OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/browser/renderer_host/render_view_host_impl.h" | 5 #include "content/browser/renderer_host/render_view_host_impl.h" |
6 | 6 |
7 #include <set> | 7 #include <set> |
8 #include <string> | 8 #include <string> |
9 #include <utility> | 9 #include <utility> |
10 #include <vector> | 10 #include <vector> |
(...skipping 25 matching lines...) Expand all Loading... |
36 #include "content/browser/loader/resource_dispatcher_host_impl.h" | 36 #include "content/browser/loader/resource_dispatcher_host_impl.h" |
37 #include "content/browser/renderer_host/dip_util.h" | 37 #include "content/browser/renderer_host/dip_util.h" |
38 #include "content/browser/renderer_host/media/audio_renderer_host.h" | 38 #include "content/browser/renderer_host/media/audio_renderer_host.h" |
39 #include "content/browser/renderer_host/render_process_host_impl.h" | 39 #include "content/browser/renderer_host/render_process_host_impl.h" |
40 #include "content/browser/renderer_host/render_view_host_delegate.h" | 40 #include "content/browser/renderer_host/render_view_host_delegate.h" |
41 #include "content/common/accessibility_messages.h" | 41 #include "content/common/accessibility_messages.h" |
42 #include "content/common/browser_plugin/browser_plugin_messages.h" | 42 #include "content/common/browser_plugin/browser_plugin_messages.h" |
43 #include "content/common/content_switches_internal.h" | 43 #include "content/common/content_switches_internal.h" |
44 #include "content/common/desktop_notification_messages.h" | 44 #include "content/common/desktop_notification_messages.h" |
45 #include "content/common/drag_messages.h" | 45 #include "content/common/drag_messages.h" |
| 46 #include "content/common/frame_messages.h" |
46 #include "content/common/input_messages.h" | 47 #include "content/common/input_messages.h" |
47 #include "content/common/inter_process_time_ticks_converter.h" | 48 #include "content/common/inter_process_time_ticks_converter.h" |
48 #include "content/common/speech_recognition_messages.h" | 49 #include "content/common/speech_recognition_messages.h" |
49 #include "content/common/swapped_out_messages.h" | 50 #include "content/common/swapped_out_messages.h" |
50 #include "content/common/view_messages.h" | 51 #include "content/common/view_messages.h" |
51 #include "content/port/browser/render_view_host_delegate_view.h" | 52 #include "content/port/browser/render_view_host_delegate_view.h" |
52 #include "content/port/browser/render_widget_host_view_port.h" | 53 #include "content/port/browser/render_widget_host_view_port.h" |
53 #include "content/public/browser/browser_accessibility_state.h" | 54 #include "content/public/browser/browser_accessibility_state.h" |
54 #include "content/public/browser/browser_context.h" | 55 #include "content/public/browser/browser_context.h" |
55 #include "content/public/browser/browser_message_filter.h" | 56 #include "content/public/browser/browser_message_filter.h" |
(...skipping 1157 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1213 bool handled = true; | 1214 bool handled = true; |
1214 bool msg_is_ok = true; | 1215 bool msg_is_ok = true; |
1215 IPC_BEGIN_MESSAGE_MAP_EX(RenderViewHostImpl, msg, msg_is_ok) | 1216 IPC_BEGIN_MESSAGE_MAP_EX(RenderViewHostImpl, msg, msg_is_ok) |
1216 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowView, OnShowView) | 1217 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowView, OnShowView) |
1217 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowWidget, OnShowWidget) | 1218 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowWidget, OnShowWidget) |
1218 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowFullscreenWidget, | 1219 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowFullscreenWidget, |
