Allow trusted brokers to restrict connections for spawned applications to whitelisted applications …

mojo/application/public/cpp/lib/application_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/application/public/cpp/application_impl.h"
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/message_loop/message_loop.h"
 #include "mojo/application/public/cpp/application_delegate.h"
 #include "mojo/application/public/cpp/lib/service_registry.h"
 #include "mojo/public/cpp/bindings/interface_ptr.h"
 #include "mojo/public/cpp/environment/logging.h"
 
 namespace mojo {
 
 namespace {
 
 void DefaultTerminationClosure() {
   if (base::MessageLoop::current() &&
       base::MessageLoop::current()->is_running())
     base::MessageLoop::current()->Quit();
 }
 
 }  // namespace
 
+template <typename E, typename T>
+struct TypeConverter<std::set<E>, Array<T>> {
+  static std::set<E> Convert(const Array<T>& input) {
+    std::set<E> result;
+    if (!input.is_null()) {
+      for (size_t i = 0; i < input.size(); ++i)
+        result.insert(TypeConverter<E, T>::Convert(input[i]));
+    }
+    return result;
+  }
+};
+
 ApplicationImpl::ApplicationImpl(ApplicationDelegate* delegate,
                                  InterfaceRequest<Application> request)
     : ApplicationImpl(delegate, request.Pass(),
                       base::Bind(&DefaultTerminationClosure)) {
 }
 
 ApplicationImpl::ApplicationImpl(ApplicationDelegate* delegate,
                                  InterfaceRequest<Application> request,
                                  const base::Closure& termination_closure)
     : delegate_(delegate),
@@ skipping 20 matching lines @@
 }
 
 ApplicationImpl::~ApplicationImpl() {
   DCHECK(!in_destructor_);
   in_destructor_ = true;
   ClearConnections();
   app_lifetime_helper_.ApplicationTerminated();
 }
 
 ApplicationConnection* ApplicationImpl::ConnectToApplication(
-    mojo::URLRequestPtr request) {
+    mojo::URLRequestPtr request,
+    CapabilityFilterPtr filter) {
   if (!shell_)
     return nullptr;
   ServiceProviderPtr local_services;
   InterfaceRequest<ServiceProvider> local_request = GetProxy(&local_services);
   ServiceProviderPtr remote_services;
   std::string application_url = request->url.To<std::string>();
   shell_->ConnectToApplication(request.Pass(), GetProxy(&remote_services),
-                               local_services.Pass());
+                               local_services.Pass(), filter.Pass());
+  // We allow all interfaces on outgoing connections since we are presumably in
+  // a position to know who we're talking to.
+  // TODO(beng): is this a valid assumption or do we need to figure some way to
+  //             filter here too?
+  std::set<std::string> allowed;
+  allowed.insert("*");
   internal::ServiceRegistry* registry = new internal::ServiceRegistry(
       this, application_url, application_url, remote_services.Pass(),
-      local_request.Pass());
+      local_request.Pass(), allowed);
   if (!delegate_->ConfigureOutgoingConnection(registry)) {
     registry->CloseConnection();
     return nullptr;
   }
   outgoing_service_registries_.push_back(registry);
   return registry;
 }
 
 void ApplicationImpl::CloseConnection(ApplicationConnection* connection) {
   if (!in_destructor_)
@@ skipping 44 matching lines @@
 
 void ApplicationImpl::QuitNow() {
   delegate_->Quit();
   termination_closure_.Run();
 }
 
 void ApplicationImpl::AcceptConnection(
     const String& requestor_url,
     InterfaceRequest<ServiceProvider> services,
     ServiceProviderPtr exposed_services,
+    Array<String> allowed_interfaces,
     const String& url) {
   internal::ServiceRegistry* registry = new internal::ServiceRegistry(
-      this, url, requestor_url, exposed_services.Pass(), services.Pass());
+      this, url, requestor_url, exposed_services.Pass(), services.Pass(),
+      allowed_interfaces.To<std::set<std::string>>());
   if (!delegate_->ConfigureIncomingConnection(registry)) {
     registry->CloseConnection();
     return;
   }
   incoming_service_registries_.push_back(registry);
 
   // If we were quitting because we thought there were no more services for this
   // app in use, then that has changed so cancel the quit request.
   if (quit_requested_)
     quit_requested_ = false;
@@ skipping 17 matching lines @@
   // than the one to the shell.
   bool quit_now = delegate_->OnShellConnectionError();
   if (quit_now)
     QuitNow();
   if (!ptr)
     return;
   shell_ = nullptr;
 }
 
 }  // namespace mojo