Add a ModuleLoadAnalyzer which checks modules against a whitelist

chrome/browser/safe_browsing/incident_reporting/module_load_analyzer.h

Index: chrome/browser/safe_browsing/incident_reporting/module_load_analyzer.h
diff --git a/chrome/browser/safe_browsing/incident_reporting/module_load_analyzer.h b/chrome/browser/safe_browsing/incident_reporting/module_load_analyzer.h
new file mode 100644
index 0000000000000000000000000000000000000000..399fa1c56c91bed00c0ec155b4116399200385a7
--- /dev/null
+++ b/chrome/browser/safe_browsing/incident_reporting/module_load_analyzer.h
@@ -0,0 +1,57 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SAFE_BROWSING_INCIDENT_REPORTING_MODULE_LOAD_ANALYZER_H_
+#define CHROME_BROWSER_SAFE_BROWSING_INCIDENT_REPORTING_MODULE_LOAD_ANALYZER_H_
+
+#include <vector>
+
+#include "base/feature_list.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
+#include "base/strings/string16.h"
+#include "components/safe_browsing_db/database_manager.h"
+
+namespace safe_browsing {
+
+class IncidentReceiver;
+
+#if defined(OS_WIN)
+extern const base::Feature kIncidentReportingModuleLoadAnalysis;
+#endif  // defined(OS_WIN)
+
+class ModuleLoadAnalyzer {
+ public:
+  // Constructs an ModuleLoadAnalyzer which will use |database_manager|
+  // over the course of its lifetime. The ModuleLoadAnalyzer will check for
+  // suspicious modules loaded in Chrome.
+  explicit ModuleLoadAnalyzer(
+      const scoped_refptr<SafeBrowsingDatabaseManager>& database_manager);
+  ~ModuleLoadAnalyzer();
+
+  // Callback to pass to the incident reporting service. The incident reporting
+  // service will decide when to start the analysis. Visible for testing.
+  void VerifyModuleLoadState(scoped_ptr<IncidentReceiver> incident_receiver);
+
+ private:
+  void Initialize();
+
+  // Returns the names of suspicious modules that are loaded in the process.
+  void GetLoadedSuspiciousModulesOnIOThread(
+      scoped_ptr<IncidentReceiver> incident_receiver);
+
+  // Creates and reports |SuspiciousModuleIncident| to the incident_receiver.
+  static void ReportIncidentsForSuspiciousModules(
+      scoped_ptr<std::set<base::string16>> module_names,
+      scoped_ptr<IncidentReceiver> incident_receiver);
+
+  scoped_refptr<SafeBrowsingDatabaseManager> database_manager_;
+
+  DISALLOW_COPY_AND_ASSIGN(ModuleLoadAnalyzer);
+};
+
+}  // namespace safe_browsing
+
+#endif  // CHROME_BROWSER_SAFE_BROWSING_INCIDENT_REPORTING_MODULE_LOAD_ANALYZER_H_