1219 OnShowFullscreenWidget) | 1220 OnShowFullscreenWidget) |
1220 IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunModal, OnRunModal) | 1221 IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunModal, OnRunModal) |
1221 IPC_MESSAGE_HANDLER(ViewHostMsg_RenderViewReady, OnRenderViewReady) | 1222 IPC_MESSAGE_HANDLER(ViewHostMsg_RenderViewReady, OnRenderViewReady) |
1222 IPC_MESSAGE_HANDLER(ViewHostMsg_RenderProcessGone, OnRenderProcessGone) | 1223 IPC_MESSAGE_HANDLER(ViewHostMsg_RenderProcessGone, OnRenderProcessGone) |
1223 IPC_MESSAGE_HANDLER_GENERIC(ViewHostMsg_FrameNavigate, OnNavigate(msg)) | |
1224 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateState, OnUpdateState) | 1224 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateState, OnUpdateState) |
1225 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTitle, OnUpdateTitle) | 1225 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTitle, OnUpdateTitle) |
1226 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateEncoding, OnUpdateEncoding) | 1226 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateEncoding, OnUpdateEncoding) |
1227 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTargetURL, OnUpdateTargetURL) | 1227 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTargetURL, OnUpdateTargetURL) |
1228 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateInspectorSetting, | 1228 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateInspectorSetting, |
1229 OnUpdateInspectorSetting) | 1229 OnUpdateInspectorSetting) |
1230 IPC_MESSAGE_HANDLER(ViewHostMsg_Close, OnClose) | 1230 IPC_MESSAGE_HANDLER(ViewHostMsg_Close, OnClose) |
1231 IPC_MESSAGE_HANDLER(ViewHostMsg_RequestMove, OnRequestMove) | 1231 IPC_MESSAGE_HANDLER(ViewHostMsg_RequestMove, OnRequestMove) |
1232 IPC_MESSAGE_HANDLER(ViewHostMsg_DidStartLoading, OnDidStartLoading) | 1232 IPC_MESSAGE_HANDLER(ViewHostMsg_DidStartLoading, OnDidStartLoading) |
1233 IPC_MESSAGE_HANDLER(ViewHostMsg_DidStopLoading, OnDidStopLoading) | 1233 IPC_MESSAGE_HANDLER(ViewHostMsg_DidStopLoading, OnDidStopLoading) |
(...skipping 193 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1427 } | 1427 } |
1428 | 1428 |
1429 void RenderViewHostImpl::OnDidStartProvisionalLoadForFrame( | 1429 void RenderViewHostImpl::OnDidStartProvisionalLoadForFrame( |
1430 int64 frame_id, | 1430 int64 frame_id, |
1431 int64 parent_frame_id, | 1431 int64 parent_frame_id, |
1432 bool is_main_frame, | 1432 bool is_main_frame, |
1433 const GURL& url) { | 1433 const GURL& url) { |
1434 NOTREACHED(); | 1434 NOTREACHED(); |
1435 } | 1435 } |
1436 | 1436 |
1437 // Called when the renderer navigates. For every frame loaded, we'll get this | |
1438 // notification containing parameters identifying the navigation. | |
1439 // | |
1440 // Subframes are identified by the page transition type. For subframes loaded | |
1441 // as part of a wider page load, the page_id will be the same as for the top | |
1442 // level frame. If the user explicitly requests a subframe navigation, we will | |
1443 // get a new page_id because we need to create a new navigation entry for that | |
1444 // action. | |
1445 void RenderViewHostImpl::OnNavigate(const IPC::Message& msg) { | 1437 void RenderViewHostImpl::OnNavigate(const IPC::Message& msg) { |
1446 // Read the parameters out of the IPC message directly to avoid making another | 1438 // TODO(nasko): Forward calls to the top level RenderFrameHost until all |
1447 // copy when we filter the URLs. | 1439 // callers of this method on RenderViewHost are removed. |
1448 PickleIterator iter(msg); | 1440 delegate_->GetFrameTree()->GetMainFrame()->OnMessageReceived(msg); |
1449 ViewHostMsg_FrameNavigate_Params validated_params; | |
