Ensure that window.open requests issued by ChromeFrame carry the correct cook...

chrome_frame/utils.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <htiframe.h>
 #include <mshtml.h>
 #include <shlobj.h>
 #include <wininet.h>
 
 #include "base/file_util.h"
@@ skipping 25 matching lines @@
 // lower-case-transformed values.
 const wchar_t kMetaTag[] = L"meta";
 const wchar_t kHttpEquivAttribName[] = L"http-equiv";
 const wchar_t kContentAttribName[] = L"content";
 const wchar_t kXUACompatValue[] = L"x-ua-compatible";
 const wchar_t kBodyTag[] = L"body";
 const wchar_t kChromeContentPrefix[] = L"chrome=";
 const wchar_t kChromeProtocolPrefix[] = L"gcf:";
 const wchar_t kChromeMimeType[] = L"application/chromepage";
 const wchar_t kPatchProtocols[] = L"PatchProtocols";
+const wchar_t kChromeFrameAttachTabPattern[] = L"*?attach_external_tab&*";
 
 static const wchar_t kChromeFrameConfigKey[] =
     L"Software\\Google\\ChromeFrame";
 static const wchar_t kChromeFrameOptinUrlsKey[] = L"OptinUrls";
 static const wchar_t kEnableGCFProtocol[] = L"EnableGCFProtocol";
 static const wchar_t kEnableBuggyBhoIntercept[] = L"EnableBuggyBhoIntercept";
 
 static const wchar_t kChromeFrameNPAPIKey[] =
     L"Software\\MozillaPlugins\\@google.com/ChromeFrame,version=1.0";
 static const wchar_t kChromeFramePersistNPAPIReg[] = L"PersistNPAPIReg";
 
 // Used to isolate chrome frame builds from google chrome release channels.
 const wchar_t kChromeFrameOmahaSuffix[] = L"-cf";
 const wchar_t kDevChannelName[] = L"-dev";
 
-const wchar_t kChromeAttachExternalTabPrefix[] = L"attach_external_tab";
+const wchar_t kChromeAttachExternalTabPrefix[] = L"?attach_external_tab";
 
 // Indicates that we are running in a test environment, where execptions, etc
 // are handled by the chrome test crash server.
 const wchar_t kChromeFrameHeadlessMode[] = L"ChromeFrameHeadlessMode";
 
 // Indicates that we are running in an environment that wishes to avoid
 // DLL pinning, such as the perf tests.
 const wchar_t kChromeFrameUnpinnedMode[] = L"kChromeFrameUnpinnedMode";
 
 // {1AF32B6C-A3BA-48B9-B24E-8AA9C41F6ECD}
@@ skipping 779 matching lines @@
       return true;
     else
       return false;
   }
 
   if (is_privileged &&
       (crack_url.SchemeIs(chrome::kDataScheme) ||
        crack_url.SchemeIs(chrome::kExtensionScheme)))
     return true;
 
-  if (StartsWith(url, kChromeAttachExternalTabPrefix, false))
-    return true;
-
   return false;
 }
 
 std::string GetRawHttpHeaders(IWinInetHttpInfo* info) {
   DCHECK(info);
 
   std::string buffer;
 
   DWORD size = 0;
   DWORD flags = 0;
@@ skipping 357 matching lines @@
   } else {
     data->clear();
     // Return S_FALSE if the underlying stream returned S_OK and zero bytes.
     if (hr == S_OK)
       hr = S_FALSE;
   }
 
   return hr;
 }
 
-bool ParseAttachExternalTabUrl(const std::wstring& url, uint64* cookie,
-                               gfx::Rect* dimensions, int* disposition) {
-  if (!StartsWith(url, kChromeAttachExternalTabPrefix, true)) {
-    DLOG(WARNING) << "Invalid url passed in:"
-                  << url.c_str();
+ChromeFrameUrl::ChromeFrameUrl()
+    : is_chrome_protocol_(false),
+      attach_to_external_tab_(false),
+      cookie_(0),
+      disposition_(0) {
+}
+
+bool ChromeFrameUrl::Parse(const std::wstring& url) {
+  bool ret = false;
+  if (url.empty())
+    return ret;
+
+  url_ = url;
+
+  attach_to_external_tab_ = MatchPatternWide(url.c_str(),
+                                             kChromeFrameAttachTabPattern);
+  is_chrome_protocol_ = StartsWith(url, kChromeProtocolPrefix,
+                                   false);
+  DCHECK(!(attach_to_external_tab_ && is_chrome_protocol_));
+  if (is_chrome_protocol_) {
+    url_.erase(0, lstrlen(kChromeProtocolPrefix));
+  }
+
+  if (attach_to_external_tab_) {
+    ret = ParseAttachExternalTabUrl();
+  } else {
+    ret = true;
+  }
+  return ret;
+}
+
+bool ChromeFrameUrl::ParseAttachExternalTabUrl() {
+  size_t attach_external_tab_start_pos =
+      url_.find(kChromeAttachExternalTabPrefix);
+  if (attach_external_tab_start_pos == std::wstring::npos) {
+    NOTREACHED() << "Invalid url:" << url_;
     return false;
   }
 
