Limit number of service instances passed to onServiceList listeners.

chrome/browser/extensions/api/mdns/mdns_api.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/mdns/mdns_api.h"
 
 #include <vector>
 
 #include "base/lazy_instance.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/common/extensions/api/mdns.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/browser/render_view_host.h"
+#include "extensions/browser/extension_host.h"
 #include "extensions/browser/extension_registry.h"
+#include "extensions/common/extension_messages.h"
 
 namespace extensions {
 
 namespace mdns = api::mdns;
 
 namespace {
 
 // Whitelisted mDNS service types.
 const char kCastServiceType[] = "_googlecast._tcp.local";
 const char kPrivetServiceType[] = "_privet._tcp.local";
@@ skipping 110 matching lines @@
   service_types_ = new_service_types;
 }
 
 void MDnsAPI::OnDnsSdEvent(const std::string& service_type,
                            const DnsSdRegistry::DnsSdServiceList& services) {
   DCHECK(thread_checker_.CalledOnValidThread());
 
   std::vector<linked_ptr<mdns::MDnsService> > args;
   for (DnsSdRegistry::DnsSdServiceList::const_iterator it = services.begin();
        it != services.end(); ++it) {
+    if (static_cast<long>(args.size()) ==
+        api::mdns::maxServiceInstancesPerEvent) {
+      std::ostringstream s;
+      s << "Truncating service instances in onServiceList event to max: "
+        << api::mdns::maxServiceInstancesPerEvent;

[not at google - send to devlin, 2015/04/02 22:36:22]

I think it's more common to use StringPrintf rather than streams for this sort
of thing.

[Red Daly, 2015/04/03 17:58:56]

Done.

+      WriteToConsole(service_type,
+                     content::CONSOLE_MESSAGE_LEVEL_WARNING,
+                     s.str());
+      VLOG(logging::LOG_WARNING) << s.str();
+      break;
+    }
     linked_ptr<mdns::MDnsService> mdns_service =
         make_linked_ptr(new mdns::MDnsService);
     mdns_service->service_name = (*it).service_name;
     mdns_service->service_host_port = (*it).service_host_port;
     mdns_service->ip_address = (*it).ip_address;
     mdns_service->service_data = (*it).service_data;
     args.push_back(mdns_service);
   }
 
   scoped_ptr<base::ListValue> results = mdns::OnServiceList::Create(args);
   scoped_ptr<Event> event(
       new Event(mdns::OnServiceList::kEventName, results.Pass()));
   event->restrict_to_browser_context = browser_context_;
   event->filter_info.SetServiceType(service_type);
 
   // TODO(justinlin): To avoid having listeners without filters getting all
   // events, modify API to have this event require filters.
   // TODO(reddaly): If event isn't on whitelist, ensure it does not get
   // broadcast to extensions.
   extensions::EventRouter::Get(browser_context_)->BroadcastEvent(event.Pass());
 }
 
+void MDnsAPI::WriteToConsole(const std::string& service_type,

[not at google - send to devlin, 2015/04/02 22:36:22]

I'm a bit lost sorry - why is so much code needed to log a message to the JS
console?

[Red Daly, 2015/04/03 17:58:55]

There is one JS console per extension.  This code gets the list of relevant
extensions for a given mDNS service type and sends a message to each console.

[not at google - send to devlin, 2015/04/03 18:16:58]

Ohh I see. So these service registation restrictions are actually shared across
Extensions? That's the way I read the code as well, in OnDnsSendEvent?

The problem with that is if an app or an extension registers for a lot of
services, it could starve other extensions. The restrictions should be per
extension, and that is what the bug appears to be filed about.

It seems like UpdateMdnsListeners is the right place to do this, you already
have the extension whitelist check in there.

Sorry if I'm misunderstanding.

+                             content::ConsoleMessageLevel level,
+                             const std::string& message) {
+  std::set<std::string> extension_ids;
+
+  // Check all listeners for service type filters.
+  for (const auto& listener :
+           extensions::EventRouter::Get(browser_context_)->listeners()
+           .GetEventListenersByName(mdns::OnServiceList::kEventName)) {
+    base::DictionaryValue* filter = (listener->filter());
+
+    std::string filter_value;
+    filter->GetStringASCII(kEventFilterServiceTypeKey, &filter_value);
+    if (filter_value.empty())
+      continue;
+
+    const Extension* extension = ExtensionRegistry::Get(browser_context_)->
+        enabled_extensions().GetByID(listener->extension_id());
+    // Don't listen for services associated only with disabled extensions.
+    if (!extension)
+      continue;
+
+    // Platform apps may query for all services; other types of extensions are
+    // restricted to a whitelist.
+    if (!extension->is_platform_app() &&
+        !IsServiceTypeWhitelisted(filter_value))
+      continue;
+
+    extension_ids.insert(listener->extension_id());
+  }
+
+  // Log to the consoles of the background pages of relevant listeners.
+  for (const std::string& extension_id : extension_ids) {
+    extensions::ExtensionHost* host =
+        extensions::ProcessManager::Get(browser_context_)
+        ->GetBackgroundHostForExtension(extension_id);
+    if (!host)
+      continue;
+    content::RenderProcessHost* rph = host->render_process_host();
+    content::RenderViewHost* rvh = host->render_view_host();
+    if (!rvh || !rph)
+      continue;
+    rph->Send(new ExtensionMsg_AddMessageToConsole(
+        rvh->GetRoutingID(),
+        level,
+        message));
+  }
+}
+
 }  // namespace extensions