Add support for gcf:about:plugins in chrome frame full tab mode. The URL vali...

chrome_frame/chrome_frame_activex_base.h

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_FRAME_CHROME_FRAME_ACTIVEX_BASE_H_
 #define CHROME_FRAME_CHROME_FRAME_ACTIVEX_BASE_H_
 
 #include <atlbase.h>
 #include <atlcom.h>
 #include <atlctl.h>
@@ skipping 131 matching lines @@
     FireMethodWithParams(CF_EVENT_DISPID_ONCHANNELERROR, NULL, 0);
   }
 
   void Fire_onclose() {  // NOLINT
     FireMethodWithParams(CF_EVENT_DISPID_ONCLOSE, NULL, 0);
   }
 };
 
 extern bool g_first_launch_by_process_;
 
-// Posted when the worker thread used for handling URL requests in IE finishes
-// uninitialization.
-#define WM_WORKER_THREAD_UNINITIALIZED_MSG (WM_APP + 1)
-
 // Common implementation for ActiveX and Active Document
 template <class T, const CLSID& class_id>
 class ATL_NO_VTABLE ChromeFrameActivexBase :  // NOLINT
   public CComObjectRootEx<CComMultiThreadModel>,
   public IOleControlImpl<T>,
   public IOleObjectImpl<T>,
   public IOleInPlaceActiveObjectImpl<T>,
   public IViewObjectExImpl<T>,
   public IOleInPlaceObjectWindowlessImpl<T>,
   public ISupportErrorInfo,
   public IQuickActivateImpl<T>,
   public com_util::IProvideClassInfo2Impl<class_id,
                                           DIID_DIChromeFrameEvents>,
   public com_util::IDispatchImpl<IChromeFrame>,
   public IChromeFrameInternal,
   public IConnectionPointContainerImpl<T>,
   public ProxyDIChromeFrameEvents<T>,
   public IPropertyNotifySinkCP<T>,
   public CComCoClass<T, &class_id>,
   public CComControl<T>,
-  public ChromeFramePlugin<T> {
+  public ChromeFramePlugin<T>,
+  public NavigationConstraintsImpl {
  protected:
   typedef std::set<base::win::ScopedComPtr<IDispatch> > EventHandlers;
   typedef ChromeFrameActivexBase<T, class_id> BasePlugin;
 
  public:
   ChromeFrameActivexBase()
       : ready_state_(READYSTATE_UNINITIALIZED),
       url_fetcher_(new UrlmonUrlRequestManager()),
       failed_to_fetch_in_place_frame_(false),
       draw_sad_tab_(false),
@@ skipping 381 matching lines @@
       draw_sad_tab_ = true;
 
     ready_state_ = READYSTATE_UNINITIALIZED;
     FireOnChanged(DISPID_READYSTATE);
   }
 
   virtual void OnCloseTab(int tab_handle) {
     Fire_onclose();
   }
 
+  // NavigationConstraints overrides.
+  virtual bool IsSchemeAllowed(const GURL&url) {

[amit, 2010/12/10 23:56:17]

nit: space after &

[ananta, 2010/12/11 02:11:11]

Done.

+    bool allowed = NavigationConstraintsImpl::IsSchemeAllowed(url);
+    if (allowed)
+      return true;
+
+    if (is_privileged_ &&
+        (url.SchemeIs(chrome::kDataScheme) ||
+         url.SchemeIs(chrome::kExtensionScheme))) {
+      return true;
+    }
+    return false;
+  }
+
+  virtual bool IsZoneAllowed(const GURL& url) {
+    if (!security_manager_) {
+      HRESULT hr = security_manager_.CreateInstance(
+          CLSID_InternetSecurityManager);
+      if (FAILED(hr)) {
+        NOTREACHED() << __FUNCTION__
+                     << " Failed to create SecurityManager. Error: 0x%x"
+                     << hr;
+        return false;
+      }
+    }
+    DWORD zone = URLZONE_INVALID;
+    std::wstring unicode_url = UTF8ToWide(url.spec());
+    security_manager_->MapUrlToZone(unicode_url.c_str(), &zone, 0);
+    if (zone == URLZONE_UNTRUSTED) {
+      DLOG(WARNING) << __FUNCTION__
+                    << " Disallowing navigation to restricted url: " << url;
+      return false;
+    }
+    return true;
+  }
+
   // Overridden to take advantage of readystate prop changes and send those
   // to potential listeners.
   HRESULT FireOnChanged(DISPID dispid) {
     if (dispid == DISPID_READYSTATE) {
       Fire_onreadystatechanged(ready_state_);
     }
     return __super::FireOnChanged(dispid);
   }
 
   // IChromeFrame
@@ skipping 16 matching lines @@
     // Switch the src to UTF8 and try to expand to full URL
     std::string src_utf8;
     WideToUTF8(src, SysStringLen(src), &src_utf8);
     std::string full_url = ResolveURL(GetDocumentUrl(), src_utf8);
 
     // We can initiate navigation here even if ready_state is not complete.
     // We do not have to set proxy, and AutomationClient will take care
     // of navigation just after CreateExternalTab is done.
     if (!automation_client_->InitiateNavigation(full_url,
                                                 GetDocumentUrl(),
-                                                is_privileged_)) {
+                                                this)) {
       // TODO(robertshield): Make InitiateNavigation return more useful
       // error information.
       return E_INVALIDARG;
     }
 
     // Save full URL in BSTR member
     url_.Reset(::SysAllocString(UTF8ToWide(full_url).c_str()));
 
     return S_OK;
   }
@@ skipping 645 matching lines @@
   EventHandlers onmessage_;
   EventHandlers onloaderror_;
   EventHandlers onload_;
   EventHandlers onreadystatechanged_;
   EventHandlers onprivatemessage_;
   EventHandlers onextensionready_;
 
   // Handle network requests when host network stack is used. Passed to the
   // automation client on initialization.
   scoped_ptr<UrlmonUrlRequestManager> url_fetcher_;
+  ScopedComPtr<IInternetSecurityManager> security_manager_;
 
   HINSTANCE prev_resource_instance_;
 };
 
 #endif  // CHROME_FRAME_CHROME_FRAME_ACTIVEX_BASE_H_