-  if (!cookie || !dimensions || !disposition)
-    return false;
+  std::wstring url =
+      url_.substr(attach_external_tab_start_pos,
+                  url_.length() - attach_external_tab_start_pos);
 
   WStringTokenizer tokenizer(url, L"&");
   // Skip over kChromeAttachExternalTabPrefix
   tokenizer.GetNext();
-
   // Read the following items in order.
   // 1. cookie
   // 2. disposition
   // 3. dimension.x
   // 4. dimension.y
   // 5. dimension.width
   // 6. dimension.height.
   if (tokenizer.GetNext()) {
     wchar_t* end_ptr = 0;
-    *cookie = _wcstoui64(tokenizer.token().c_str(), &end_ptr, 10);
+    cookie_ = _wcstoui64(tokenizer.token().c_str(), &end_ptr, 10);
   } else {
     return false;
   }
 
   if (tokenizer.GetNext()) {
-    *disposition = _wtoi(tokenizer.token().c_str());
+    disposition_ = _wtoi(tokenizer.token().c_str());
   } else {
     return false;
   }
 
   if (tokenizer.GetNext()) {
-    dimensions->set_x(_wtoi(tokenizer.token().c_str()));
+    dimensions_.set_x(_wtoi(tokenizer.token().c_str()));
   } else {
     return false;
   }
 
   if (tokenizer.GetNext()) {
-    dimensions->set_y(_wtoi(tokenizer.token().c_str()));
+    dimensions_.set_y(_wtoi(tokenizer.token().c_str()));
   } else {
     return false;
   }
 
   if (tokenizer.GetNext()) {
-    dimensions->set_width(_wtoi(tokenizer.token().c_str()));
+    dimensions_.set_width(_wtoi(tokenizer.token().c_str()));
   } else {
     return false;
   }
 
   if (tokenizer.GetNext()) {
-    dimensions->set_height(_wtoi(tokenizer.token().c_str()));
+    dimensions_.set_height(_wtoi(tokenizer.token().c_str()));
   } else {
     return false;
   }
+  return true;
+}
+
+bool CanNavigateInFullTabMode(const ChromeFrameUrl& cf_url,
+                              IInternetSecurityManager* security_manager) {
+  bool is_privileged = false;
+
+  if (!IsValidUrlScheme(cf_url.url(), is_privileged)) {
+    DLOG(WARNING) << __FUNCTION__ << " Disallowing navigation to url: "
+                  << cf_url.url();
+    return false;
+  }
+
+  if (security_manager) {
+    DWORD zone = URLZONE_INVALID;
+    security_manager->MapUrlToZone(cf_url.url().c_str(), &zone, 0);
+    if (zone == URLZONE_UNTRUSTED) {
+      DLOG(WARNING) << __FUNCTION__
+                    << " Disallowing navigation to restricted url: "
+                    << cf_url.url();
+      return false;
+    }
+  }
+
+  if (cf_url.is_chrome_protocol()) {
+    // Allow chrome protocol (gcf:) if -
+    // - explicitly enabled using registry
+    // - for gcf:attach_external_tab
+    // - for gcf:about and gcf:view-source
+    GURL crack_url(cf_url.url());
+    bool allow_gcf_protocol =
+        GetConfigBool(false, kEnableGCFProtocol) ||
+        crack_url.SchemeIs(chrome::kAboutScheme) ||
+        crack_url.SchemeIs(chrome::kViewSourceScheme);
+    if (!allow_gcf_protocol) {
+      DLOG(WARNING) << __FUNCTION__
+                    << " Disallowing navigation to gcf url: "
+                    << cf_url.url();
+      return false;
+    }
+  }
 
   return true;
 }
-