OLD | NEW |
---|---|
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/browser/ppapi_plugin_process_host.h" | 5 #include "content/browser/ppapi_plugin_process_host.h" |
6 | 6 |
7 #include <stddef.h> | 7 #include <stddef.h> |
8 | 8 |
9 #include <string> | 9 #include <string> |
10 #include <utility> | 10 #include <utility> |
(...skipping 18 matching lines...) Expand all Loading... | |
29 #include "content/public/common/pepper_plugin_info.h" | 29 #include "content/public/common/pepper_plugin_info.h" |
30 #include "content/public/common/process_type.h" | 30 #include "content/public/common/process_type.h" |
31 #include "content/public/common/sandbox_type.h" | 31 #include "content/public/common/sandbox_type.h" |
32 #include "content/public/common/sandboxed_process_launcher_delegate.h" | 32 #include "content/public/common/sandboxed_process_launcher_delegate.h" |
33 #include "ipc/ipc_switches.h" | 33 #include "ipc/ipc_switches.h" |
34 #include "net/base/network_change_notifier.h" | 34 #include "net/base/network_change_notifier.h" |
35 #include "ppapi/proxy/ppapi_messages.h" | 35 #include "ppapi/proxy/ppapi_messages.h" |
36 #include "ui/base/ui_base_switches.h" | 36 #include "ui/base/ui_base_switches.h" |
37 | 37 |
38 #if defined(OS_WIN) | 38 #if defined(OS_WIN) |
39 #include "base/strings/string_tokenizer.h" | |
40 #include "base/strings/string_util.h" | |
41 #include "components/variations/variations_associated_data.h" | |
39 #include "content/browser/renderer_host/dwrite_font_proxy_message_filter_win.h" | 42 #include "content/browser/renderer_host/dwrite_font_proxy_message_filter_win.h" |
40 #include "content/common/sandbox_win.h" | 43 #include "content/common/sandbox_win.h" |
41 #include "sandbox/win/src/process_mitigations.h" | 44 #include "sandbox/win/src/process_mitigations.h" |
42 #include "sandbox/win/src/sandbox_policy.h" | 45 #include "sandbox/win/src/sandbox_policy.h" |
43 #include "ui/gfx/win/dpi.h" | 46 #include "ui/gfx/win/dpi.h" |
44 #endif | 47 #endif |
45 | 48 |
46 namespace content { | 49 namespace content { |
47 | 50 |
51 #if defined(OS_WIN) | |
52 namespace { | |
53 | |
54 // Returns whether Win32k PPAPI lockdown is enabled for a specific mime type. | |
55 bool IsWin32kLockdownEnabledForMimeType(const std::string& mime_type) { | |
56 // Consider PPAPI lockdown a superset of renderer lockdown. | |
57 if (!IsWin32kRendererLockdownEnabled()) | |
58 return false; | |
59 | |
60 std::map<std::string, std::string> mime_params; | |
61 | |
Alexei Svitkine (slow)
2016/01/20 16:19:52
Nit: Remove empty line.
Will Harris
2016/01/25 19:50:28
Done.
| |
62 if (variations::GetVariationParams("EnableWin32kLockDownMimeTypes", | |
Will Harris
2016/01/25 19:08:10
Q: should this call be above line 57 to ensure tha
Alexei Svitkine (slow)
2016/01/25 19:32:48
So, if its here, those users won't show up on the
Will Harris
2016/01/25 19:35:39
sounds like leaving it here is easier, so users wh
| |
63 &mime_params)) { | |
64 bool enabled = false; | |
65 for (auto param : mime_params) { | |
Alexei Svitkine (slow)
2016/01/22 19:27:50
Nit: const auto&
Will Harris
2016/01/25 19:50:28
Done.
| |
66 if (param.first == mime_type || param.first == "*") { | |
Alexei Svitkine (slow)
2016/01/20 16:19:52
Hmm, I was thinking you just have a single "MimeTy
Will Harris
2016/01/20 16:44:08
This code allows us to enable for all plugins exce
forshaw
2016/01/20 16:57:48
Well I could see it being useful in this scenario
Will Harris
2016/01/25 19:50:28
Acknowledged.
| |
67 // Disabled entries take precedence over Enabled entries. | |
68 if (base::StartsWith(param.second, "Disabled", | |
69 base::CompareCase::INSENSITIVE_ASCII)) { | |
70 return false; | |
71 } | |
72 if (base::StartsWith(param.second, "Enabled", | |
73 base::CompareCase::INSENSITIVE_ASCII)) { | |
74 enabled = true; | |
75 } | |
76 } | |
77 } | |
78 if (enabled) | |
79 return true; | |
Alexei Svitkine (slow)
2016/01/22 19:27:50
So if something is not explicitly listed as enable
Will Harris
2016/01/25 18:20:28
The idea is that there is a global disable - which
Alexei Svitkine (slow)
2016/01/25 18:54:51
That's fine. In that case, I would suggest changin
Will Harris
2016/01/25 19:08:10
okay yes that makes good sense, will add comments
| |
80 } | |
81 | |
82 const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess(); | |
83 | |
84 if (!cmd_line->HasSwitch(switches::kEnableWin32kLockDownMimeTypes)) | |
85 return false; | |
86 | |
87 std::string mime_types = | |
88 cmd_line->GetSwitchValueASCII(switches::kEnableWin32kLockDownMimeTypes); | |
89 | |
90 // Consider the value * to enable all mime types for lockdown. | |
91 if (mime_types == "*") | |
92 return true; | |
93 | |
94 base::StringTokenizer tokenizer(mime_types, ","); | |
95 tokenizer.set_quote_chars("\""); | |
96 while (tokenizer.GetNext()) { | |
97 if (tokenizer.token() == mime_type) | |
98 return true; | |
99 } | |
100 | |
101 return false; | |
102 } | |
103 | |
104 } // namespace | |
105 #endif // OS_WIN | |
106 | |
48 // NOTE: changes to this class need to be reviewed by the security team. | 107 // NOTE: changes to this class need to be reviewed by the security team. |
49 class PpapiPluginSandboxedProcessLauncherDelegate | 108 class PpapiPluginSandboxedProcessLauncherDelegate |
50 : public content::SandboxedProcessLauncherDelegate { | 109 : public content::SandboxedProcessLauncherDelegate { |
51 public: | 110 public: |
52 PpapiPluginSandboxedProcessLauncherDelegate(bool is_broker, | 111 PpapiPluginSandboxedProcessLauncherDelegate(bool is_broker, |
53 const PepperPluginInfo& info, | 112 const PepperPluginInfo& info, |
54 ChildProcessHost* host) | 113 ChildProcessHost* host) |
55 : | 114 : |
56 #if defined(OS_WIN) | 115 #if defined(OS_WIN) |
57 info_(info), | 116 info_(info), |
(...skipping 455 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
513 // sent_requests_ queue should be the one that the plugin just created. | 572 // sent_requests_ queue should be the one that the plugin just created. |
514 Client* client = sent_requests_.front(); | 573 Client* client = sent_requests_.front(); |
515 sent_requests_.pop(); | 574 sent_requests_.pop(); |
516 | 575 |
517 const ChildProcessData& data = process_->GetData(); | 576 const ChildProcessData& data = process_->GetData(); |
518 client->OnPpapiChannelOpened(channel_handle, base::GetProcId(data.handle), | 577 client->OnPpapiChannelOpened(channel_handle, base::GetProcId(data.handle), |
519 data.id); | 578 data.id); |
520 } | 579 } |
521 | 580 |
522 } // namespace content | 581 } // namespace content |
OLD | NEW |