Add some browser-level checks to prohibit access to extension bindings by...

chrome/browser/extensions/extension_message_service.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_message_service.h"
 
 #include "base/json_writer.h"
 #include "base/singleton.h"
 #include "base/stl_util-inl.h"
 #include "base/values.h"
+#include "chrome/browser/child_process_security_policy.h"
 #include "chrome/browser/chrome_thread.h"
 #include "chrome/browser/extensions/extension_tabs_module.h"
 #include "chrome/browser/extensions/extension_view.h"
 #include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/browser/renderer_host/resource_message_filter.h"
 #include "chrome/browser/tab_contents/tab_contents.h"
 #include "chrome/browser/tab_contents/tab_util.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/notification_service.h"
 #include "chrome/common/render_messages.h"
@@ skipping 247 matching lines @@
     const std::string& event_name, const std::string& event_args) {
   DCHECK_EQ(MessageLoop::current()->type(), MessageLoop::TYPE_UI);
 
   std::set<int>& pids = listeners_[event_name];
 
   // Send the event only to renderers that are listening for it.
   for (std::set<int>::iterator pid = pids.begin(); pid != pids.end(); ++pid) {
     RenderProcessHost* renderer = RenderProcessHost::FromID(*pid);
     if (!renderer)
       continue;
+    if (!ChildProcessSecurityPolicy::GetInstance()->
+            HasExtensionBindings(*pid)) {
+      // Don't send browser-level events to unprivileged processes.
+      continue;
+    }
+
     renderer->Send(new ViewMsg_ExtensionHandleEvent(event_name, event_args));
   }
 }
 
 void ExtensionMessageService::Observe(NotificationType type,
                                       const NotificationSource& source,
                                       const NotificationDetails& details) {
   DCHECK_EQ(MessageLoop::current()->type(), MessageLoop::TYPE_UI);
 
   DCHECK(type.value == NotificationType::RENDERER_PROCESS_TERMINATED ||
@@ skipping 14 matching lines @@
 
   // Close any channels that share this renderer.
   // TODO(mpcomplete): should we notify the other side of the port?
   for (MessageChannelMap::iterator it = channels_.begin();
        it != channels_.end(); ) {
     MessageChannelMap::iterator current = it++;
     if (current->second.port1 == renderer || current->second.port2 == renderer)
       channels_.erase(current);
   }
 }