Adds better security checking to OnCreatedFrame()

components/web_view/frame.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/web_view/frame.h"
 
 #include <algorithm>
 
 #include "base/auto_reset.h"
 #include "base/bind.h"
@@ skipping 11 matching lines @@
 DECLARE_VIEW_PROPERTY_TYPE(web_view::Frame*);
 
 namespace web_view {
 
 // Used to find the Frame associated with a View.
 DEFINE_LOCAL_VIEW_PROPERTY_KEY(Frame*, kFrame, nullptr);
 
 namespace {
 
 const uint32_t kNoParentId = 0u;
+const mojo::ConnectionSpecificId kInvalidConnectionId = 0u;
 
 FrameDataPtr FrameToFrameData(const Frame* frame) {
   FrameDataPtr frame_data(FrameData::New());
   frame_data->frame_id = frame->id();
   frame_data->parent_id = frame->parent() ? frame->parent()->id() : kNoParentId;
   frame_data->client_properties =
       mojo::Map<mojo::String, mojo::Array<uint8_t>>::From(
           frame->client_properties());
   return frame_data.Pass();
 }
 
 }  // namespace
 
 struct Frame::FrameTreeServerBinding {
   scoped_ptr<FrameUserData> user_data;
   scoped_ptr<mojo::Binding<FrameTreeServer>> frame_tree_server_binding;
 };
 
 Frame::Frame(FrameTree* tree,
              View* view,
              uint32_t frame_id,
              uint32_t app_id,
              ViewOwnership view_ownership,
              FrameTreeClient* frame_tree_client,
              scoped_ptr<FrameUserData> user_data,
              const ClientPropertyMap& client_properties)
     : tree_(tree),
       view_(nullptr),
+      embedded_connection_id_(kInvalidConnectionId),
       id_(frame_id),
       app_id_(app_id),
       parent_(nullptr),
       view_ownership_(view_ownership),
       user_data_(user_data.Pass()),
       frame_tree_client_(frame_tree_client),
       loading_(false),
       progress_(0.f),
       client_properties_(client_properties),
-      weak_factory_(this),
+      embed_weak_ptr_factory_(this),
       navigate_weak_ptr_factory_(this) {
   if (view)
     SetView(view);
 }
 
 Frame::~Frame() {
   if (view_)
     view_->RemoveObserver(this);
   while (!children_.empty())
     delete children_[0];
   if (parent_)
     parent_->Remove(this);
   if (view_) {
     view_->ClearLocalProperty(kFrame);
     if (view_ownership_ == ViewOwnership::OWNS_VIEW)
       view_->Destroy();
   }
 }
 
-void Frame::Init(Frame* parent) {
+void Frame::Init(Frame* parent, mojo::ViewTreeClientPtr view_tree_client) {
   {
     // Set the FrameTreeClient to null so that we don't notify the client of the
     // add before OnConnect().
     base::AutoReset<FrameTreeClient*> frame_tree_client_resetter(
         &frame_tree_client_, nullptr);
     if (parent)
       parent->Add(this);
   }
 
-  InitClient(ClientType::NEW_APP, nullptr);
+  InitClient(ClientType::NEW_APP, nullptr, view_tree_client.Pass());
 }
 
 // static
 Frame* Frame::FindFirstFrameAncestor(View* view) {
   while (view && !view->GetLocalProperty(kFrame))
     view = view->parent();
   return view ? view->GetLocalProperty(kFrame) : nullptr;
 }
 
 const Frame* Frame::FindFrame(uint32_t id) const {
@@ skipping 28 matching lines @@
 double Frame::GatherProgress(int* frame_count) const {
   ++(*frame_count);
   double progress = progress_;
   for (const Frame* child : children_)
     progress += child->GatherProgress(frame_count);
   return progress_;
 }
 
 void Frame::InitClient(
     ClientType client_type,
-    scoped_ptr<FrameTreeServerBinding> frame_tree_server_binding) {
+    scoped_ptr<FrameTreeServerBinding> frame_tree_server_binding,
+    mojo::ViewTreeClientPtr view_tree_client) {
+  if (client_type == ClientType::NEW_APP && view_tree_client.get()) {
+    embedded_connection_id_ = kInvalidConnectionId;
+    embed_weak_ptr_factory_.InvalidateWeakPtrs();
+    view_->Embed(
+        view_tree_client.Pass(),
+        base::Bind(&Frame::OnEmbedAck, embed_weak_ptr_factory_.GetWeakPtr()));
+  }
+
   std::vector<const Frame*> frames;
   tree_->root()->BuildFrameTree(&frames);
 
   mojo::Array<FrameDataPtr> array(frames.size());
   for (size_t i = 0; i < frames.size(); ++i)
     array[i] = FrameToFrameData(frames[i]).Pass();
 
