| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/renderer/content_settings_observer.h" | 5 #include "chrome/renderer/content_settings_observer.h" |
| 6 | 6 |
| 7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
| 8 #include "base/metrics/histogram.h" | 8 #include "base/metrics/histogram.h" |
| 9 #include "components/content_settings/content/common/content_settings_messages.h
" | 9 #include "components/content_settings/content/common/content_settings_messages.h
" |
| 10 #include "content/public/common/url_constants.h" | 10 #include "content/public/common/url_constants.h" |
| 11 #include "content/public/renderer/document_state.h" | 11 #include "content/public/renderer/document_state.h" |
| 12 #include "content/public/renderer/render_frame.h" | 12 #include "content/public/renderer/render_frame.h" |
| 13 #include "content/public/renderer/render_view.h" | 13 #include "content/public/renderer/render_view.h" |
| 14 #include "third_party/WebKit/public/platform/URLConversion.h" |
| 14 #include "third_party/WebKit/public/platform/WebContentSettingCallbacks.h" | 15 #include "third_party/WebKit/public/platform/WebContentSettingCallbacks.h" |
| 15 #include "third_party/WebKit/public/platform/WebURL.h" | 16 #include "third_party/WebKit/public/platform/WebURL.h" |
| 16 #include "third_party/WebKit/public/web/WebDataSource.h" | 17 #include "third_party/WebKit/public/web/WebDataSource.h" |
| 17 #include "third_party/WebKit/public/web/WebDocument.h" | 18 #include "third_party/WebKit/public/web/WebDocument.h" |
| 18 #include "third_party/WebKit/public/web/WebFrameClient.h" | 19 #include "third_party/WebKit/public/web/WebFrameClient.h" |
| 19 #include "third_party/WebKit/public/web/WebLocalFrame.h" | 20 #include "third_party/WebKit/public/web/WebLocalFrame.h" |
| 20 #include "third_party/WebKit/public/web/WebSecurityOrigin.h" | 21 #include "third_party/WebKit/public/web/WebSecurityOrigin.h" |
| 21 #include "third_party/WebKit/public/web/WebView.h" | 22 #include "third_party/WebKit/public/web/WebView.h" |
| 22 #include "url/url_constants.h" | 23 #include "url/url_constants.h" |
| 23 | 24 |
| (...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 92 | 93 |
| 93 GURL GetOriginOrURL(const WebFrame* frame) { | 94 GURL GetOriginOrURL(const WebFrame* frame) { |
| 94 WebString top_origin = frame->top()->securityOrigin().toString(); | 95 WebString top_origin = frame->top()->securityOrigin().toString(); |
| 95 // The |top_origin| is unique ("null") e.g., for file:// URLs. Use the | 96 // The |top_origin| is unique ("null") e.g., for file:// URLs. Use the |
| 96 // document URL as the primary URL in those cases. | 97 // document URL as the primary URL in those cases. |
| 97 // TODO(alexmos): This is broken for --site-per-process, since top() can be a | 98 // TODO(alexmos): This is broken for --site-per-process, since top() can be a |
| 98 // WebRemoteFrame which does not have a document(), and the WebRemoteFrame's | 99 // WebRemoteFrame which does not have a document(), and the WebRemoteFrame's |
| 99 // URL is not replicated. | 100 // URL is not replicated. |
| 100 if (top_origin == "null") | 101 if (top_origin == "null") |
| 101 return frame->top()->document().url(); | 102 return frame->top()->document().url(); |
| 102 return GURL(top_origin); | 103 return blink::WebStringToGURL(top_origin); |
| 103 } | 104 } |
| 104 | 105 |
| 105 ContentSetting GetContentSettingFromRules( | 106 ContentSetting GetContentSettingFromRules( |
| 106 const ContentSettingsForOneType& rules, | 107 const ContentSettingsForOneType& rules, |
| 107 const WebFrame* frame, | 108 const WebFrame* frame, |
| 108 const GURL& secondary_url) { | 109 const GURL& secondary_url) { |
| 109 ContentSettingsForOneType::const_iterator it; | 110 ContentSettingsForOneType::const_iterator it; |
| 110 // If there is only one rule, it's the default rule and we don't need to match | 111 // If there is only one rule, it's the default rule and we don't need to match |
| 111 // the patterns. | 112 // the patterns. |
| 112 if (rules.size() == 1) { | 113 if (rules.size() == 1) { |
