Kill bad apps.

extensions/browser/guest_view/app_view/app_view_guest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/guest_view/app_view/app_view_guest.h"
 
 #include "base/command_line.h"
 #include "components/guest_view/browser/guest_view_manager.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/common/renderer_preferences.h"
+#include "content/public/common/result_codes.h"
 #include "extensions/browser/api/app_runtime/app_runtime_api.h"
 #include "extensions/browser/api/extensions_api_client.h"
 #include "extensions/browser/app_window/app_delegate.h"
 #include "extensions/browser/event_router.h"
 #include "extensions/browser/extension_host.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/guest_view/app_view/app_view_constants.h"
 #include "extensions/browser/lazy_background_task_queue.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/browser/view_type_utils.h"
@@ skipping 35 matching lines @@
 }  // namespace
 
 // static.
 const char AppViewGuest::Type[] = "appview";
 
 // static.
 bool AppViewGuest::CompletePendingRequest(
     content::BrowserContext* browser_context,
     const GURL& url,
     int guest_instance_id,
-    const std::string& guest_extension_id) {
+    const std::string& guest_extension_id,
+    int guest_render_process_host_id) {

[lfg, 2015/06/12 21:43:47]

Add a DCHECK that the render process host passed here is the same as the one
that the guest's WebContents uses.

[EhsanK, 2015/06/25 16:19:50]

I am not sure if I understand this comment correctly. We are trying to kill the
apps which are posing as the guest app. They have different render process hosts
if I understand correctly. Wouldn't a DCHECK stop that part?

[lfg, 2015/06/26 21:46:05]

Ah, I see. Please, add a comment explaining why we are killing this process and
that this process is not the real guest.

[EhsanK, 2015/06/30 16:53:10]

Done.

   PendingResponseMap* response_map = pending_response_map.Pointer();
   PendingResponseMap::iterator it = response_map->find(guest_instance_id);
   if (it == response_map->end()) {
     // TODO(fsamuel): An app is sending invalid responses. We should probably
     // kill it.

[lfg, 2015/06/12 21:43:47]

Remove the TODO.

[EhsanK, 2015/06/25 16:19:50]

Done.

+    content::RenderProcessHost::FromID(guest_render_process_host_id)
+        ->Shutdown(-1, false);

[lfg, 2015/06/12 21:43:47]

We should add UMA metrics to track the kills here.

[EhsanK, 2015/06/25 16:19:50]

Done.

     return false;
   }
 
   linked_ptr<ResponseInfo> response_info = it->second;
   if (!response_info->app_view_guest ||
       (response_info->guest_extension->id() != guest_extension_id)) {
     // TODO(fsamuel): An app is trying to respond to an <appview> that didn't
     // initiate communication with it. We should kill the app here.
+    content::RenderProcessHost::FromID(guest_render_process_host_id)
+        ->Shutdown(-1, false);

[lfg, 2015/06/12 21:43:47]

Same as above.

[EhsanK, 2015/06/25 16:19:50]

Done.

     return false;
   }
 
   response_info->app_view_guest->CompleteCreateWebContents(
       url, response_info->guest_extension.get(), response_info->callback);
 
   response_map->erase(guest_instance_id);
   return true;
 }
 
@@ skipping 18 matching lines @@
   return nullptr;
 }
 
 content::WebContents* AppViewGuest::GetAssociatedWebContents() const {
   return web_contents();
 }
 
 bool AppViewGuest::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(AppViewGuest, message)
-    IPC_MESSAGE_HANDLER(ExtensionHostMsg_Request, OnRequest)
-    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_MESSAGE_HANDLER(ExtensionHostMsg_Request, OnRequest)
+  IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
 bool AppViewGuest::HandleContextMenu(const content::ContextMenuParams& params) {
   if (app_view_guest_delegate_) {
     return app_view_guest_delegate_->HandleContextMenu(web_contents(), params);
   }
   return false;
 }
@@ skipping 61 matching lines @@
   const Extension* guest_extension = enabled_extensions.GetByID(app_id);
   const Extension* embedder_extension =
       enabled_extensions.GetByID(GetOwnerSiteURL().host());
 
   if (!guest_extension || !guest_extension->is_platform_app() ||
       !embedder_extension | !embedder_extension->is_platform_app()) {
     callback.Run(nullptr);
     return;
   }
 
-  pending_response_map.Get().insert(
-      std::make_pair(guest_instance_id(),
-                     make_linked_ptr(new ResponseInfo(
-                                        guest_extension,
-                                        weak_ptr_factory_.GetWeakPtr(),
-                                        callback))));
+  pending_response_map.Get().insert(std::make_pair(
+      guest_instance_id(),
+      make_linked_ptr(new ResponseInfo(
+          guest_extension, weak_ptr_factory_.GetWeakPtr(), callback))));
 
   LazyBackgroundTaskQueue* queue =
       LazyBackgroundTaskQueue::Get(browser_context());
   if (queue->ShouldEnqueueTask(browser_context(), guest_extension)) {
     queue->AddPendingTask(browser_context(),
                           guest_extension->id(),
                           base::Bind(
                               &AppViewGuest::LaunchAppAndFireEvent,
                               weak_ptr_factory_.GetWeakPtr(),
                               base::Passed(make_scoped_ptr(data->DeepCopy())),
@@ skipping 69 matching lines @@
   embed_request->SetString(appview::kEmbedderID, owner_host());
   embed_request->Set(appview::kData, data.release());
   AppRuntimeEventRouter::DispatchOnEmbedRequestedEvent(
       browser_context(), embed_request.Pass(), extension_host->extension());
 }
 
 void AppViewGuest::SetAppDelegateForTest(AppDelegate* delegate) {
   app_delegate_.reset(delegate);
 }
 
+// static
+void AppViewGuest::AddFakeRequestInfoForTesting(
+    const Extension* guest_extension,
+    AppViewGuest* app_view_guest,
+    GuestViewBase::WebContentsCreatedCallback& callback,
+    int guest_instance_id) {
+  pending_response_map.Get().insert(std::make_pair(
+      guest_instance_id,
+      make_linked_ptr(new ResponseInfo(
+          guest_extension, app_view_guest->weak_ptr_factory_.GetWeakPtr(),
+          callback))));
+}
+
 }  // namespace extensions