Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/browser/site_instance.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/site_instance.h"
 
+#include "base/command_line.h"
 #include "content/browser/browsing_instance.h"
+#include "content/browser/child_process_security_policy.h"
 #include "content/browser/renderer_host/browser_render_process_host.h"
 #include "content/browser/webui/web_ui_factory.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/registry_controlled_domain.h"
 
 static bool IsURLSameAsAnySiteInstance(const GURL& url) {
   if (!url.is_valid())
     return false;
 
   // We treat javascript: as the same site as any URL since it is actually
   // a modifier on existing pages.
   if (url.SchemeIs(chrome::kJavaScriptScheme))
@@ skipping 55 matching lines @@
       } else {
         process_ =
             new BrowserRenderProcessHost(browsing_instance_->browser_context());
       }
     }
 
     content::GetContentClient()->browser()->SiteInstanceGotProcess(this);
 
     // Make sure the process starts at the right max_page_id
     process_->UpdateMaxPageID(max_page_id_);
+
+    const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+    if (command_line.HasSwitch(switches::kEnableStrictSiteIsolation)) {
+      ChildProcessSecurityPolicy* policy =
+          ChildProcessSecurityPolicy::GetInstance();
+      policy->LockToOrigin(process_->id(), site_);

[Charlie Reis, 2011/11/22 19:06:59]

Hmm, a SiteInstance's site_ isn't always set by the time GetProcess() is called
(which helps deal with redirects).  For example, if you open a bookmark in a new
tab, GetProcess gets called before SetSite.  If you open a bookmark in the
current tab, SetSite gets called before GetProcess.

I think we might have to move this to a helper and call it from both GetProcess
and SetSite, whichever comes first (e.g., checking if has_site here, and if
process_ below).

+    }
   }
   DCHECK(process_);
 
   return process_;
 }
 
 void SiteInstance::SetSite(const GURL& url) {
   // A SiteInstance's site should not change.
   // TODO(creis): When following links or script navigations, we can currently
   // render pages from other sites in this SiteInstance.  This will eventually
@@ skipping 122 matching lines @@
 }
 
 void SiteInstance::Observe(int type,
                            const content::NotificationSource& source,
                            const content::NotificationDetails& details) {
   DCHECK(type == content::NOTIFICATION_RENDERER_PROCESS_TERMINATED);
   RenderProcessHost* rph = content::Source<RenderProcessHost>(source).ptr();
   if (rph == process_)
     process_ = NULL;
 }