| (...skipping 140 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 253 bool ContentSettingsObserver::allowDatabase(const WebString& name, | 254 bool ContentSettingsObserver::allowDatabase(const WebString& name, |
| 254 const WebString& display_name, | 255 const WebString& display_name, |
| 255 unsigned long estimated_size) { | 256 unsigned long estimated_size) { |
| 256 WebFrame* frame = render_frame()->GetWebFrame(); | 257 WebFrame* frame = render_frame()->GetWebFrame(); |
| 257 if (frame->securityOrigin().isUnique() || | 258 if (frame->securityOrigin().isUnique() || |
| 258 frame->top()->securityOrigin().isUnique()) | 259 frame->top()->securityOrigin().isUnique()) |
| 259 return false; | 260 return false; |
| 260 | 261 |
| 261 bool result = false; | 262 bool result = false; |
| 262 Send(new ChromeViewHostMsg_AllowDatabase( | 263 Send(new ChromeViewHostMsg_AllowDatabase( |
| 263 routing_id(), GURL(frame->securityOrigin().toString()), | 264 routing_id(), |
| 264 GURL(frame->top()->securityOrigin().toString()), name, display_name, | 265 blink::WebStringToGURL(frame->securityOrigin().toString()), |
| 265 &result)); | 266 blink::WebStringToGURL(frame->top()->securityOrigin().toString()), |
| 267 name, display_name, &result)); |
| 266 return result; | 268 return result; |
| 267 } | 269 } |
| 268 | 270 |
| 269 void ContentSettingsObserver::requestFileSystemAccessAsync( | 271 void ContentSettingsObserver::requestFileSystemAccessAsync( |
| 270 const WebContentSettingCallbacks& callbacks) { | 272 const WebContentSettingCallbacks& callbacks) { |
| 271 WebFrame* frame = render_frame()->GetWebFrame(); | 273 WebFrame* frame = render_frame()->GetWebFrame(); |
| 272 if (frame->securityOrigin().isUnique() || | 274 if (frame->securityOrigin().isUnique() || |
| 273 frame->top()->securityOrigin().isUnique()) { | 275 frame->top()->securityOrigin().isUnique()) { |
| 274 WebContentSettingCallbacks permissionCallbacks(callbacks); | 276 WebContentSettingCallbacks permissionCallbacks(callbacks); |
| 275 permissionCallbacks.doDeny(); | 277 permissionCallbacks.doDeny(); |
| 276 return; | 278 return; |
| 277 } | 279 } |
| 278 ++current_request_id_; | 280 ++current_request_id_; |
| 279 std::pair<PermissionRequestMap::iterator, bool> insert_result = | 281 std::pair<PermissionRequestMap::iterator, bool> insert_result = |
| 280 permission_requests_.insert( | 282 permission_requests_.insert( |
| 281 std::make_pair(current_request_id_, callbacks)); | 283 std::make_pair(current_request_id_, callbacks)); |
| 282 | 284 |
| 283 // Verify there are no duplicate insertions. | 285 // Verify there are no duplicate insertions. |
| 284 DCHECK(insert_result.second); | 286 DCHECK(insert_result.second); |
| 285 | 287 |
| 286 Send(new ChromeViewHostMsg_RequestFileSystemAccessAsync( | 288 Send(new ChromeViewHostMsg_RequestFileSystemAccessAsync( |
| 287 routing_id(), current_request_id_, | 289 routing_id(), current_request_id_, |
| 288 GURL(frame->securityOrigin().toString()), | 290 blink::WebStringToGURL(frame->securityOrigin().toString()), |
| 289 GURL(frame->top()->securityOrigin().toString()))); | 291 blink::WebStringToGURL(frame->top()->securityOrigin().toString()))); |
| 290 } | 292 } |
| 291 | 293 |
| 292 bool ContentSettingsObserver::allowImage(bool enabled_per_settings, | 294 bool ContentSettingsObserver::allowImage(bool enabled_per_settings, |
| 293 const WebURL& image_url) { | 295 const WebURL& image_url) { |
| 294 bool allow = enabled_per_settings; | 296 bool allow = enabled_per_settings; |
| 295 if (enabled_per_settings) { | 297 if (enabled_per_settings) { |
| 296 if (is_interstitial_page_) | 298 if (is_interstitial_page_) |
| 297 return true; | 299 return true; |
| 298 | 300 |
| 299 if (IsWhitelistedForContentSettings()) | 301 if (IsWhitelistedForContentSettings()) |
| (...skipping 14 matching lines...) Expand all Loading... |
| 314 | 316 |
| 315 bool ContentSettingsObserver::allowIndexedDB(const WebString& name, | 317 bool ContentSettingsObserver::allowIndexedDB(const WebString& name, |
| 316 const WebSecurityOrigin& origin) { | 318 const WebSecurityOrigin& origin) { |
