Use CapabilityFilter to restrict what HTMLViewers can connect to.

mojo/shell/application_instance.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/shell/application_instance.h"
 
 #include "base/bind.h"
 #include "base/stl_util.h"
 #include "mojo/application/public/interfaces/content_handler.mojom.h"
 #include "mojo/common/common_type_converters.h"
 #include "mojo/common/url_type_converters.h"
 #include "mojo/shell/application_manager.h"
 
 namespace mojo {
 namespace shell {
 
+// It's valid to specify mojo: URLs in the filter either as mojo:foo or
+// mojo://foo/ - but we store the filter in the latter form.
+CapabilityFilter CanonicalizeFilter(const CapabilityFilter& filter) {
+  CapabilityFilter canonicalized;
+  for (CapabilityFilter::const_iterator it = filter.begin();
+       it != filter.end();
+       ++it) {
+    if (it->first == "*")
+      canonicalized[it->first] = it->second;
+    else
+      canonicalized[GURL(it->first).spec()] = it->second;
+  }
+  return canonicalized;
+}
+
 ApplicationInstance::QueuedClientRequest::QueuedClientRequest()
     : originator(nullptr) {}
 
 ApplicationInstance::QueuedClientRequest::~QueuedClientRequest() {
 }
 
 ApplicationInstance::ApplicationInstance(
     ApplicationPtr application,
     ApplicationManager* manager,
     const Identity& originator_identity,
     const Identity& identity,
     const CapabilityFilter& filter,
     const base::Closure& on_application_end)
     : manager_(manager),
       originator_identity_(originator_identity),
       identity_(identity),
-      filter_(filter),
+      filter_(CanonicalizeFilter(filter)),
       allow_any_application_(filter.size() == 1 && filter.count("*") == 1),
       on_application_end_(on_application_end),
       application_(application.Pass()),
       binding_(this),
       queue_requests_(false) {
   binding_.set_connection_error_handler([this]() { OnConnectionError(); });
 }
 
 ApplicationInstance::~ApplicationInstance() {
   STLDeleteElements(&queued_client_requests_);
@@ skipping 44 matching lines @@
   return AllowedInterfaces();
 }
 
 // Shell implementation:
 void ApplicationInstance::ConnectToApplication(
     URLRequestPtr app_request,
     InterfaceRequest<ServiceProvider> services,
     ServiceProviderPtr exposed_services,
     CapabilityFilterPtr filter) {
   std::string url_string = app_request->url.To<std::string>();
-  if (!GURL(url_string).is_valid()) {
+  GURL url(url_string);
+  if (!url.is_valid()) {
     LOG(ERROR) << "Error: invalid URL: " << url_string;
     return;
   }
-  if (allow_any_application_ || filter_.find(url_string) != filter_.end()) {
+  if (allow_any_application_ || filter_.find(url.spec()) != filter_.end()) {
     CapabilityFilter capability_filter = GetPermissiveCapabilityFilter();
     if (!filter.is_null())
       capability_filter = filter->filter.To<CapabilityFilter>();
     manager_->ConnectToApplication(this, app_request.Pass(), std::string(),
                                    identity_.url, services.Pass(),
                                    exposed_services.Pass(), capability_filter,
                                    base::Closure());
   } else {
-    DVLOG(1) << "CapabilityFilter prevented connection from: " <<
-        identity_.url << " to: " << url_string;
+    LOG(WARNING) << "CapabilityFilter prevented connection from: " <<
+        identity_.url << " to: " << url.spec();
   }
 }
 
 void ApplicationInstance::QuitApplication() {
   queue_requests_ = true;
   application_->OnQuitRequested(
       base::Bind(&ApplicationInstance::OnQuitRequestedResult,
                  base::Unretained(this)));
 }
 
@@ skipping 48 matching lines @@
                          request->requestor_url,
                          request->services.Pass(),
                          request->exposed_services.Pass(),
                          request->requested_url);
   }
   STLDeleteElements(&queued_client_requests_);
 }
 
 }  // namespace shell
 }  // namespace mojo