Disable outdated plugins, block non-sandboxed plugins.

chrome/renderer/render_view.cc

Index: chrome/renderer/render_view.cc
diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index fcaa65aab92887db3a6310ebebcd8cc559892233..9ddedf3081b57bf855749bf9598f6a6bb837915e 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -31,8 +31,10 @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/jstemplate_builder.h"
+#include "chrome/common/notification_service.h"
 #include "chrome/common/page_zoom.h"
 #include "chrome/common/pepper_plugin_registry.h"
+#include "chrome/common/plugin_group.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/renderer_preferences.h"
 #include "chrome/common/thumbnail_score.h"
@@ -683,6 +685,7 @@ void RenderView::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(ViewMsg_UpdateWebPreferences, OnUpdateWebPreferences)
     IPC_MESSAGE_HANDLER(ViewMsg_SetAltErrorPageURL, OnSetAltErrorPageURL)
     IPC_MESSAGE_HANDLER(ViewMsg_InstallMissingPlugin, OnInstallMissingPlugin)
+    IPC_MESSAGE_HANDLER(ViewMsg_LoadBlockedPlugins, OnLoadBlockedPlugins)
     IPC_MESSAGE_HANDLER(ViewMsg_RunFileChooserResponse, OnFileChooserResponse)
     IPC_MESSAGE_HANDLER(ViewMsg_EnableViewSourceMode, OnEnableViewSourceMode)
     IPC_MESSAGE_HANDLER(ViewMsg_GetAllSavableResourceLinksForCurrentPage,
@@ -2297,11 +2300,53 @@ void RenderView::runModal() {
 
 WebPlugin* RenderView::createPlugin(WebFrame* frame,
                                     const WebPluginParams& params) {
-  if (AllowContentType(CONTENT_SETTINGS_TYPE_PLUGINS))
-    return CreatePluginInternal(frame, params);
+  bool found = false;
+  WebPluginInfo info;
+  GURL url(params.url);
+  std::string mime_type(params.mimeType.utf8());
+  std::string actual_mime_type;
+  Send(new ViewHostMsg_GetPluginInfo(url,
+                                     frame->top()->url(),
+                                     mime_type,
+                                     &found,
+                                     &info,
+                                     &actual_mime_type));
+
+  if (!found)
+    return NULL;
+
+  scoped_ptr<PluginGroup> group(PluginGroup::FindHardcodedPluginGroup(info));
+  group->AddPlugin(info, 0);
 
-  didNotAllowPlugins(frame);
-  return CreatePluginPlaceholder(frame, params);
+  if (!info.enabled) {
+    if (group->IsVulnerable() && CommandLine::ForCurrentProcess()->HasSwitch(
+        switches::kDisableOutdatedPlugins)) {
+      Send(new ViewHostMsg_DisabledOutdatedPlugin(routing_id_,
+                                                  group->GetGroupName(),
+                                                  GURL(group->GetUpdateURL())));
+      return CreatePluginPlaceholder(frame, params, group.get());
+    }
+    return NULL;
+  }
+
+  if (info.path.value() != kDefaultPluginLibraryName) {
+    if (!AllowContentType(CONTENT_SETTINGS_TYPE_PLUGINS)) {
+      didNotAllowPlugins(frame);
+      return CreatePluginPlaceholder(frame, params, NULL);
+    }
+    scoped_refptr<pepper::PluginModule> pepper_module =
+        PepperPluginRegistry::GetInstance()->GetModule(info.path);
+    if (pepper_module) {
+      return CreatePepperPlugin(pepper_module.get(), params);
+    }
+    if (CommandLine::ForCurrentProcess()->HasSwitch(
+        switches::kBlockNonSandboxedPlugins)) {
+      Send(new ViewHostMsg_NonSandboxedPluginBlocked(routing_id_,
+                                                     group->GetGroupName()));
+      return CreatePluginPlaceholder(frame, params, NULL);
+    }
+  }
+  return CreateNPAPIPlugin(frame, params, &info, actual_mime_type);
 }
 
 WebWorker* RenderView::createWorker(WebFrame* frame, WebWorkerClient* client) {
@@ -3727,36 +3772,47 @@ void RenderView::ClearBlockedContentSettings() {
     content_blocked_[i] = false;
 }
 
-WebPlugin* RenderView::CreatePluginInternal(WebFrame* frame,
-                                            const WebPluginParams& params) {
-  FilePath path;
-  std::string actual_mime_type;
-  render_thread_->Send(new ViewHostMsg_GetPluginPath(
-      params.url, frame->top()->url(), params.mimeType.utf8(), &path,
-      &actual_mime_type));
-  if (path.value().empty())
+WebPlugin* RenderView::CreatePepperPlugin(pepper::PluginModule* pepper_module,
+                                          const WebPluginParams& params) {
+  return new pepper::WebPluginImpl(pepper_module, params,
+                                   pepper_delegate_.AsWeakPtr());
+}
+
+
+WebPlugin* RenderView::CreateNPAPIPlugin(WebFrame* frame,
+                                         const WebPluginParams& params,
+                                         WebPluginInfo* plugin_info,
+                                         const std::string& mime_type) {
+  std::string actual_mime_type(mime_type);
+  WebPluginInfo plugin;
+  if (plugin_info != NULL) {
+    plugin = *plugin_info;
+  } else {
+    bool found;
+    std::string actual_mime_type(mime_type);
+    Send(new ViewHostMsg_GetPluginInfo(
+        params.url, frame->top()->url(), params.mimeType.utf8(), &found,
+        &plugin, &actual_mime_type));
+    if (!found)
+      plugin.enabled = false;
+  }
+  if (!plugin.enabled)
     return NULL;
 
   if (actual_mime_type.empty())
     actual_mime_type = params.mimeType.utf8();
-
-  scoped_refptr<pepper::PluginModule> pepper_module =
-      PepperPluginRegistry::GetInstance()->GetModule(path);
-  if (pepper_module) {
-    return new pepper::WebPluginImpl(pepper_module, params,
-                                     pepper_delegate_.AsWeakPtr());
-  }
-
-  return new webkit_glue::WebPluginImpl(frame, params, path, actual_mime_type,
-                                        AsWeakPtr());
+  return new webkit_glue::WebPluginImpl(frame, params, plugin.path,
+                                        actual_mime_type, AsWeakPtr());
 }
 
 WebPlugin* RenderView::CreatePluginPlaceholder(WebFrame* frame,
-                                               const WebPluginParams& params) {
+                                               const WebPluginParams& params,
+                                               PluginGroup* group) {
   // |blocked_plugin| will delete itself when the WebViewPlugin is destroyed.
-  BlockedPlugin* blocked_plugin = new BlockedPlugin(this, frame, params);
+  BlockedPlugin* blocked_plugin = new BlockedPlugin(this, frame, params, group);
   WebViewPlugin* plugin = blocked_plugin->plugin();
-  webkit_preferences_.Apply(plugin->web_view());
+  WebView* web_view = plugin->web_view();
+  webkit_preferences_.Apply(web_view);
   return plugin;
 }
 
@@ -4011,6 +4067,12 @@ void RenderView::OnInstallMissingPlugin() {
     first_default_plugin_->InstallMissingPlugin();
 }
 
+void RenderView::OnLoadBlockedPlugins() {
+  NotificationService::current()->Notify(NotificationType::SHOULD_LOAD_PLUGINS,
+                                         Source<RenderView>(this),
+                                         NotificationService::NoDetails());
+}
+
 void RenderView::OnFileChooserResponse(const std::vector<FilePath>& paths) {
   // This could happen if we navigated to a different page before the user
   // closed the chooser.