1450 if (!IPC::ParamTraits<ViewHostMsg_FrameNavigate_Params>:: | |
1451 Read(&msg, &iter, &validated_params)) | |
1452 return; | |
1453 | |
1454 // If we're waiting for a cross-site beforeunload ack from this renderer and | |
1455 // we receive a Navigate message from the main frame, then the renderer was | |
1456 // navigating already and sent it before hearing the ViewMsg_Stop message. | |
1457 // We do not want to cancel the pending navigation in this case, since the | |
1458 // old page will soon be stopped. Instead, treat this as a beforeunload ack | |
1459 // to allow the pending navigation to continue. | |
1460 if (is_waiting_for_beforeunload_ack_ && | |
1461 unload_ack_is_for_cross_site_transition_ && | |
1462 PageTransitionIsMainFrame(validated_params.transition)) { | |
1463 OnShouldCloseACK(true, send_should_close_start_time_, | |
1464 base::TimeTicks::Now()); | |
1465 return; | |
1466 } | |
1467 | |
1468 // If we're waiting for an unload ack from this renderer and we receive a | |
1469 // Navigate message, then the renderer was navigating before it received the | |
1470 // unload request. It will either respond to the unload request soon or our | |
1471 // timer will expire. Either way, we should ignore this message, because we | |
1472 // have already committed to closing this renderer. | |
1473 if (is_waiting_for_unload_ack_) | |
1474 return; | |
1475 | |
1476 // Cache the main frame id, so we can use it for creating the frame tree | |
1477 // root node when needed. | |
1478 if (PageTransitionIsMainFrame(validated_params.transition)) { | |
1479 if (main_frame_id_ == -1) { | |
1480 main_frame_id_ = validated_params.frame_id; | |
1481 } else { | |
1482 // TODO(nasko): We plan to remove the usage of frame_id in navigation | |
1483 // and move to routing ids. This is in place to ensure that a | |
1484 // renderer is not misbehaving and sending us incorrect data. | |
1485 DCHECK_EQ(main_frame_id_, validated_params.frame_id); | |
1486 } | |
1487 } | |
1488 RenderProcessHost* process = GetProcess(); | |
1489 | |
1490 // Attempts to commit certain off-limits URL should be caught more strictly | |
1491 // than our FilterURL checks below. If a renderer violates this policy, it | |
1492 // should be killed. | |
1493 if (!CanCommitURL(validated_params.url)) { | |
1494 VLOG(1) << "Blocked URL " << validated_params.url.spec(); | |
1495 validated_params.url = GURL(kAboutBlankURL); | |
1496 RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled")); | |
1497 // Kills the process. | |
1498 process->ReceivedBadMessage(); | |
1499 } | |
1500 | |
1501 // Now that something has committed, we don't need to track whether the | |
1502 // initial page has been accessed. | |
1503 has_accessed_initial_document_ = false; | |
1504 | |
1505 // Without this check, an evil renderer can trick the browser into creating | |
1506 // a navigation entry for a banned URL. If the user clicks the back button | |
1507 // followed by the forward button (or clicks reload, or round-trips through | |
1508 // session restore, etc), we'll think that the browser commanded the | |
1509 // renderer to load the URL and grant the renderer the privileges to request | |
1510 // the URL. To prevent this attack, we block the renderer from inserting | |
1511 // banned URLs into the navigation controller in the first place. | |
1512 process->FilterURL(false, &validated_params.url); | |
1513 process->FilterURL(true, &validated_params.referrer.url); | |
1514 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); | |
1515 it != validated_params.redirects.end(); ++it) { | |
1516 process->FilterURL(false, &(*it)); | |
1517 } | |
1518 process->FilterURL(true, &validated_params.searchable_form_url); | |
1519 | |
