Foundations for Print Preview and Setup...

chrome/browser/child_process_security_policy.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/child_process_security_policy.h"
 
 #include "base/file_path.h"
 #include "base/logging.h"
 #include "base/stl_util-inl.h"
 #include "base/string_util.h"
@@ skipping 80 matching lines @@
   RegisterWebSafeScheme(chrome::kHttpsScheme);
   RegisterWebSafeScheme(chrome::kFtpScheme);
   RegisterWebSafeScheme(chrome::kDataScheme);
   RegisterWebSafeScheme("feed");
   RegisterWebSafeScheme("chrome-extension");
 
   // We know about the following psuedo schemes and treat them specially.
   RegisterPseudoScheme(chrome::kAboutScheme);
   RegisterPseudoScheme(chrome::kJavaScriptScheme);
   RegisterPseudoScheme(chrome::kViewSourceScheme);
+  RegisterPseudoScheme(chrome::kPrintScheme);
 }
 
 ChildProcessSecurityPolicy::~ChildProcessSecurityPolicy() {
   web_safe_schemes_.clear();
   pseudo_schemes_.clear();
   STLDeleteContainerPairSecondPointers(security_state_.begin(),
                                        security_state_.end());
   security_state_.clear();
 }
 
@@ skipping 52 matching lines @@
 
 void ChildProcessSecurityPolicy::GrantRequestURL(int renderer_id, const GURL& url) {
 
   if (!url.is_valid())
     return;  // Can't grant the capability to request invalid URLs.
 
   if (IsWebSafeScheme(url.scheme()))
     return;  // The scheme has already been white-listed for every renderer.
 
   if (IsPseudoScheme(url.scheme())) {
-    // The view-source scheme is a special case of a pseudo URL that eventually
-    // results in requesting its embedded URL.
-    if (url.SchemeIs(chrome::kViewSourceScheme)) {
-      // URLs with the view-source scheme typically look like:
+    // The view-source and print schemes are a special case of a pseudo URL that
+    // eventually results in requesting its embedded URL.
+    if (url.SchemeIs(chrome::kViewSourceScheme) ||
+        url.SchemeIs(chrome::kPrintScheme)) {
+      // URLs with the view-source and print schemes typically look like:
       //   view-source:http://www.google.com/a
       // In order to request these URLs, the renderer needs to be able to
       // request the embedded URL.
       GrantRequestURL(renderer_id, GURL(url.path()));
     }
 
     return;  // Can't grant the capability to request pseudo schemes.
   }
 
   {
@@ skipping 60 matching lines @@
 bool ChildProcessSecurityPolicy::CanRequestURL(int renderer_id, const GURL& url) {
   if (!url.is_valid())
     return false;  // Can't request invalid URLs.
 
   if (IsWebSafeScheme(url.scheme()))
     return true;  // The scheme has been white-listed for every renderer.
 
   if (IsPseudoScheme(url.scheme())) {
     // There are a number of special cases for pseudo schemes.
 
-    if (url.SchemeIs(chrome::kViewSourceScheme)) {
-      // A view-source URL is allowed if the renderer is permitted to request
-      // the embedded URL.
+    if (url.SchemeIs(chrome::kViewSourceScheme) ||
+        url.SchemeIs(chrome::kPrintScheme)) {
+      // View-source and print URL's are allowed if the renderer is permitted
+      // to request the embedded URL.
       return CanRequestURL(renderer_id, GURL(url.path()));
     }
 
     if (LowerCaseEqualsASCII(url.spec(), chrome::kAboutBlankURL))
       return true;  // Every renderer can request <about:blank>.
 
     // URLs like <about:memory> and <about:crash> shouldn't be requestable by
     // any renderer.  Also, this case covers <javascript:...>, which should be
     // handled internally by the renderer and not kicked up to the browser.
     return false;
@@ skipping 38 matching lines @@
 
 bool ChildProcessSecurityPolicy::HasExtensionBindings(int renderer_id) {
   AutoLock lock(lock_);
 
   SecurityStateMap::iterator state = security_state_.find(renderer_id);
   if (state == security_state_.end())
     return false;
 
   return state->second->has_extension_bindings();
 }