| 317 WebFrame* frame = render_frame()->GetWebFrame(); | 319 WebFrame* frame = render_frame()->GetWebFrame(); |
| 318 if (frame->securityOrigin().isUnique() || | 320 if (frame->securityOrigin().isUnique() || |
| 319 frame->top()->securityOrigin().isUnique()) | 321 frame->top()->securityOrigin().isUnique()) |
| 320 return false; | 322 return false; |
| 321 | 323 |
| 322 bool result = false; | 324 bool result = false; |
| 323 Send(new ChromeViewHostMsg_AllowIndexedDB( | 325 Send(new ChromeViewHostMsg_AllowIndexedDB( |
| 324 routing_id(), GURL(frame->securityOrigin().toString()), | 326 routing_id(), |
| 325 GURL(frame->top()->securityOrigin().toString()), name, &result)); | 327 blink::WebStringToGURL(frame->securityOrigin().toString()), |
| 328 blink::WebStringToGURL(frame->top()->securityOrigin().toString()), |
| 329 name, &result)); |
| 326 return result; | 330 return result; |
| 327 } | 331 } |
| 328 | 332 |
| 329 bool ContentSettingsObserver::allowPlugins(bool enabled_per_settings) { | 333 bool ContentSettingsObserver::allowPlugins(bool enabled_per_settings) { |
| 330 return enabled_per_settings; | 334 return enabled_per_settings; |
| 331 } | 335 } |
| 332 | 336 |
| 333 bool ContentSettingsObserver::allowScript(bool enabled_per_settings) { | 337 bool ContentSettingsObserver::allowScript(bool enabled_per_settings) { |
| 334 if (!enabled_per_settings) | 338 if (!enabled_per_settings) |
| 335 return false; | 339 return false; |
| 336 if (is_interstitial_page_) | 340 if (is_interstitial_page_) |
| 337 return true; | 341 return true; |
| 338 | 342 |
| 339 WebFrame* frame = render_frame()->GetWebFrame(); | 343 WebFrame* frame = render_frame()->GetWebFrame(); |
| 340 std::map<WebFrame*, bool>::const_iterator it = | 344 std::map<WebFrame*, bool>::const_iterator it = |
| 341 cached_script_permissions_.find(frame); | 345 cached_script_permissions_.find(frame); |
| 342 if (it != cached_script_permissions_.end()) | 346 if (it != cached_script_permissions_.end()) |
| 343 return it->second; | 347 return it->second; |
| 344 | 348 |
| 345 // Evaluate the content setting rules before | 349 // Evaluate the content setting rules before |
| 346 // |IsWhitelistedForContentSettings|; if there is only the default rule | 350 // |IsWhitelistedForContentSettings|; if there is only the default rule |
| 347 // allowing all scripts, it's quicker this way. | 351 // allowing all scripts, it's quicker this way. |
| 348 bool allow = true; | 352 bool allow = true; |
| 349 if (content_setting_rules_) { | 353 if (content_setting_rules_) { |
| 350 ContentSetting setting = GetContentSettingFromRules( | 354 ContentSetting setting = GetContentSettingFromRules( |
| 351 content_setting_rules_->script_rules, | 355 content_setting_rules_->script_rules, |
| 352 frame, | 356 frame, |
| 353 GURL(frame->document().securityOrigin().toString())); | 357 blink::WebStringToGURL( |
| 358 frame->document().securityOrigin().toString())); |
| 354 allow = setting != CONTENT_SETTING_BLOCK; | 359 allow = setting != CONTENT_SETTING_BLOCK; |
| 355 } | 360 } |
| 356 allow = allow || IsWhitelistedForContentSettings(); | 361 allow = allow || IsWhitelistedForContentSettings(); |
| 357 | 362 |
| 358 cached_script_permissions_[frame] = allow; | 363 cached_script_permissions_[frame] = allow; |
| 359 return allow; | 364 return allow; |
| 360 } | 365 } |
| 361 | 366 |
| 362 bool ContentSettingsObserver::allowScriptFromSource( | 367 bool ContentSettingsObserver::allowScriptFromSource( |
| 363 bool enabled_per_settings, | 368 bool enabled_per_settings, |
| (...skipping 15 matching lines...) Expand all Loading... |
| 379 } | 384 } |
| 380 | 385 |
| 381 bool ContentSettingsObserver::allowStorage(bool local) { | 386 bool ContentSettingsObserver::allowStorage(bool local) { |
| 382 WebFrame* frame = render_frame()->GetWebFrame(); | 387 WebFrame* frame = render_frame()->GetWebFrame(); |
| 383 if (frame->securityOrigin().isUnique() || | 388 if (frame->securityOrigin().isUnique() || |
| 384 frame->top()->securityOrigin().isUnique()) | 389 frame->top()->securityOrigin().isUnique()) |
