Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/renderer_host/render_view_host_impl.h" | 5 #include "content/browser/renderer_host/render_view_host_impl.h" |
| 6 | 6 |
| 7 #include <set> | 7 #include <set> |
| 8 #include <string> | 8 #include <string> |
| 9 #include <utility> | 9 #include <utility> |
| 10 #include <vector> | 10 #include <vector> |
| (...skipping 25 matching lines...) Expand all Loading... | |
| 36 #include "content/browser/loader/resource_dispatcher_host_impl.h" | 36 #include "content/browser/loader/resource_dispatcher_host_impl.h" |
| 37 #include "content/browser/renderer_host/dip_util.h" | 37 #include "content/browser/renderer_host/dip_util.h" |
| 38 #include "content/browser/renderer_host/media/audio_renderer_host.h" | 38 #include "content/browser/renderer_host/media/audio_renderer_host.h" |
| 39 #include "content/browser/renderer_host/render_process_host_impl.h" | 39 #include "content/browser/renderer_host/render_process_host_impl.h" |
| 40 #include "content/browser/renderer_host/render_view_host_delegate.h" | 40 #include "content/browser/renderer_host/render_view_host_delegate.h" |
| 41 #include "content/common/accessibility_messages.h" | 41 #include "content/common/accessibility_messages.h" |
| 42 #include "content/common/browser_plugin/browser_plugin_messages.h" | 42 #include "content/common/browser_plugin/browser_plugin_messages.h" |
| 43 #include "content/common/content_switches_internal.h" | 43 #include "content/common/content_switches_internal.h" |
| 44 #include "content/common/desktop_notification_messages.h" | 44 #include "content/common/desktop_notification_messages.h" |
| 45 #include "content/common/drag_messages.h" | 45 #include "content/common/drag_messages.h" |
| 46 #include "content/common/frame_messages.h" | |
| 46 #include "content/common/input_messages.h" | 47 #include "content/common/input_messages.h" |
| 47 #include "content/common/inter_process_time_ticks_converter.h" | 48 #include "content/common/inter_process_time_ticks_converter.h" |
| 48 #include "content/common/speech_recognition_messages.h" | 49 #include "content/common/speech_recognition_messages.h" |
| 49 #include "content/common/swapped_out_messages.h" | 50 #include "content/common/swapped_out_messages.h" |
| 50 #include "content/common/view_messages.h" | 51 #include "content/common/view_messages.h" |
| 51 #include "content/port/browser/render_view_host_delegate_view.h" | 52 #include "content/port/browser/render_view_host_delegate_view.h" |
| 52 #include "content/port/browser/render_widget_host_view_port.h" | 53 #include "content/port/browser/render_widget_host_view_port.h" |
| 53 #include "content/public/browser/browser_accessibility_state.h" | 54 #include "content/public/browser/browser_accessibility_state.h" |
| 54 #include "content/public/browser/browser_context.h" | 55 #include "content/public/browser/browser_context.h" |
| 55 #include "content/public/browser/browser_message_filter.h" | 56 #include "content/public/browser/browser_message_filter.h" |
| (...skipping 1157 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1213 bool handled = true; | 1214 bool handled = true; |
| 1214 bool msg_is_ok = true; | 1215 bool msg_is_ok = true; |
| 1215 IPC_BEGIN_MESSAGE_MAP_EX(RenderViewHostImpl, msg, msg_is_ok) | 1216 IPC_BEGIN_MESSAGE_MAP_EX(RenderViewHostImpl, msg, msg_is_ok) |
| 1216 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowView, OnShowView) | 1217 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowView, OnShowView) |
| 1217 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowWidget, OnShowWidget) | 1218 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowWidget, OnShowWidget) |
| 1218 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowFullscreenWidget, | 1219 IPC_MESSAGE_HANDLER(ViewHostMsg_ShowFullscreenWidget, |
| 1219 OnShowFullscreenWidget) | 1220 OnShowFullscreenWidget) |
| 1220 IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunModal, OnRunModal) | 1221 IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunModal, OnRunModal) |
| 1221 IPC_MESSAGE_HANDLER(ViewHostMsg_RenderViewReady, OnRenderViewReady) | 1222 IPC_MESSAGE_HANDLER(ViewHostMsg_RenderViewReady, OnRenderViewReady) |
| 1222 IPC_MESSAGE_HANDLER(ViewHostMsg_RenderProcessGone, OnRenderProcessGone) | 1223 IPC_MESSAGE_HANDLER(ViewHostMsg_RenderProcessGone, OnRenderProcessGone) |
| 1223 IPC_MESSAGE_HANDLER_GENERIC(ViewHostMsg_FrameNavigate, OnNavigate(msg)) | |
| 1224 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateState, OnUpdateState) | 1224 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateState, OnUpdateState) |
