Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/browser/child_process_security_policy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/child_process_security_policy.h"
 
 #include "base/file_path.h"
 #include "base/logging.h"
 #include "base/platform_file.h"
 #include "base/stl_util.h"
 #include "base/string_util.h"
+#include "content/browser/site_instance.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/url_constants.h"
 #include "googleurl/src/gurl.h"
 #include "net/url_request/url_request.h"
 
 static const int kReadFilePermissions =
     base::PLATFORM_FILE_OPEN |
     base::PLATFORM_FILE_READ |
     base::PLATFORM_FILE_EXCLUSIVE_READ |
     base::PLATFORM_FILE_ASYNC;
@@ skipping 63 matching lines @@
     while (current_path != last_path) {
       if (file_permissions_.find(current_path) != file_permissions_.end())
         return (file_permissions_[current_path] & permissions) == permissions;
       last_path = current_path;
       current_path = current_path.DirName();
     }
 
     return false;
   }
 
+  bool CanUseCookiesForOrigin(const GURL& gurl) {
+    if (origin_lock_.is_empty())
+      return true;
+    GURL site_gurl = SiteInstance::GetSiteForURL(NULL, gurl);

[Charlie Reis, 2011/11/22 19:06:59]

Hosted apps and extensions do run in renderer processes.  Looking closer, I
think this actually does the right thing for hosted apps (since we don't want
GetEffectiveURL to return the hosted app's chrome-extension://... URL).  This
code might end up preventing extensions from accessing their own cookies, but
I'd have to test it to be sure.

Since this is just experimental, I'm not too concerned for the time being-- it's
ok if it has a bug there for now.  Feel free to give it a try if you're curious,
though.

+    return origin_lock_ == site_gurl;
+  }
+
+  void LockToOrigin(const GURL& gurl) {
+    origin_lock_ = gurl;
+  }
+
   bool has_web_ui_bindings() const {
     return enabled_bindings_ & content::BINDINGS_POLICY_WEB_UI;
   }
 
   bool can_read_raw_cookies() const {
     return can_read_raw_cookies_;
   }
 
  private:
   typedef std::map<std::string, bool> SchemeMap;
   typedef std::map<FilePath, int> FileMap;  // bit-set of PlatformFileFlags
 
   // Maps URL schemes to whether permission has been granted or revoked:
   //   |true| means the scheme has been granted.
   //   |false| means the scheme has been revoked.
   // If a scheme is not present in the map, then it has never been granted
   // or revoked.
   SchemeMap scheme_policy_;
 
   // The set of files the child process is permited to upload to the web.
   FileMap file_permissions_;
 
   int enabled_bindings_;
 
   bool can_read_raw_cookies_;
 
+  GURL origin_lock_;
+
   DISALLOW_COPY_AND_ASSIGN(SecurityState);
 };
 
 ChildProcessSecurityPolicy::ChildProcessSecurityPolicy() {
   // We know about these schemes and believe them to be safe.
   RegisterWebSafeScheme(chrome::kHttpScheme);
   RegisterWebSafeScheme(chrome::kHttpsScheme);
   RegisterWebSafeScheme(chrome::kFtpScheme);
   RegisterWebSafeScheme(chrome::kDataScheme);
   RegisterWebSafeScheme("feed");
@@ skipping 305 matching lines @@
   security_state_[child_id] = new SecurityState();
 }
 
 bool ChildProcessSecurityPolicy::ChildProcessHasPermissionsForFile(
     int child_id, const FilePath& file, int permissions) {
   SecurityStateMap::iterator state = security_state_.find(child_id);
   if (state == security_state_.end())
     return false;
   return state->second->HasPermissionsForFile(file, permissions);
 }
+
+bool ChildProcessSecurityPolicy::CanUseCookiesForOrigin(int child_id,
+                                                        const GURL& gurl) {
+  base::AutoLock lock(lock_);
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  if (state == security_state_.end()) {
+    NOTREACHED();
+    return false;
+  }
+  return state->second->CanUseCookiesForOrigin(gurl);
+}
+
+void ChildProcessSecurityPolicy::LockToOrigin(int child_id, const GURL& gurl) {
+  DCHECK(!gurl.is_empty());
+  DCHECK(gurl.GetOrigin() == gurl);

[Charlie Reis, 2011/11/22 19:06:59]

Interesting.  I think line 475 implies line 474, but not vice versa.  In other
words, anything you get back from GetSiteForURL is indeed an origin, but you can
get back something from GetOrigin that isn't a site (e.g., something with a
subdomain or port).

It works, but it's tricky to read.  Maybe flip these two lines for clarity?

+  DCHECK(SiteInstance::GetSiteForURL(NULL, gurl) == gurl);
+  base::AutoLock lock(lock_);
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  DCHECK(state != security_state_.end());
+  state->second->LockToOrigin(gurl);
+}
+