Reland of [Background Sync] Allow sync manager access from uncontrolled clients

content/common/background_sync_service.mojom

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 module content;
 
 import "content/public/common/background_sync.mojom";
 import "content/public/common/permission_status.mojom";
 import "content/public/common/service_worker_event_status.mojom";
 
 enum BackgroundSyncError {
   NONE,
   STORAGE,
   NOT_FOUND,
   NO_SERVICE_WORKER,
   NOT_ALLOWED,
   MAX=NOT_ALLOWED
 };
 
 interface BackgroundSyncService {
-  Register(SyncRegistration options, int64 service_worker_registration_id)
+  Register(SyncRegistration options, int64 service_worker_registration_id,
+           bool requested_from_service_worker)

[Tom Sepez, 2015/08/31 18:58:13]

Is this sent by both renderers and SWs?  If so, what happens if the untrusted
processes lies about this value?

[iclelland, 2015/08/31 19:16:29]

This value is sent by the renderer, based on whether the request to register is
coming from a service worker thread (true) or a document/web-worker thread
(false). To prevent abuse of the BackgroundSync API, we want to restrict
registrations coming from service workers -- only workers with a controlled
document are allowed to register sync events. This stops a service worker from
being able to "chain" one-shot syncs into de facto periodic syncs, and also
doesn't force web developers to put all of their JS code into the document.

If a compromised renderer can lie about this, it could say 'false' when sending
a request, and the browser would allow a sync event to be registered for an
origin, even if there was no associated open document window. (All of the other
relevant permissions for that origin would still be checked, though; it is just
the "not from a SW" flag that is being trusted here).

(Also, if the compromised renderer has an open document at that origin, with an
installed service worker, then there is no change in behaviour; the registration
would be allowed anyway. This only matters if the service worker is running in
the background already)

       => (BackgroundSyncError err, SyncRegistration options);
   GetRegistration(BackgroundSyncPeriodicity periodicity, string tag,
                   int64 service_worker_registration_id)
       => (BackgroundSyncError err, SyncRegistration? registration);
   GetRegistrations(BackgroundSyncPeriodicity periodicity,
                    int64 service_worker_registration_id)
       => (BackgroundSyncError err, array<SyncRegistration> registrations);
   Unregister(BackgroundSyncPeriodicity periodicity, int64 id, string tag,
              int64 service_worker_registration_id) => (BackgroundSyncError err);
   GetPermissionStatus(BackgroundSyncPeriodicity periodicity,
                       int64 service_worker_registration_id)
       => (BackgroundSyncError err, PermissionStatus status);
 };
 
 interface BackgroundSyncServiceClient {
   Sync(SyncRegistration registration)
       => (ServiceWorkerEventStatus status);
 };