| 1225 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTitle, OnUpdateTitle) | 1225 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTitle, OnUpdateTitle) |
| 1226 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateEncoding, OnUpdateEncoding) | 1226 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateEncoding, OnUpdateEncoding) |
| 1227 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTargetURL, OnUpdateTargetURL) | 1227 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTargetURL, OnUpdateTargetURL) |
| 1228 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateInspectorSetting, | 1228 IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateInspectorSetting, |
| 1229 OnUpdateInspectorSetting) | 1229 OnUpdateInspectorSetting) |
| 1230 IPC_MESSAGE_HANDLER(ViewHostMsg_Close, OnClose) | 1230 IPC_MESSAGE_HANDLER(ViewHostMsg_Close, OnClose) |
| 1231 IPC_MESSAGE_HANDLER(ViewHostMsg_RequestMove, OnRequestMove) | 1231 IPC_MESSAGE_HANDLER(ViewHostMsg_RequestMove, OnRequestMove) |
| 1232 IPC_MESSAGE_HANDLER(ViewHostMsg_DidStartLoading, OnDidStartLoading) | 1232 IPC_MESSAGE_HANDLER(ViewHostMsg_DidStartLoading, OnDidStartLoading) |
| 1233 IPC_MESSAGE_HANDLER(ViewHostMsg_DidStopLoading, OnDidStopLoading) | 1233 IPC_MESSAGE_HANDLER(ViewHostMsg_DidStopLoading, OnDidStopLoading) |
| (...skipping 193 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 1427 } | 1427 } |
| 1428 | 1428 |
| 1429 void RenderViewHostImpl::OnDidStartProvisionalLoadForFrame( | 1429 void RenderViewHostImpl::OnDidStartProvisionalLoadForFrame( |
| 1430 int64 frame_id, | 1430 int64 frame_id, |
| 1431 int64 parent_frame_id, | 1431 int64 parent_frame_id, |
| 1432 bool is_main_frame, | 1432 bool is_main_frame, |
| 1433 const GURL& url) { | 1433 const GURL& url) { |
| 1434 NOTREACHED(); | 1434 NOTREACHED(); |
| 1435 } | 1435 } |
| 1436 | 1436 |
| 1437 // Called when the renderer navigates. For every frame loaded, we'll get this | 1437 // Called when the renderer navigates. For every frame loaded, we'll get this |
|
Charlie Reis
2014/02/05 23:30:37
We can remove this comment now that it's in RFH.
nasko
2014/02/06 01:55:13
Done.
| |
| 1438 // notification containing parameters identifying the navigation. | 1438 // notification containing parameters identifying the navigation. |
| 1439 // | 1439 // |
| 1440 // Subframes are identified by the page transition type. For subframes loaded | 1440 // Subframes are identified by the page transition type. For subframes loaded |
| 1441 // as part of a wider page load, the page_id will be the same as for the top | 1441 // as part of a wider page load, the page_id will be the same as for the top |
| 1442 // level frame. If the user explicitly requests a subframe navigation, we will | 1442 // level frame. If the user explicitly requests a subframe navigation, we will |
| 1443 // get a new page_id because we need to create a new navigation entry for that | 1443 // get a new page_id because we need to create a new navigation entry for that |
| 1444 // action. | 1444 // action. |
| 1445 void RenderViewHostImpl::OnNavigate(const IPC::Message& msg) { | 1445 void RenderViewHostImpl::OnNavigate(const IPC::Message& msg) { |
| 1446 // Read the parameters out of the IPC message directly to avoid making another | 1446 // TODO(nasko): Forward calls to the top level RenderFrameHost until all |
| 1447 // copy when we filter the URLs. | 1447 // callers of this method on RenderViewHost are removed. |
| 1448 PickleIterator iter(msg); | 1448 delegate_->GetFrameTree()->GetMainFrame()->OnMessageReceived(msg); |
| 1449 ViewHostMsg_FrameNavigate_Params validated_params; | |
| 1450 if (!IPC::ParamTraits<ViewHostMsg_FrameNavigate_Params>:: | |
| 1451 Read(&msg, &iter, &validated_params)) | |
| 1452 return; | |
| 1453 | |
| 1454 // If we're waiting for a cross-site beforeunload ack from this renderer and | |
| 1455 // we receive a Navigate message from the main frame, then the renderer was | |
| 1456 // navigating already and sent it before hearing the ViewMsg_Stop message. | |
| 1457 // We do not want to cancel the pending navigation in this case, since the | |
| 1458 // old page will soon be stopped. Instead, treat this as a beforeunload ack | |
| 1459 // to allow the pending navigation to continue. | |
| 1460 if (is_waiting_for_beforeunload_ack_ && | |
| 1461 unload_ack_is_for_cross_site_transition_ && | |
| 1462 PageTransitionIsMainFrame(validated_params.transition)) { | |
| 1463 OnShouldCloseACK(true, send_should_close_start_time_, | |
| 1464 base::TimeTicks::Now()); | |
| 1465 return; | |
| 1466 } | |
| 1467 | |
| 1468 // If we're waiting for an unload ack from this renderer and we receive a | |
| 1469 // Navigate message, then the renderer was navigating before it received the | |
