base/lock.h" | |
| 15 #include "base/singleton.h" | |
| 16 | |
| 17 class FilePath; | |
| 18 class GURL; | |
| 19 | |
| 20 // The RendererSecurityPolicy class is used to grant and revoke security | |
| 21 // capabilities for renderers. For example, it restricts whether a renderer | |
| 22 // is permmitted to loaded file:// URLs based on whether the renderer has ever | |
| 23 // been commanded to load file:// URLs by the browser. | |
| 24 // | |
| 25 // RendererSecurityPolicy is a singleton that may be used on any thread. | |
| 26 // | |
| 27 class RendererSecurityPolicy { | |
| 28 public: | |
| 29 // Object can only be created through GetInstance() so the constructor is | |
| 30 // private. | |
| 31 ~RendererSecurityPolicy(); | |
| 32 | |
| 33 // There is one global RendererSecurityPolicy object for the entire browser | |
| 34 // processes. The object returned by this method may be accessed on any | |
| 35 // thread. | |
| 36 static RendererSecurityPolicy* GetInstance(); | |
| 37 | |
| 38 // Web-safe schemes can be requested by any renderer. Once a web-safe scheme | |
| 39 // has been registered, any renderer processes can request URLs with that | |
| 40 // scheme. There is no mechanism for revoking web-safe schemes. | |
| 41 void RegisterWebSafeScheme(const std::string& scheme); | |
| 42 | |
| 43 // Returns true iff |scheme| has been registered as a web-safe scheme. | |
| 44 bool IsWebSafeScheme(const std::string& scheme); | |
| 45 | |
| 46 // Pseudo schemes are treated differently than other schemes because they | |
| 47 // cannot be requested like normal URLs. There is no mechanism for revoking | |
| 48 // pseudo schemes. | |
| 49 void RegisterPseudoScheme(const std::string& scheme); | |
| 50 | |
| 51 // Returns true iff |scheme| has been registered as pseudo scheme. | |
| 52 bool IsPseudoScheme(const std::string& scheme); | |
| 53 | |
| 54 // Upon creation, render processes should register themselves by calling this | |
| 55 // this method exactly once. | |
| 56 void Add(int renderer_id); | |
| 57 | |
| 58 // Upon destruction, render processess should unregister themselves by caling | |
| 59 // this method exactly once. | |
| 60 void Remove(int renderer_id); | |
| 61 | |
| 62 // Whenever the browser processes commands the renderer to request a URL, it | |
| 63 // should call this method to grant the renderer process the capability to | |
| 64 // request the URL. | |
| 65 void GrantRequestURL(int renderer_id, const GURL& url); | |
| 66 | |
| 67 // Whenever the user picks a file from a <input type="file"> element, the | |
| 68 // browser should call this function to grant the renderer the capability to | |
| 69 // upload the file to the web. | |
| 70 void GrantUploadFile(int renderer_id, const FilePath& file); | |
| 71 | |
| 72 // Whenever the browser processes commands the renderer to run web inspector, | |
| 73 // it should call this method to grant the renderer process the capability to | |
| 74 // run the inspector. | |
| 75 void GrantInspectElement(int renderer_id); | |
| 76 | |
| 77 // Grant this renderer the ability to use DOM UI Bindings. | |
| 78 void GrantDOMUIBindings(int renderer_id); | |
| 79 | |
| 80 // Before servicing a renderer's request for a URL, the browser should call | |
| 81 // this method to determine whether the renderer has the capability to | |
| 82 // request the URL. | |
| 83 bool CanRequestURL(int renderer_id, const GURL& url); | |
| 84 | |
| 85 // Before servicing a renderer's request to upload a file to the web, the | |
| 86 // browser should call this method to determine whether the renderer has the | |
| 87 // capability to upload the requested file. | |
| 88 bool CanUploadFile(int renderer_id, const FilePath& file); | |
| 89 | |
| 90 // Returns true of the specified renderer_id has been granted DOMUIBindings. | |
| 91 // The browser should check this property before assuming the renderer is | |
| 92 // allowed to use DOMUIBindings. | |
| 93 bool HasDOMUIBindings(int renderer_id); | |
| 94 | |
| 95 private: | |
| 96 class SecurityState; | |
| 97 | |
| 98 typedef std::set<std::string> SchemeSet; | |
| 99 typedef std::map<int, SecurityState*> SecurityStateMap; | |
| 100 | |
| 101 // Obtain an instance of RendererSecurityPolicy via GetInstance(). | |
| 102 RendererSecurityPolicy(); | |
| 103 friend struct DefaultSingletonTraits<RendererSecurityPolicy>; | |
| 104 | |
| 105 // You must acquire this lock before reading or writing any members of this | |
| 106 // class. You must not block while holding this lock. | |
| 107 Lock lock_; | |
| 108 | |
| 109 // These schemes are white-listed for all renderers. This set is protected | |
| 110 // by |lock_|. | |
| 111 SchemeSet web_safe_schemes_; | |
| 112 | |
| 113 // These schemes do not actually represent retrievable URLs. For example, | |
| 114 // the the URLs in the "about" scheme are aliases to other URLs. This set is | |
| 115 // protected by |lock_|. | |
| 116 SchemeSet pseudo_schemes_; | |
| 117 | |
| 118 // This map holds a SecurityState for each renderer process. The key for the | |
| 119 // map is the ID of the RenderProcessHost. The SecurityState objects are | |
| 120 // owned by this object and are protected by |lock_|. References to them must | |
| 121 // not escape this class. | |
| 122 SecurityStateMap security_state_; | |
| 123 | |
| 124 DISALLOW_COPY_AND_ASSIGN(RendererSecurityPolicy); | |
| 125 }; | |
| 126 | |
| 127 #endif // CHROME_BROWSER_RENDERER_HOST_RENDERER_SECURITY_POLICY_H_ | |
| OLD | NEW |