Adds better security checking to OnCreatedFrame()

components/web_view/frame.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_WEB_VIEW_FRAME_H_
 #define COMPONENTS_WEB_VIEW_FRAME_H_
 
 #include <map>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
+#include "components/view_manager/public/cpp/types.h"
 #include "components/view_manager/public/cpp/view_observer.h"
 #include "components/web_view/public/interfaces/frame_tree.mojom.h"
 #include "third_party/mojo/src/mojo/public/cpp/bindings/binding.h"
 
 namespace web_view {
 
 class FrameTree;
 class FrameTreeClient;
 class FrameUserData;
 
@@ skipping 31 matching lines @@
   Frame(FrameTree* tree,
         mojo::View* view,
         uint32_t frame_id,
         uint32_t app_id,
         ViewOwnership view_ownership,
         FrameTreeClient* frame_tree_client,
         scoped_ptr<FrameUserData> user_data,
         const ClientPropertyMap& client_properties);
   ~Frame() override;
 
-  void Init(Frame* parent);
+  void Init(Frame* parent, mojo::ViewTreeClientPtr view_tree_client);
 
   // Walks the View tree starting at |view| going up returning the first
   // Frame that is associated with |view|. For example, if |view|
   // has a Frame associated with it, then that is returned. Otherwise
   // this checks view->parent() and so on.
   static Frame* FindFirstFrameAncestor(mojo::View* view);
 
   FrameTree* tree() { return tree_; }
 
   Frame* parent() { return parent_; }
@@ skipping 42 matching lines @@
   // |frame_tree_server_binding| contains the current FrameTreeServerBinding
   // (if any) and is destroyed after the connection responds to OnConnect().
   //
   // If |client_type| is SAME_APP we can't destroy the existing client
   // (and related data) until we get back the ack from OnConnect(). This way
   // we know the client has completed the switch. If we did not do this it
   // would be possible for the app to see it's existing FrameTreeServer
   // connection lost (and assume the frame is being torn down) before the
   // OnConnect().
   void InitClient(ClientType client_type,
-                  scoped_ptr<FrameTreeServerBinding> frame_tree_server_binding);
+                  scoped_ptr<FrameTreeServerBinding> frame_tree_server_binding,
+                  mojo::ViewTreeClientPtr view_tree_client);
 
   // Callback from OnConnect(). This does nothing (other than destroying
   // |frame_tree_server_binding|). See InitClient() for details as to why
   // destruction of |frame_tree_server_binding| happens after OnConnect().
   static void OnConnectAck(
       scoped_ptr<FrameTreeServerBinding> frame_tree_server_binding);
 
+  // Callback from OnEmbed().
+  void OnEmbedAck(bool success, mojo::ConnectionSpecificId connection_id);
+
   // Completes a navigation request; swapping the existing FrameTreeClient to
   // the supplied arguments.
   void ChangeClient(FrameTreeClient* frame_tree_client,
                     scoped_ptr<FrameUserData> user_data,
                     mojo::ViewTreeClientPtr view_tree_client,
                     uint32 app_id);
 
   void SetView(mojo::View* view);
 
   // Returns the first ancestor (starting at |this|) that has a
@@ skipping 60 matching lines @@
       uint32_t frame_id,
       mojo::Map<mojo::String, mojo::Array<uint8_t>> client_properties) override;
   void RequestNavigate(NavigationTargetType target_type,
                        uint32_t target_frame_id,
                        mojo::URLRequestPtr request) override;
   void DidNavigateLocally(uint32_t frame_id, const mojo::String& url) override;
 
   FrameTree* const tree_;
   // WARNING: this may be null. See class description for details.
   mojo::View* view_;
+  // The connection id returned from ViewManager::Embed(). Frames created by
+  // way of OnCreatedFrame() inherit the id from the parent.
+  mojo::ConnectionSpecificId embedded_connection_id_;
   // ID for the frame, which is the same as that of the view.
   const uint32_t id_;
   // ID of the app providing the FrameTreeClient and ViewTreeClient.
   uint32_t app_id_;
   Frame* parent_;
   ViewOwnership view_ownership_;
   std::vector<Frame*> children_;
   scoped_ptr<FrameUserData> user_data_;
 
   // WARNING: this may be null. See class description for details.
   FrameTreeClient* frame_tree_client_;
 
   bool loading_;
   double progress_;
 
   ClientPropertyMap client_properties_;
 
   // StartNavigate() stores the request here if the view isn't available at
   // the time of StartNavigate().
   mojo::URLRequestPtr pending_navigate_;
 
   scoped_ptr<mojo::Binding<FrameTreeServer>> frame_tree_server_binding_;
 
-  base::WeakPtrFactory<Frame> weak_factory_;
+  base::WeakPtrFactory<Frame> embed_weak_ptr_factory_;
 
   base::WeakPtrFactory<Frame> navigate_weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(Frame);
 };
 
 }  // namespace web_view
 
 #endif  // COMPONENTS_WEB_VIEW_FRAME_H_