| 1470 // unload request. It will either respond to the unload request soon or our | |
| 1471 // timer will expire. Either way, we should ignore this message, because we | |
| 1472 // have already committed to closing this renderer. | |
| 1473 if (is_waiting_for_unload_ack_) | |
| 1474 return; | |
| 1475 | |
| 1476 // Cache the main frame id, so we can use it for creating the frame tree | |
| 1477 // root node when needed. | |
| 1478 if (PageTransitionIsMainFrame(validated_params.transition)) { | |
| 1479 if (main_frame_id_ == -1) { | |
| 1480 main_frame_id_ = validated_params.frame_id; | |
| 1481 } else { | |
| 1482 // TODO(nasko): We plan to remove the usage of frame_id in navigation | |
| 1483 // and move to routing ids. This is in place to ensure that a | |
| 1484 // renderer is not misbehaving and sending us incorrect data. | |
| 1485 DCHECK_EQ(main_frame_id_, validated_params.frame_id); | |
| 1486 } | |
| 1487 } | |
| 1488 RenderProcessHost* process = GetProcess(); | |
| 1489 | |
| 1490 // Attempts to commit certain off-limits URL should be caught more strictly | |
| 1491 // than our FilterURL checks below. If a renderer violates this policy, it | |
| 1492 // should be killed. | |
| 1493 if (!CanCommitURL(validated_params.url)) { | |
| 1494 VLOG(1) << "Blocked URL " << validated_params.url.spec(); | |
| 1495 validated_params.url = GURL(kAboutBlankURL); | |
| 1496 RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled")); | |
| 1497 // Kills the process. | |
| 1498 process->ReceivedBadMessage(); | |
| 1499 } | |
| 1500 | |
| 1501 // Now that something has committed, we don't need to track whether the | |
| 1502 // initial page has been accessed. | |
| 1503 has_accessed_initial_document_ = false; | |
| 1504 | |
| 1505 // Without this check, an evil renderer can trick the browser into creating | |
| 1506 // a navigation entry for a banned URL. If the user clicks the back button | |
| 1507 // followed by the forward button (or clicks reload, or round-trips through | |
| 1508 // session restore, etc), we'll think that the browser commanded the | |
| 1509 // renderer to load the URL and grant the renderer the privileges to request | |
| 1510 // the URL. To prevent this attack, we block the renderer from inserting | |
| 1511 // banned URLs into the navigation controller in the first place. | |
| 1512 process->FilterURL(false, &validated_params.url); | |
| 1513 process->FilterURL(true, &validated_params.referrer.url); | |
| 1514 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); | |
| 1515 it != validated_params.redirects.end(); ++it) { | |
| 1516 process->FilterURL(false, &(*it)); | |
| 1517 } | |
| 1518 process->FilterURL(true, &validated_params.searchable_form_url); | |
| 1519 | |
| 1520 // Without this check, the renderer can trick the browser into using | |
| 1521 // filenames it can't access in a future session restore. | |
| 1522 if (!CanAccessFilesOfPageState(validated_params.page_state)) { | |
| 1523 GetProcess()->ReceivedBadMessage(); | |
| 1524 return; | |
| 1525 } | |
| 1526 | |
| 1527 delegate_->DidNavigate(this, validated_params); | |
| 1528 } | 1449 } |
| 1529 | 1450 |
| 1530 void RenderViewHostImpl::OnUpdateState(int32 page_id, const PageState& state) { | 1451 void RenderViewHostImpl::OnUpdateState(int32 page_id, const PageState& state) { |
| 1531 // Without this check, the renderer can trick the browser into using | 1452 // Without this check, the renderer can trick the browser into using |
| 1532 // filenames it can't access in a future session restore. | 1453 // filenames it can't access in a future session restore. |
| 1533 if (!CanAccessFilesOfPageState(state)) { | 1454 if (!CanAccessFilesOfPageState(state)) { |
| 1534 GetProcess()->ReceivedBadMessage(); | 1455 GetProcess()->ReceivedBadMessage(); |
| 1535 return; | 1456 return; |
| 1536 } | 1457 } |
| 1537 | 1458 |
| (...skipping 699 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 2237 void RenderViewHostImpl::AttachToFrameTree() { | 2158 void RenderViewHostImpl::AttachToFrameTree() { |
| 2238 FrameTree* frame_tree = delegate_->GetFrameTree(); | 2159 FrameTree* frame_tree = delegate_->GetFrameTree(); |
| 2239 | 2160 |
| 2240 frame_tree->ResetForMainFrameSwap(); | 2161 frame_tree->ResetForMainFrameSwap(); |
| 2241 if (main_frame_id() != FrameTreeNode::kInvalidFrameId) { | 2162 if (main_frame_id() != FrameTreeNode::kInvalidFrameId) { |
| 2242 frame_tree->OnFirstNavigationAfterSwap(main_frame_id()); | 2163 frame_tree->OnFirstNavigationAfterSwap(main_frame_id()); |
| 2243 } | 2164 } |
| 2244 } | 2165 } |
| 2245 | 2166 |
| 2246 } // namespace content | 2167 } // namespace content |
| OLD | NEW |