PPAPI: Add permissions checking for PPB_NetworkProxy

content/browser/renderer_host/pepper/pepper_network_proxy_host.h

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_RENDERER_HOST_PEPPER_PEPPER_NETWORK_PROXY_HOST_H_
 #define CONTENT_BROWSER_RENDERER_HOST_PEPPER_PEPPER_NETWORK_PROXY_HOST_H_
 
 #include <queue>
 #include <string>
 
@@ skipping 12 matching lines @@
 namespace ppapi {
 namespace host {
 struct ReplyMessageContext;
 }
 }
 
 namespace content {
 
 class BrowserPpapiHost;
 
-// The host for PPB_NetworkProxy. This class runs exclusively on the IO thread.
+// The host for PPB_NetworkProxy. This class lives on the IO thread.
 class CONTENT_EXPORT PepperNetworkProxyHost : public ppapi::host::ResourceHost {
  public:
   PepperNetworkProxyHost(BrowserPpapiHost* host,
                          PP_Instance instance,
                          PP_Resource resource);
 
   virtual ~PepperNetworkProxyHost();
 
  private:
-  // We retrieve the appropriate URLRequestContextGetter on the UI thread
-  // and pass it to this function, which uses it to retrieve proxy_service_.
-  void DidGetURLRequestContextGetter(
-      scoped_refptr<net::URLRequestContextGetter> context_getter);
+  // We retrieve the appropriate URLRequestContextGetter and whether this API
+  // is allowed for the instance on the UI thread and pass those to
+  // DidGetUIThreadData, which sets allowed_ and proxy_service_.
+  struct UIThreadData {
+    UIThreadData();

[yzshen1, 2013/06/21 18:06:24]

I suspect you will get a warning of not having a destructor defined. But I am
fine if the compiler doesn't complain. :)

[dmichael (off chromium), 2013/06/21 20:25:45]

The compiler provides the destructor for you by default. It's usually only
important to provide one if you need to make it virtual or if you have to do
something special in the destructor, like delete a heap-allocated object. In
this case, the generated destructor invokes the destructor of the scoped_refptr,
so there's no need to write one.

[yzshen1, 2013/06/21 20:31:35]

Yeah, I know.
I just vaguely remember that clang will complain that you don't have a 
destructor defined in certain cases. (But I don't remember which cases.)

I am fine if it doesn't complain. :)

+    bool is_allowed;
+    scoped_refptr<net::URLRequestContextGetter> context_getter;
+  };
+  static UIThreadData GetUIThreadDataOnUIThread(int render_process_id,
+                                                int render_view_id,
+                                                bool is_external_plugin);
+  void DidGetUIThreadData(const UIThreadData&);
 
   // ResourceHost implementation.
   virtual int32_t OnResourceMessageReceived(
       const IPC::Message& msg,
       ppapi::host::HostMessageContext* context) OVERRIDE;
 
   int32_t OnMsgGetProxyForURL(ppapi::host::HostMessageContext* context,
                               const std::string& url);
 
   // If we have a valid proxy_service_, send all messages in unsent_requests_.
   void TryToSendUnsentRequests();
 
   void OnResolveProxyCompleted(ppapi::host::ReplyMessageContext context,
                                net::ProxyInfo* proxy_info,
                                int result);
   void SendFailureReply(int32_t error,
                         ppapi::host::ReplyMessageContext context);
 
+  // The following two members are invalid until we get some information from
+  // the UI thread. However, these are only ever set or accessed on the IO
+  // thread.
   net::ProxyService* proxy_service_;
-  bool waiting_for_proxy_service_;
+  bool is_allowed_;
+
+  // False initially, but set to true once the values for proxy_service_ and

[yzshen1, 2013/06/21 18:06:24]

Is this comment inverted? It is set to false when |proxy_service_| and
|is_allowed_| are set.

[dmichael (off chromium), 2013/06/21 20:25:45]

Oops! Thanks, nice catch.

+  // is_allowed_ have been set.
+  bool waiting_for_ui_thread_data_;
 
   // We have to get the URLRequestContextGetter from the UI thread before we
   // can retrieve proxy_service_. If we receive any calls for GetProxyForURL
   // before proxy_service_ is available, we save them in unsent_requests_.
   struct UnsentRequest {
     GURL url;
     ppapi::host::ReplyMessageContext reply_context;
   };
   std::queue<UnsentRequest> unsent_requests_;
 
   // Requests awaiting a response from ProxyService. We need to store these so
   // that we can cancel them if we get destroyed.
   std::queue<net::ProxyService::PacRequest*> pending_requests_;
 
   base::WeakPtrFactory<PepperNetworkProxyHost> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(PepperNetworkProxyHost);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_PEPPER_PEPPER_NETWORK_PROXY_HOST_H_