Don't allow updating tabs to javascript URLs without host

chrome/browser/extensions/extension_tabs_module.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_tabs_module.h"
 
 #include "base/gfx/jpeg_codec.h"
 #include "base/string_util.h"
 #include "chrome/browser/browser.h"
 #include "chrome/browser/browser_list.h"
 #include "chrome/browser/browser_window.h"
 #include "chrome/browser/extensions/extension_function_dispatcher.h"
 #include "chrome/browser/extensions/extension_tabs_module_constants.h"
 #include "chrome/browser/extensions/extensions_service.h"
 #include "chrome/browser/profile.h"
 #include "chrome/browser/renderer_host/backing_store.h"
 #include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/browser/renderer_host/render_view_host_delegate.h"
 #include "chrome/browser/tab_contents/navigation_entry.h"
 #include "chrome/browser/tab_contents/tab_contents.h"
 #include "chrome/browser/window_sizer.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_error_utils.h"
+#include "chrome/common/url_constants.h"
 #include "net/base/base64.h"
 #include "skia/ext/image_operations.h"
 #include "skia/ext/platform_canvas.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 
 
 namespace keys = extension_tabs_module_constants;
 
 // Forward declare static helper functions defined below.
 
 // |error_message| can optionally be passed in a will be set with an appropriate
 // message if the window cannot be found by id.
 static Browser* GetBrowserInProfileWithId(Profile* profile,
                                           const int window_id,
                                           std::string* error_message);
 
 // |error_message| can optionally be passed in a will be set with an appropriate
 // message if the tab cannot be found by id.
 static bool GetTabById(int tab_id, Profile* profile, Browser** browser,
                        TabStripModel** tab_strip,
                        TabContents** contents,
                        int* tab_index, std::string* error_message);
 
-// Construct an absolute path from a relative path.
-static GURL AbsolutePath(Profile* profile, const std::string& extension_id,
-                         const std::string& relative_url);
-
 int ExtensionTabUtil::GetWindowId(const Browser* browser) {
   return browser->session_id().id();
 }
 
 int ExtensionTabUtil::GetTabId(const TabContents* tab_contents) {
   return tab_contents->controller().session_id().id();
 }
 
 ExtensionTabUtil::TabStatus ExtensionTabUtil::GetTabStatus(
     const TabContents* tab_contents) {
@@ skipping 403 matching lines @@
   // -favIconUrl
 
   std::string url_string;
   scoped_ptr<GURL> url(new GURL());
   if (args->HasKey(keys::kUrlKey)) {
     EXTENSION_FUNCTION_VALIDATE(args->GetString(keys::kUrlKey,
                                                 &url_string));
     url.reset(new GURL(url_string));
     if (!url->is_valid()) {
       // The path as passed in is not valid. Try converting to absolute path.
-      *url = AbsolutePath(profile(), extension_id(), url_string);
+      *url = GetExtension()->GetResourceURL(url->spec());
       if (!url->is_valid()) {
         error_ = ExtensionErrorUtils::FormatErrorMessage(keys::kInvalidUrlError,
                                                          url_string);
         return false;
       }
     }
   }
 
   // Default to foreground for the new tab. The presence of 'selected' property
   // will override this default.
@@ skipping 66 matching lines @@
 
   // Navigate the tab to a new location if the url different.
   std::string url;
   if (update_props->HasKey(keys::kUrlKey)) {
     EXTENSION_FUNCTION_VALIDATE(update_props->GetString(
         keys::kUrlKey, &url));
     GURL new_gurl(url);
 
     if (!new_gurl.is_valid()) {
       // The path as passed in is not valid. Try converting to absolute path.
-      new_gurl = AbsolutePath(profile(), extension_id(), url);
+      new_gurl = GetExtension()->GetResourceURL(url);
       if (!new_gurl.is_valid()) {
         error_ = ExtensionErrorUtils::FormatErrorMessage(keys::kInvalidUrlError,
                                                          url);
         return false;
       }
     }
 
+    // JavaScript URLs can do the same kinds of things as cross-origin XHR, so
+    // we need to check host permissions before allowing them.
+    if (new_gurl.SchemeIs(chrome::kJavaScriptScheme)) {
+      if (!GetExtension()->CanAccessHost(contents->GetURL())) {
+        error_ = ExtensionErrorUtils::FormatErrorMessage(
+            keys::kCannotAccessPageError, contents->GetURL().spec());
+        return false;
+      }
+
+      // TODO(aa): How does controller queue URLs? Is there any chance that this
+      // JavaScript URL will end up applying to something other than
+      // controller->GetURL()?
+    }
+
     controller.LoadURL(new_gurl, GURL(), PageTransition::LINK);
-    DCHECK_EQ(new_gurl.spec(), contents->GetURL().spec());
+
+    // The URL of a tab contents never actually changes to a JavaScript URL, so
+    // this check only makes sense in other cases.
+    if (!new_gurl.SchemeIs(chrome::kJavaScriptScheme))
+      DCHECK_EQ(new_gurl.spec(), contents->GetURL().spec());
   }
 
   bool selected = false;
   // TODO(rafaelw): Setting |selected| from js doesn't make much sense.
   // Move tab selection management up to window.
   if (update_props->HasKey(keys::kSelectedKey)) {
     EXTENSION_FUNCTION_VALIDATE(update_props->GetBoolean(
         keys::kSelectedKey,
         &selected));
     if (selected && tab_strip->selected_index() != tab_index) {
@@ skipping 240 matching lines @@
       return *browser;
   }
 
   if (error_message)
     *error_message= ExtensionErrorUtils::FormatErrorMessage(
         keys::kWindowNotFoundError, IntToString(window_id));
 
   return NULL;
 }
 
-static GURL AbsolutePath(Profile* profile, const std::string& extension_id,
-                         const std::string& relative_url) {
-  ExtensionsService* service = profile->GetExtensionsService();
-  Extension* extension = service->GetExtensionById(extension_id);
-  return Extension::GetResourceURL(extension->url(), relative_url);
-}
-
 static bool GetTabById(int tab_id, Profile* profile, Browser** browser,
                        TabStripModel** tab_strip,
                        TabContents** contents,
                        int* tab_index,
                        std::string* error_message) {
   if (ExtensionTabUtil::GetTabById(tab_id, profile, browser, tab_strip,
                                    contents, tab_index))
     return true;
 
   if (error_message)
     *error_message = ExtensionErrorUtils::FormatErrorMessage(
         keys::kTabNotFoundError, IntToString(tab_id));
 
   return false;
 }