Ensured that worker thread renderer process file permissions are inherited from its main thread r...

content/browser/child_process_security_policy.cc

Index: content/browser/child_process_security_policy.cc
===================================================================
--- content/browser/child_process_security_policy.cc	(revision 83553)
+++ content/browser/child_process_security_policy.cc	(working copy)
@@ -157,12 +157,15 @@
 
 void ChildProcessSecurityPolicy::Add(int child_id) {
   base::AutoLock lock(lock_);
-  if (security_state_.count(child_id) != 0) {
-    NOTREACHED() << "Add child process at most once.";
-    return;
-  }
+  AddChild(child_id);
+}
 
-  security_state_[child_id] = new SecurityState();
+void ChildProcessSecurityPolicy::AddWorker(int child_id,
+                                           int main_render_process_id) {
+  base::AutoLock lock(lock_);
+  AddChild(child_id);
+  worker_map_.insert(WorkerToMainProcessMap::value_type(child_id,
+      main_render_process_id));

[jam, 2011/05/02 17:17:53]

nit: seems simpler to read if it's just

worker_map_[child_id] = main_render_process_id;

[zel, 2011/05/02 18:16:11]

Done.

 }
 
 void ChildProcessSecurityPolicy::Remove(int child_id) {
@@ -172,6 +175,7 @@
 
   delete security_state_[child_id];
   security_state_.erase(child_id);
+  worker_map_.erase(child_id);
 }
 
 void ChildProcessSecurityPolicy::RegisterWebSafeScheme(
@@ -405,12 +409,19 @@
 bool ChildProcessSecurityPolicy::HasPermissionsForFile(
     int child_id, const FilePath& file, int permissions) {
   base::AutoLock lock(lock_);
-
-  SecurityStateMap::iterator state = security_state_.find(child_id);
-  if (state == security_state_.end())
-    return false;
-
-  return state->second->HasPermissionsForFile(file, permissions);
+  bool result = ChildProcessHasPermissionsForFile(child_id, file, permissions);
+  if (!result) {
+    // If this is a worker thread that has no access to a given file,
+    // let's check that its main thread renderer process has access to that

[jam, 2011/05/02 17:17:53]

nit "main thread" seems redundant.  "its renderer process" is enough

[zel, 2011/05/02 18:16:11]

Done.

+    // file instead.
+    WorkerToMainProcessMap::iterator iter = worker_map_.find(child_id);
+    if (iter != worker_map_.end() && iter->second != 0) {
+      result = ChildProcessHasPermissionsForFile(iter->second,
+                                                 file,
+                                                 permissions);
+    }
+  }
+  return result;
 }
 
 bool ChildProcessSecurityPolicy::HasWebUIBindings(int child_id) {
@@ -442,3 +453,20 @@
 
   return state->second->can_read_raw_cookies();
 }
+
+void ChildProcessSecurityPolicy::AddChild(int child_id) {
+  if (security_state_.count(child_id) != 0) {
+    NOTREACHED() << "Add child process at most once.";
+    return;
+  }
+
+  security_state_[child_id] = new SecurityState();
+}
+
+bool ChildProcessSecurityPolicy::ChildProcessHasPermissionsForFile(
+    int child_id, const FilePath& file, int permissions) {
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  if (state == security_state_.end())
+    return false;
+  return state->second->HasPermissionsForFile(file, permissions);
+}