Use CapabilityFilter to restrict what HTMLViewers can connect to.

mandoline/tab/frame_connection.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mandoline/tab/frame_connection.h"
 
 #include "mojo/application/public/cpp/application_connection.h"
 #include "mojo/application/public/cpp/application_impl.h"
 
 namespace mandoline {
 
 FrameConnection::FrameConnection() : application_connection_(nullptr) {
 }
 
 FrameConnection::~FrameConnection() {
 }
 
 void FrameConnection::Init(mojo::ApplicationImpl* app,
                            mojo::URLRequestPtr request,
                            mojo::ViewManagerClientPtr* view_manage_client) {
   DCHECK(!application_connection_);
-  application_connection_ = app->ConnectToApplication(request.Pass());
+
+  mojo::CapabilityFilterPtr filter(mojo::CapabilityFilter::New());
+  mojo::Array<mojo::String> resource_provider_interfaces;
+  resource_provider_interfaces.push_back("resource_provider::ResourceProvider");
+  filter->filter.insert("mojo:resource_provider",
+                        resource_provider_interfaces.Pass());
+
+  mojo::Array<mojo::String> network_service_interfaces;
+  network_service_interfaces.push_back("mojo::NetworkService");

[sky, 2015/08/12 20:36:16]

This strikes me as very fragile. If someone renames the classes we won't
immediately see a failure. Do you think it worth getting the name from the
interface directly? Eg:

network_service_interfaces.push_back(NetworkService::Name_);

The down side is this code would have to depend upon all the interfaces, but
that seems way less fragile. WDYT?

+  network_service_interfaces.push_back("mojo::URLLoaderFactory");
+  filter->filter.insert("mojo:network_service",
+                        network_service_interfaces.Pass());
+
+  mojo::Array<mojo::String> clipboard_interfaces;
+  clipboard_interfaces.push_back("mojo::Clipboard");
+  filter->filter.insert("mojo:clipboard", clipboard_interfaces.Pass());
+
+  mojo::Array<mojo::String> surfaces_interfaces;
+  surfaces_interfaces.push_back("mojo::DisplayFactory");
+  surfaces_interfaces.push_back("mojo::Surface");
+  filter->filter.insert("mojo:surfaces_service", surfaces_interfaces.Pass());
+
+  mojo::Array<mojo::String> view_manager_interfaces;
+  view_manager_interfaces.push_back("mojo::Gpu");
+  view_manager_interfaces.push_back("mojo::ViewManagerRoot");
+  filter->filter.insert("mojo:view_manager", view_manager_interfaces.Pass());
+
+  mojo::Array<mojo::String> devtools_interfaces;
+  devtools_interfaces.push_back("devtools_service::DevToolsRegistry");
+  filter->filter.insert("mojo:devtools_service", devtools_interfaces.Pass());
+
+  application_connection_ = app->ConnectToApplicationWithCapabilityFilter(
+      request.Pass(), filter.Pass());
   application_connection_->ConnectToService(view_manage_client);
   application_connection_->ConnectToService(&frame_tree_client_);
   frame_tree_client_.set_connection_error_handler([]() {
     // TODO(sky): implement this.
     NOTIMPLEMENTED();
   });
 }
 
 }  // namespace mandoline