   // TODO(sky): error handling.
   FrameTreeServerPtr frame_tree_server_ptr;
   frame_tree_server_binding_.reset(new mojo::Binding<FrameTreeServer>(
@@ skipping 33 matching lines @@
         frame_tree_server_binding_.Pass();
   }
 
   user_data_ = user_data.Pass();
   frame_tree_client_ = frame_tree_client;
   frame_tree_server_binding_.reset();
   loading_ = false;
   progress_ = 0.f;
   app_id_ = app_id;
 
-  if (client_type == ClientType::NEW_APP)
-    view_->Embed(view_tree_client.Pass());
+  InitClient(client_type, frame_tree_server_binding.Pass(),
+             view_tree_client.Pass());
+}
 
-  InitClient(client_type, frame_tree_server_binding.Pass());
+void Frame::OnEmbedAck(bool success, mojo::ConnectionSpecificId connection_id) {
+  if (success)
+    embedded_connection_id_ = connection_id;
 }
 
 void Frame::SetView(mojo::View* view) {
   DCHECK(!view_);
   DCHECK_EQ(id_, view->id());
   view_ = view;
   view_->SetLocalProperty(kFrame, this);
   view_->AddObserver(this);
   if (pending_navigate_.get())
     StartNavigate(pending_navigate_.Pass());
@@ skipping 177 matching lines @@
 }
 
 void Frame::OnViewDestroying(mojo::View* view) {
   if (parent_)
     parent_->Remove(this);
 
   // Reset |view_ownership_| so we don't attempt to delete |view_| in the
   // destructor.
   view_ownership_ = ViewOwnership::DOESNT_OWN_VIEW;
 
-  // TODO(sky): Change browser to create a child for each FrameTree.
   if (tree_->root() == this) {
     view_->RemoveObserver(this);
     view_ = nullptr;
     return;
   }
 
   delete this;
 }
 
 void Frame::PostMessageEventToFrame(uint32_t source_frame_id,
@@ skipping 42 matching lines @@
                               mojo::Array<uint8_t> value) {
   Frame* target_frame = FindFrameWithIdFromSameApp(frame_id);
   if (target_frame)
     target_frame->SetClientPropertyImpl(name, value.Pass());
 }
 
 void Frame::OnCreatedFrame(
     uint32_t parent_id,
     uint32_t frame_id,
     mojo::Map<mojo::String, mojo::Array<uint8_t>> client_properties) {
-  // TODO(sky): I need a way to verify the frame_id. Unfortunately the code here
-  // doesn't know the connection id of the embedder, so it's not possible to
-  // do it.
+  if ((frame_id >> 16) != embedded_connection_id_) {
+    // TODO(sky): kill connection here?
+    // TODO(sky): there is a race in that there is no guarantee we received the
+    // connection id before the frame tries to create a new frame. Ideally we
+    // could pause the frame until we get the connection id, but bindings don't
+    // offer such an API.
+    DVLOG(1) << "OnCreatedFrame supplied invalid frame id, expecting"
+             << embedded_connection_id_;
+    return;
+  }
 
   if (FindFrame(frame_id)) {
     // TODO(sky): kill connection here?
-    DVLOG(1) << "OnCreatedLocalFrame supplied id of existing frame.";
+    DVLOG(1) << "OnCreatedFrame supplied id of existing frame.";
     return;
   }
 
   Frame* parent_frame = FindFrameWithIdFromSameApp(parent_id);
   if (!parent_frame) {
-    DVLOG(1) << "OnCreatedLocalFrame supplied invalid parent_id.";
+    DVLOG(1) << "OnCreatedFrame supplied invalid parent_id.";
     return;
   }
 
-  if (parent_frame != this && parent_frame->frame_tree_client_) {
-    DVLOG(1) << "OnCreatedLocalFrame supplied parent from another connection.";
-    return;
-  }
-
-  tree_->CreateSharedFrame(parent_frame, frame_id, app_id_,
-                           client_properties.To<ClientPropertyMap>());
+  Frame* child_frame =
+      tree_->CreateSharedFrame(parent_frame, frame_id, app_id_,
+                               client_properties.To<ClientPropertyMap>());
+  child_frame->embedded_connection_id_ = embedded_connection_id_;
 }
 
 void Frame::RequestNavigate(NavigationTargetType target_type,
                             uint32_t target_frame_id,
                             mojo::URLRequestPtr request) {
   if (target_type == NAVIGATION_TARGET_TYPE_EXISTING_FRAME) {
     // |target_frame| is allowed to come from another connection.
     Frame* target_frame = tree_->root()->FindFrame(target_frame_id);
     if (!target_frame) {
       DVLOG(1) << "RequestNavigate EXIT_FRAME with no matching frame";
       return;
     }
     if (target_frame != tree_->root()) {
       target_frame->StartNavigate(request.Pass());
       return;
     }
     // Else case if |target_frame| == root. Treat at top level request.
   }
   tree_->delegate_->NavigateTopLevel(this, request.Pass());
 }
 
 void Frame::DidNavigateLocally(uint32_t frame_id, const mojo::String& url) {
   NOTIMPLEMENTED();
 }
 
 }  // namespace web_view