Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/browser/child_process_security_policy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/child_process_security_policy.h"
 
 #include "base/file_path.h"
 #include "base/logging.h"
 #include "base/platform_file.h"
 #include "base/stl_util.h"
 #include "base/string_util.h"
+#include "content/browser/site_instance.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/url_constants.h"
 #include "googleurl/src/gurl.h"
 #include "net/url_request/url_request.h"
 
 static const int kReadFilePermissions =
     base::PLATFORM_FILE_OPEN |
     base::PLATFORM_FILE_READ |
     base::PLATFORM_FILE_EXCLUSIVE_READ |
     base::PLATFORM_FILE_ASYNC;
@@ skipping 63 matching lines @@
     while (current_path != last_path) {
       if (file_permissions_.find(current_path) != file_permissions_.end())
         return (file_permissions_[current_path] & permissions) == permissions;
       last_path = current_path;
       current_path = current_path.DirName();
     }
 
     return false;
   }
 
+  bool CanUseCookiesForOrigin(const GURL& gurl) {
+    if (origin_lock_.is_empty())
+      return true;
+    GURL site_gurl = SiteInstance::GetSiteForURL(NULL, gurl);

[Charlie Reis, 2011/11/10 01:09:26]

Is NULL ok for the context?  I think that means we'll treat extension URLs (or
possibly hosted app URLs) incorrectly.

+    return origin_lock_ == site_gurl;
+  }
+
+  void LockToOrigin(const GURL& gurl) {
+    origin_lock_ = gurl.GetOrigin();

[Charlie Reis, 2011/11/10 01:09:26]

Why use GetOrigin for one and GetSiteForURL for the other?

+  }
+
   bool has_web_ui_bindings() const {
     return enabled_bindings_ & content::BINDINGS_POLICY_WEB_UI;
   }
 
   bool can_read_raw_cookies() const {
     return can_read_raw_cookies_;
   }
 
  private:
   typedef std::map<std::string, bool> SchemeMap;
   typedef std::map<FilePath, int> FileMap;  // bit-set of PlatformFileFlags
 
   // Maps URL schemes to whether permission has been granted or revoked:
   //   |true| means the scheme has been granted.
   //   |false| means the scheme has been revoked.
   // If a scheme is not present in the map, then it has never been granted
   // or revoked.
   SchemeMap scheme_policy_;
 
   // The set of files the child process is permited to upload to the web.
   FileMap file_permissions_;
 
   int enabled_bindings_;
 
   bool can_read_raw_cookies_;
 
+  GURL origin_lock_;
+
   DISALLOW_COPY_AND_ASSIGN(SecurityState);
 };
 
 ChildProcessSecurityPolicy::ChildProcessSecurityPolicy() {
   // We know about these schemes and believe them to be safe.
   RegisterWebSafeScheme(chrome::kHttpScheme);
   RegisterWebSafeScheme(chrome::kHttpsScheme);
   RegisterWebSafeScheme(chrome::kFtpScheme);
   RegisterWebSafeScheme(chrome::kDataScheme);
   RegisterWebSafeScheme("feed");
@@ skipping 305 matching lines @@
   security_state_[child_id] = new SecurityState();
 }
 
 bool ChildProcessSecurityPolicy::ChildProcessHasPermissionsForFile(
     int child_id, const FilePath& file, int permissions) {
   SecurityStateMap::iterator state = security_state_.find(child_id);
   if (state == security_state_.end())
     return false;
   return state->second->HasPermissionsForFile(file, permissions);
 }
+
+bool ChildProcessSecurityPolicy::CanUseCookiesForOrigin(int child_id,
+                                                        const GURL& gurl) {
+  base::AutoLock lock(lock_);
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  if (state == security_state_.end()) {
+    NOTREACHED();
+    return false;
+  }
+  return state->second->CanUseCookiesForOrigin(gurl);
+}
+
+void ChildProcessSecurityPolicy::LockToOrigin(int child_id, const GURL& gurl) {
+  DCHECK(!gurl.is_empty());
+  base::AutoLock lock(lock_);
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  DCHECK(state != security_state_.end());
+  state->second->LockToOrigin(gurl);
+}
+