Make sandboxed Flash work under UIPI

webkit/plugins/npapi/webplugin_delegate_impl_win.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/npapi/webplugin_delegate_impl.h"
 
 #include <map>
 #include <string>
 #include <vector>
 
@@ skipping 253 matching lines @@
       instance_(instance),
       quirks_(0),
       plugin_(NULL),
       windowless_(false),
       windowed_handle_(NULL),
       windowed_did_set_window_(false),
       plugin_wnd_proc_(NULL),
       last_message_(0),
       is_calling_wndproc(false),
       dummy_window_for_activation_(NULL),
+      parent_proxy_window_(NULL),
       handle_event_message_filter_hook_(NULL),
       handle_event_pump_messages_event_(NULL),
       user_gesture_message_posted_(false),
 #pragma warning(suppress: 4355)  // can use this
       user_gesture_msg_factory_(this),
       handle_event_depth_(0),
       mouse_hook_(NULL),
       first_set_window_call_(true),
       plugin_has_focus_(false),
       has_webkit_focus_(false),
       containing_view_has_focus_(true),
       creation_succeeded_(false) {
   memset(&window_, 0, sizeof(window_));
 
   const WebPluginInfo& plugin_info = instance_->plugin_lib()->plugin_info();
   std::wstring filename =
       StringToLowerASCII(plugin_info.path.BaseName().value());
 
   if (instance_->mime_type() == "application/x-shockwave-flash" ||
       filename == kFlashPlugin) {
     // Flash only requests windowless plugins if we return a Mozilla user
     // agent.
     instance_->set_use_mozilla_user_agent();
     quirks_ |= PLUGIN_QUIRK_THROTTLE_WM_USER_PLUS_ONE;
     quirks_ |= PLUGIN_QUIRK_PATCH_SETCURSOR;
     quirks_ |= PLUGIN_QUIRK_ALWAYS_NOTIFY_SUCCESS;
     quirks_ |= PLUGIN_QUIRK_HANDLE_MOUSE_CAPTURE;
+    if (filename == kBuiltinFlashPlugin)
+      quirks_ |= PLUGIN_QUIRK_REPARENT_IN_BROWSER;
   } else if (filename == kAcrobatReaderPlugin) {
     // Check for the version number above or equal 9.
     int major_version = GetPluginMajorVersion(plugin_info);
     if (major_version >= 9) {
       quirks_ |= PLUGIN_QUIRK_DIE_AFTER_UNLOAD;
       // 9.2 needs this.
       quirks_ |= PLUGIN_QUIRK_SETWINDOW_TWICE;
     }
     quirks_ |= PLUGIN_QUIRK_BLOCK_NONSTANDARD_GETURL_REQUESTS;
   } else if (plugin_info.name.find(L"Windows Media Player") !=
@@ skipping 36 matching lines @@
              std::wstring::npos) {
     // The divx plugin sets its size on the first NPP_SetWindow call and never
     // updates its size. We should call the underlying NPP_SetWindow only when
     // we have the correct size.
     quirks_ |= PLUGIN_QUIRK_IGNORE_FIRST_SETWINDOW_CALL;
   }
 }
 
 WebPluginDelegateImpl::~WebPluginDelegateImpl() {
   if (::IsWindow(dummy_window_for_activation_)) {
-    ::DestroyWindow(dummy_window_for_activation_);
+    // Sandboxed Flash stacks two dummy windows to prevent UIPI failures
+    if (::IsWindow(parent_proxy_window_))
+      ::DestroyWindow(parent_proxy_window_);
+    else
+      ::DestroyWindow(dummy_window_for_activation_);
   }
 
   DestroyInstance();
 
   if (!windowless_)
     WindowedDestroyWindow();
 
   if (handle_event_pump_messages_event_) {
     CloseHandle(handle_event_pump_messages_event_);
   }
@@ skipping 107 matching lines @@
   evt.lParam = 0;
   evt.wParam = 0;
   instance()->NPP_HandleEvent(&evt);
 }
 
 bool WebPluginDelegateImpl::WindowedCreatePlugin() {
   DCHECK(!windowed_handle_);
 
   RegisterNativeWindowClass();
 
+  // UIPI requires reparenting in the (medium-integrity) browser process.
+  bool reparent_in_browser = (quirks_ & PLUGIN_QUIRK_REPARENT_IN_BROWSER) != 0;
+
   // The window will be sized and shown later.
   windowed_handle_ = CreateWindowEx(
       WS_EX_LEFT | WS_EX_LTRREADING | WS_EX_RIGHTSCROLLBAR,
       kNativeWindowClassName,
       0,
       WS_POPUP | WS_CLIPCHILDREN | WS_CLIPSIBLINGS,
       0,
       0,
       0,
       0,
-      parent_,
+      reparent_in_browser ? NULL : parent_,
       0,
       GetModuleHandle(NULL),
       0);
   if (windowed_handle_ == 0)
     return false;
 
-  if (IsWindow(parent_)) {
+  if (reparent_in_browser) {
+    plugin_->ReparentPluginWindow(windowed_handle_, parent_);
+  } else if (IsWindow(parent_)) {
     // This is a tricky workaround for Issue 2673 in chromium "Flash: IME not
     // available". To use IMEs in this window, we have to make Windows attach
     // IMEs to this window (i.e. load IME DLLs, attach them to this process,
     // and add their message hooks to this window). Windows attaches IMEs while
     // this process creates a top-level window. On the other hand, to layout
     // this window correctly in the given parent window (RenderWidgetHostHWND),
     // this window should be a child window of the parent window.
     // To satisfy both of the above conditions, this code once creates a
     // top-level window and change it to a child window of the parent window.
     SetWindowLongPtr(windowed_handle_, GWL_STYLE,
@@ skipping 185 matching lines @@
         reinterpret_cast<LONG>(wnd_proc)));
     DCHECK(old_flash_proc);
     g_window_handle_proc_map.Get()[window] = old_flash_proc;
   }
 
   return TRUE;
 }
 
 bool WebPluginDelegateImpl::CreateDummyWindowForActivation() {
   DCHECK(!dummy_window_for_activation_);
+
+  // Built-in Flash runs with UIPI, but in windowless mode Flash sometimes
+  // tries to attach windows to the parent (which fails under UIPI). To make
+  // it work we add an extra dummy parent in the low-integrity process.
+  if (quirks_ & PLUGIN_QUIRK_REPARENT_IN_BROWSER) {
+    parent_proxy_window_ = CreateWindowEx(
+      0,
+      L"Static",
+      kDummyActivationWindowName,
+      WS_POPUP,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      GetModuleHandle(NULL),
+      0);
+
+    if (parent_proxy_window_ == 0)
+      return false;
+    plugin_->ReparentPluginWindow(parent_proxy_window_, parent_);
+  }
+
   dummy_window_for_activation_ = CreateWindowEx(
     0,
     L"Static",
     kDummyActivationWindowName,
     WS_CHILD,
     0,
     0,
     0,
     0,
-    parent_,
+    parent_proxy_window_ ? parent_proxy_window_ : parent_,
     0,
     GetModuleHandle(NULL),
     0);
 
   if (dummy_window_for_activation_ == 0)
     return false;
 
   // Flash creates background windows which use excessive CPU in our
   // environment; we wrap these windows and throttle them so that they don't
   // get out of hand.
@@ skipping 668 matching lines @@
       ::ReleaseCapture();
       break;
 
     default:
       break;
   }
 }
 
 }  // namespace npapi
 }  // namespace webkit