1520 // Without this check, the renderer can trick the browser into using | |
1521 // filenames it can't access in a future session restore. | |
1522 if (!CanAccessFilesOfPageState(validated_params.page_state)) { | |
1523 GetProcess()->ReceivedBadMessage(); | |
1524 return; | |
1525 } | |
1526 | |
1527 delegate_->DidNavigate(this, validated_params); | |
1528 } | 1441 } |
1529 | 1442 |
1530 void RenderViewHostImpl::OnUpdateState(int32 page_id, const PageState& state) { | 1443 void RenderViewHostImpl::OnUpdateState(int32 page_id, const PageState& state) { |
1531 // Without this check, the renderer can trick the browser into using | 1444 // Without this check, the renderer can trick the browser into using |
1532 // filenames it can't access in a future session restore. | 1445 // filenames it can't access in a future session restore. |
1533 if (!CanAccessFilesOfPageState(state)) { | 1446 if (!CanAccessFilesOfPageState(state)) { |
1534 GetProcess()->ReceivedBadMessage(); | 1447 GetProcess()->ReceivedBadMessage(); |
1535 return; | 1448 return; |
1536 } | 1449 } |
1537 | 1450 |
(...skipping 418 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1956 #endif | 1869 #endif |
1957 | 1870 |
1958 void RenderViewHostImpl::SendOrientationChangeEvent(int orientation) { | 1871 void RenderViewHostImpl::SendOrientationChangeEvent(int orientation) { |
1959 Send(new ViewMsg_OrientationChangeEvent(GetRoutingID(), orientation)); | 1872 Send(new ViewMsg_OrientationChangeEvent(GetRoutingID(), orientation)); |
1960 } | 1873 } |
1961 | 1874 |
1962 void RenderViewHostImpl::ToggleSpeechInput() { | 1875 void RenderViewHostImpl::ToggleSpeechInput() { |
1963 Send(new InputTagSpeechMsg_ToggleSpeechInput(GetRoutingID())); | 1876 Send(new InputTagSpeechMsg_ToggleSpeechInput(GetRoutingID())); |
1964 } | 1877 } |
1965 | 1878 |
1966 bool RenderViewHostImpl::CanCommitURL(const GURL& url) { | |
1967 // TODO(creis): We should also check for WebUI pages here. Also, when the | |
1968 // out-of-process iframes implementation is ready, we should check for | |
1969 // cross-site URLs that are not allowed to commit in this process. | |
1970 | |
1971 // Give the client a chance to disallow URLs from committing. | |
1972 return GetContentClient()->browser()->CanCommitURL(GetProcess(), url); | |
1973 } | |
1974 | |
1975 void RenderViewHostImpl::ExitFullscreen() { | 1879 void RenderViewHostImpl::ExitFullscreen() { |
1976 RejectMouseLockOrUnlockIfNecessary(); | 1880 RejectMouseLockOrUnlockIfNecessary(); |
1977 // Notify delegate_ and renderer of fullscreen state change. | 1881 // Notify delegate_ and renderer of fullscreen state change. |
1978 OnToggleFullscreen(false); | 1882 OnToggleFullscreen(false); |
1979 } | 1883 } |
1980 | 1884 |
1981 WebPreferences RenderViewHostImpl::GetWebkitPreferences() { | 1885 WebPreferences RenderViewHostImpl::GetWebkitPreferences() { |
1982 return delegate_->GetWebkitPrefs(); | 1886 return delegate_->GetWebkitPrefs(); |
1983 } | 1887 } |
1984 | 1888 |
(...skipping 252 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2237 void RenderViewHostImpl::AttachToFrameTree() { | 2141 void RenderViewHostImpl::AttachToFrameTree() { |
2238 FrameTree* frame_tree = delegate_->GetFrameTree(); | 2142 FrameTree* frame_tree = delegate_->GetFrameTree(); |
2239 | 2143 |
2240 frame_tree->ResetForMainFrameSwap(); | 2144 frame_tree->ResetForMainFrameSwap(); |
2241 if (main_frame_id() != FrameTreeNode::kInvalidFrameId) { | 2145 if (main_frame_id() != FrameTreeNode::kInvalidFrameId) { |
2242 frame_tree->OnFirstNavigationAfterSwap(main_frame_id()); | 2146 frame_tree->OnFirstNavigationAfterSwap(main_frame_id()); |
2243 } | 2147 } |
2244 } | 2148 } |
2245 | 2149 |
2246 } // namespace content | 2150 } // namespace content |
OLD | NEW |