PPAPI: Add permissions checking for PPB_NetworkProxy

content/browser/renderer_host/pepper/pepper_network_proxy_host.h

Index: content/browser/renderer_host/pepper/pepper_network_proxy_host.h
diff --git a/content/browser/renderer_host/pepper/pepper_network_proxy_host.h b/content/browser/renderer_host/pepper/pepper_network_proxy_host.h
index 84293be553ffb5b17cde8d54ce2ce3dd51c30f67..94e83f39416d20ab701cf293a0840d265cb80cd8 100644
--- a/content/browser/renderer_host/pepper/pepper_network_proxy_host.h
+++ b/content/browser/renderer_host/pepper/pepper_network_proxy_host.h
@@ -30,7 +30,7 @@ namespace content {
 
 class BrowserPpapiHost;
 
-// The host for PPB_NetworkProxy. This class runs exclusively on the IO thread.
+// The host for PPB_NetworkProxy. This class lives on the IO thread.
 class CONTENT_EXPORT PepperNetworkProxyHost : public ppapi::host::ResourceHost {
  public:
   PepperNetworkProxyHost(BrowserPpapiHost* host,
@@ -40,10 +40,18 @@ class CONTENT_EXPORT PepperNetworkProxyHost : public ppapi::host::ResourceHost {
   virtual ~PepperNetworkProxyHost();
 
  private:
-  // We retrieve the appropriate URLRequestContextGetter on the UI thread
-  // and pass it to this function, which uses it to retrieve proxy_service_.
-  void DidGetURLRequestContextGetter(
-      scoped_refptr<net::URLRequestContextGetter> context_getter);
+  // We retrieve the appropriate URLRequestContextGetter and whether this API
+  // is allowed for the instance on the UI thread and pass those to
+  // DidGetUIThreadData, which sets allowed_ and proxy_service_.
+  struct UIThreadData {
+    UIThreadData();

[yzshen1, 2013/06/21 18:06:24]

I suspect you will get a warning of not having a destructor defined. But I am
fine if the compiler doesn't complain. :)

[dmichael (off chromium), 2013/06/21 20:25:45]

The compiler provides the destructor for you by default. It's usually only
important to provide one if you need to make it virtual or if you have to do
something special in the destructor, like delete a heap-allocated object. In
this case, the generated destructor invokes the destructor of the scoped_refptr,
so there's no need to write one.

[yzshen1, 2013/06/21 20:31:35]

Yeah, I know.
I just vaguely remember that clang will complain that you don't have a 
destructor defined in certain cases. (But I don't remember which cases.)

I am fine if it doesn't complain. :)

+    bool is_allowed;
+    scoped_refptr<net::URLRequestContextGetter> context_getter;
+  };
+  static UIThreadData GetUIThreadDataOnUIThread(int render_process_id,
+                                                int render_view_id,
+                                                bool is_external_plugin);
+  void DidGetUIThreadData(const UIThreadData&);
 
   // ResourceHost implementation.
   virtual int32_t OnResourceMessageReceived(
@@ -62,8 +70,15 @@ class CONTENT_EXPORT PepperNetworkProxyHost : public ppapi::host::ResourceHost {
   void SendFailureReply(int32_t error,
                         ppapi::host::ReplyMessageContext context);
 
+  // The following two members are invalid until we get some information from
+  // the UI thread. However, these are only ever set or accessed on the IO
+  // thread.
   net::ProxyService* proxy_service_;
-  bool waiting_for_proxy_service_;
+  bool is_allowed_;
+
+  // False initially, but set to true once the values for proxy_service_ and

[yzshen1, 2013/06/21 18:06:24]

Is this comment inverted? It is set to false when |proxy_service_| and
|is_allowed_| are set.

[dmichael (off chromium), 2013/06/21 20:25:45]

Oops! Thanks, nice catch.

+  // is_allowed_ have been set.
+  bool waiting_for_ui_thread_data_;
 
   // We have to get the URLRequestContextGetter from the UI thread before we
   // can retrieve proxy_service_. If we receive any calls for GetProxyForURL