| 385 return false; | 390 return false; |
| 386 bool result = false; | 391 bool result = false; |
| 387 | 392 |
| 388 StoragePermissionsKey key( | 393 StoragePermissionsKey key( |
| 389 GURL(frame->document().securityOrigin().toString()), local); | 394 blink::WebStringToGURL(frame->document().securityOrigin().toString()), |
| 395 local); |
| 390 std::map<StoragePermissionsKey, bool>::const_iterator permissions = | 396 std::map<StoragePermissionsKey, bool>::const_iterator permissions = |
| 391 cached_storage_permissions_.find(key); | 397 cached_storage_permissions_.find(key); |
| 392 if (permissions != cached_storage_permissions_.end()) | 398 if (permissions != cached_storage_permissions_.end()) |
| 393 return permissions->second; | 399 return permissions->second; |
| 394 | 400 |
| 395 Send(new ChromeViewHostMsg_AllowDOMStorage( | 401 Send(new ChromeViewHostMsg_AllowDOMStorage( |
| 396 routing_id(), GURL(frame->securityOrigin().toString()), | 402 routing_id(), |
| 397 GURL(frame->top()->securityOrigin().toString()), local, &result)); | 403 blink::WebStringToGURL(frame->securityOrigin().toString()), |
| 404 blink::WebStringToGURL(frame->top()->securityOrigin().toString()), |
| 405 local, &result)); |
| 398 cached_storage_permissions_[key] = result; | 406 cached_storage_permissions_[key] = result; |
| 399 return result; | 407 return result; |
| 400 } | 408 } |
| 401 | 409 |
| 402 bool ContentSettingsObserver::allowReadFromClipboard(bool default_value) { | 410 bool ContentSettingsObserver::allowReadFromClipboard(bool default_value) { |
| 403 bool allowed = default_value; | 411 bool allowed = default_value; |
| 404 #if defined(ENABLE_EXTENSIONS) | 412 #if defined(ENABLE_EXTENSIONS) |
| 405 extensions::ScriptContext* current_context = | 413 extensions::ScriptContext* current_context = |
| 406 extension_dispatcher_->script_context_set().GetCurrent(); | 414 extension_dispatcher_->script_context_set().GetCurrent(); |
| 407 if (current_context) { | 415 if (current_context) { |
| (...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 479 return false; | 487 return false; |
| 480 } | 488 } |
| 481 | 489 |
| 482 return true; | 490 return true; |
| 483 } | 491 } |
| 484 | 492 |
| 485 void ContentSettingsObserver::didUseKeygen() { | 493 void ContentSettingsObserver::didUseKeygen() { |
| 486 WebFrame* frame = render_frame()->GetWebFrame(); | 494 WebFrame* frame = render_frame()->GetWebFrame(); |
| 487 Send(new ChromeViewHostMsg_DidUseKeygen( | 495 Send(new ChromeViewHostMsg_DidUseKeygen( |
| 488 routing_id(), | 496 routing_id(), |
| 489 GURL(frame->securityOrigin().toString()))); | 497 blink::WebStringToGURL(frame->securityOrigin().toString()))); |
| 490 } | 498 } |
| 491 | 499 |
| 492 void ContentSettingsObserver::didNotAllowPlugins() { | 500 void ContentSettingsObserver::didNotAllowPlugins() { |
| 493 DidBlockContentType(CONTENT_SETTINGS_TYPE_PLUGINS); | 501 DidBlockContentType(CONTENT_SETTINGS_TYPE_PLUGINS); |
| 494 } | 502 } |
| 495 | 503 |
| 496 void ContentSettingsObserver::didNotAllowScript() { | 504 void ContentSettingsObserver::didNotAllowScript() { |
| 497 DidBlockContentType(CONTENT_SETTINGS_TYPE_JAVASCRIPT); | 505 DidBlockContentType(CONTENT_SETTINGS_TYPE_JAVASCRIPT); |
| 498 } | 506 } |
| 499 | 507 |
| (...skipping 120 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 620 | 628 |
| 621 // If the scheme is file:, an empty file name indicates a directory listing, | 629 // If the scheme is file:, an empty file name indicates a directory listing, |
| 622 // which requires JavaScript to function properly. | 630 // which requires JavaScript to function properly. |
| 623 if (base::EqualsASCII(protocol, url::kFileScheme)) { | 631 if (base::EqualsASCII(protocol, url::kFileScheme)) { |
| 624 return document_url.SchemeIs(url::kFileScheme) && | 632 return document_url.SchemeIs(url::kFileScheme) && |
| 625 document_url.ExtractFileName().empty(); | 633 document_url.ExtractFileName().empty(); |
| 626 } | 634 } |
| 627 | 635 |
| 628 return false; | 636 return false; |
| 629 } | 637 } |
| OLD | NEW |