Track which NativeViewIds each render process is allowed to interact with.

chrome/browser/renderer_host/render_widget_host.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/render_widget_host.h"
 
 #include "base/gfx/native_widget_types.h"
 #include "base/histogram.h"
 #include "base/message_loop.h"
 #include "base/keyboard_codes.h"
 #include "chrome/browser/renderer_host/backing_store.h"
+#include "chrome/browser/renderer_host/renderer_security_policy.h"
 #include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/browser/renderer_host/render_widget_helper.h"
 #include "chrome/browser/renderer_host/render_widget_host_view.h"
 #include "chrome/common/notification_service.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/views/view.h"
 #include "webkit/glue/webcursor.h"
 #include "webkit/glue/webtextdirection.h"
 
 #if defined(OS_WIN)
@@ skipping 57 matching lines @@
   process_->Release(routing_id_);
 }
 
 void RenderWidgetHost::Init() {
   DCHECK(process_->channel());
 
   renderer_initialized_ = true;
 
   // Send the ack along with the information on placement.
   gfx::NativeView plugin_view = view_->GetPluginNativeView();
-  Send(new ViewMsg_CreatingNew_ACK(routing_id_,
-                                   gfx::IdFromNativeView(plugin_view)));
+  gfx::NativeViewId view_id = gfx::IdFromNativeView(plugin_view);
+  RendererSecurityPolicy::GetInstance()->GrantNativeViewId(
+      process()->pid(), view_id);
+  Send(new ViewMsg_CreatingNew_ACK(routing_id_, view_id));
   WasResized();
 }
 
 void RenderWidgetHost::Shutdown() {
   if (process_->channel()) {
     // Tell the renderer object to close.
     process_->ReportExpectingClose(routing_id_);
     bool rv = Send(new ViewMsg_Close(routing_id_));
     DCHECK(rv);
   }
@@ skipping 619 matching lines @@
 
   // TODO(darin): do we need to do something else if our backing store is not
   // the same size as the advertised view?  maybe we just assume there is a
   // full paint on its way?
   BackingStore* backing_store = BackingStoreManager::Lookup(this);
   if (!backing_store || (backing_store->size() != view_size))
     return;
   backing_store->ScrollRect(process_->process().handle(), bitmap, bitmap_rect,
                             dx, dy, clip_rect, view_size);
 }