Chromium Code Reviews| Index: content/browser/renderer_host/render_view_host_impl.cc |
| diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc |
| index 752d34e591a24248a4e4c52e321c7df742d9024a..73cd509caab7d196a82674ba498640b459f3504e 100644 |
| --- a/content/browser/renderer_host/render_view_host_impl.cc |
| +++ b/content/browser/renderer_host/render_view_host_impl.cc |
| @@ -43,6 +43,7 @@ |
| #include "content/common/content_switches_internal.h" |
| #include "content/common/desktop_notification_messages.h" |
| #include "content/common/drag_messages.h" |
| +#include "content/common/frame_messages.h" |
| #include "content/common/input_messages.h" |
| #include "content/common/inter_process_time_ticks_converter.h" |
| #include "content/common/speech_recognition_messages.h" |
| @@ -1220,7 +1221,6 @@ bool RenderViewHostImpl::OnMessageReceived(const IPC::Message& msg) { |
| IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_RunModal, OnRunModal) |
| IPC_MESSAGE_HANDLER(ViewHostMsg_RenderViewReady, OnRenderViewReady) |
| IPC_MESSAGE_HANDLER(ViewHostMsg_RenderProcessGone, OnRenderProcessGone) |
| - IPC_MESSAGE_HANDLER_GENERIC(ViewHostMsg_FrameNavigate, OnNavigate(msg)) |
| IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateState, OnUpdateState) |
| IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateTitle, OnUpdateTitle) |
| IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateEncoding, OnUpdateEncoding) |
| @@ -1434,97 +1434,15 @@ void RenderViewHostImpl::OnDidStartProvisionalLoadForFrame( |
| NOTREACHED(); |
| } |
| -// Called when the renderer navigates. For every frame loaded, we'll get this |
| -// notification containing parameters identifying the navigation. |
| -// |
| // Subframes are identified by the page transition type. For subframes loaded |
| // as part of a wider page load, the page_id will be the same as for the top |
| // level frame. If the user explicitly requests a subframe navigation, we will |
| // get a new page_id because we need to create a new navigation entry for that |
| // action. |
|
Charlie Reis
2014/02/06 21:49:07
The rest of this comment can be removed as well.
nasko
2014/02/06 21:58:43
Done.
|
| void RenderViewHostImpl::OnNavigate(const IPC::Message& msg) { |
| - // Read the parameters out of the IPC message directly to avoid making another |
| - // copy when we filter the URLs. |
| - PickleIterator iter(msg); |
| - ViewHostMsg_FrameNavigate_Params validated_params; |
| - if (!IPC::ParamTraits<ViewHostMsg_FrameNavigate_Params>:: |
| - Read(&msg, &iter, &validated_params)) |
| - return; |
| - |
| - // If we're waiting for a cross-site beforeunload ack from this renderer and |
| - // we receive a Navigate message from the main frame, then the renderer was |
| - // navigating already and sent it before hearing the ViewMsg_Stop message. |
| - // We do not want to cancel the pending navigation in this case, since the |
| - // old page will soon be stopped. Instead, treat this as a beforeunload ack |
| - // to allow the pending navigation to continue. |
| - if (is_waiting_for_beforeunload_ack_ && |
| - unload_ack_is_for_cross_site_transition_ && |
| - PageTransitionIsMainFrame(validated_params.transition)) { |
| - OnShouldCloseACK(true, send_should_close_start_time_, |
| - base::TimeTicks::Now()); |
| - return; |
| - } |
| - |
| - // If we're waiting for an unload ack from this renderer and we receive a |
| - // Navigate message, then the renderer was navigating before it received the |
| - // unload request. It will either respond to the unload request soon or our |
| - // timer will expire. Either way, we should ignore this message, because we |
| - // have already committed to closing this renderer. |
| - if (is_waiting_for_unload_ack_) |
| - return; |
| - |
| - // Cache the main frame id, so we can use it for creating the frame tree |
| - // root node when needed. |
| - if (PageTransitionIsMainFrame(validated_params.transition)) { |
| - if (main_frame_id_ == -1) { |
| - main_frame_id_ = validated_params.frame_id; |
| - } else { |
| - // TODO(nasko): We plan to remove the usage of frame_id in navigation |
| - // and move to routing ids. This is in place to ensure that a |
| - // renderer is not misbehaving and sending us incorrect data. |
| - DCHECK_EQ(main_frame_id_, validated_params.frame_id); |
| - } |
| - } |
| - RenderProcessHost* process = GetProcess(); |
| - |
| - // Attempts to commit certain off-limits URL should be caught more strictly |
| - // than our FilterURL checks below. If a renderer violates this policy, it |
| - // should be killed. |
| - if (!CanCommitURL(validated_params.url)) { |
| - VLOG(1) << "Blocked URL " << validated_params.url.spec(); |
| - validated_params.url = GURL(kAboutBlankURL); |
| - RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled")); |
| - // Kills the process. |
| - process->ReceivedBadMessage(); |
| - } |
| - |
| - // Now that something has committed, we don't need to track whether the |
| - // initial page has been accessed. |
| - has_accessed_initial_document_ = false; |
| - |
| - // Without this check, an evil renderer can trick the browser into creating |
| - // a navigation entry for a banned URL. If the user clicks the back button |
| - // followed by the forward button (or clicks reload, or round-trips through |
| - // session restore, etc), we'll think that the browser commanded the |
| - // renderer to load the URL and grant the renderer the privileges to request |
| - // the URL. To prevent this attack, we block the renderer from inserting |
| - // banned URLs into the navigation controller in the first place. |
| - process->FilterURL(false, &validated_params.url); |
| - process->FilterURL(true, &validated_params.referrer.url); |
| - for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); |
| - it != validated_params.redirects.end(); ++it) { |
| - process->FilterURL(false, &(*it)); |
| - } |
| - process->FilterURL(true, &validated_params.searchable_form_url); |
| - |
| - // Without this check, the renderer can trick the browser into using |
| - // filenames it can't access in a future session restore. |
| - if (!CanAccessFilesOfPageState(validated_params.page_state)) { |
| - GetProcess()->ReceivedBadMessage(); |
| - return; |
| - } |
| - |
| - delegate_->DidNavigate(this, validated_params); |
| + // TODO(nasko): Forward calls to the top level RenderFrameHost until all |
| + // callers of this method on RenderViewHost are removed. |
| + delegate_->GetFrameTree()->GetMainFrame()->OnMessageReceived(msg); |
| } |
| void RenderViewHostImpl::OnUpdateState(int32 page_id, const PageState& state) { |
| @@ -1963,15 +1881,6 @@ void RenderViewHostImpl::ToggleSpeechInput() { |
| Send(new InputTagSpeechMsg_ToggleSpeechInput(GetRoutingID())); |
| } |
| -bool RenderViewHostImpl::CanCommitURL(const GURL& url) { |
| - // TODO(creis): We should also check for WebUI pages here. Also, when the |
| - // out-of-process iframes implementation is ready, we should check for |
| - // cross-site URLs that are not allowed to commit in this process. |
| - |
| - // Give the client a chance to disallow URLs from committing. |
| - return GetContentClient()->browser()->CanCommitURL(GetProcess(), url); |
| -} |
| - |
| void RenderViewHostImpl::ExitFullscreen() { |
| RejectMouseLockOrUnlockIfNecessary(); |
| // Notify delegate_ and renderer of fullscreen state change. |