| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/renderer/content_settings_observer.h" | 5 #include "chrome/renderer/content_settings_observer.h" |
| 6 | 6 |
| 7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
| 8 #include "base/metrics/histogram.h" | 8 #include "base/metrics/histogram.h" |
| 9 #include "components/content_settings/content/common/content_settings_messages.h
" | 9 #include "components/content_settings/content/common/content_settings_messages.h
" |
| 10 #include "content/public/common/url_constants.h" | 10 #include "content/public/common/url_constants.h" |
| (...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 85 INSECURE_CONTENT_NUM_EVENTS | 85 INSECURE_CONTENT_NUM_EVENTS |
| 86 }; | 86 }; |
| 87 | 87 |
| 88 // Constants for UMA statistic collection. | 88 // Constants for UMA statistic collection. |
| 89 static const char kDotJS[] = ".js"; | 89 static const char kDotJS[] = ".js"; |
| 90 static const char kDotCSS[] = ".css"; | 90 static const char kDotCSS[] = ".css"; |
| 91 static const char kDotSWF[] = ".swf"; | 91 static const char kDotSWF[] = ".swf"; |
| 92 static const char kDotHTML[] = ".html"; | 92 static const char kDotHTML[] = ".html"; |
| 93 | 93 |
| 94 GURL GetOriginOrURL(const WebFrame* frame) { | 94 GURL GetOriginOrURL(const WebFrame* frame) { |
| 95 WebString top_origin = frame->top()->securityOrigin().toString(); | 95 WebString top_origin = frame->top()->getSecurityOrigin().toString(); |
| 96 // The |top_origin| is unique ("null") e.g., for file:// URLs. Use the | 96 // The |top_origin| is unique ("null") e.g., for file:// URLs. Use the |
| 97 // document URL as the primary URL in those cases. | 97 // document URL as the primary URL in those cases. |
| 98 // TODO(alexmos): This is broken for --site-per-process, since top() can be a | 98 // TODO(alexmos): This is broken for --site-per-process, since top() can be a |
| 99 // WebRemoteFrame which does not have a document(), and the WebRemoteFrame's | 99 // WebRemoteFrame which does not have a document(), and the WebRemoteFrame's |
| 100 // URL is not replicated. | 100 // URL is not replicated. |
| 101 if (top_origin == "null") | 101 if (top_origin == "null") |
| 102 return frame->top()->document().url(); | 102 return frame->top()->document().url(); |
| 103 return blink::WebStringToGURL(top_origin); | 103 return blink::WebStringToGURL(top_origin); |
| 104 } | 104 } |
| 105 | 105 |
| (...skipping 134 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 240 // |allowPlugins()| is called for the new page so that these functions can | 240 // |allowPlugins()| is called for the new page so that these functions can |
| 241 // correctly detect that a piece of content flipped from "not blocked" to | 241 // correctly detect that a piece of content flipped from "not blocked" to |
| 242 // "blocked". | 242 // "blocked". |
| 243 ClearBlockedContentSettings(); | 243 ClearBlockedContentSettings(); |
| 244 temporarily_allowed_plugins_.clear(); | 244 temporarily_allowed_plugins_.clear(); |
| 245 } | 245 } |
| 246 | 246 |
| 247 GURL url = frame->document().url(); | 247 GURL url = frame->document().url(); |
| 248 // If we start failing this DCHECK, please makes sure we don't regress | 248 // If we start failing this DCHECK, please makes sure we don't regress |
| 249 // this bug: http://code.google.com/p/chromium/issues/detail?id=79304 | 249 // this bug: http://code.google.com/p/chromium/issues/detail?id=79304 |
| 250 DCHECK(frame->document().securityOrigin().toString() == "null" || | 250 DCHECK(frame->document().getSecurityOrigin().toString() == "null" || |
| 251 !url.SchemeIs(url::kDataScheme)); | 251 !url.SchemeIs(url::kDataScheme)); |
| 252 } | 252 } |
| 253 | 253 |
| 254 bool ContentSettingsObserver::allowDatabase(const WebString& name, | 254 bool ContentSettingsObserver::allowDatabase(const WebString& name, |
| 255 const WebString& display_name, | 255 const WebString& display_name, |
| 256 unsigned long estimated_size) { | 256 unsigned long estimated_size) { |
| 257 WebFrame* frame = render_frame()->GetWebFrame(); | 257 WebFrame* frame = render_frame()->GetWebFrame(); |
| 258 if (frame->securityOrigin().isUnique() || | 258 if (frame->getSecurityOrigin().isUnique() || |
| 259 frame->top()->securityOrigin().isUnique()) | 259 frame->top()->getSecurityOrigin().isUnique()) |
| 260 return false; | 260 return false; |
| 261 | 261 |
| 262 bool result = false; | 262 bool result = false; |
| 263 Send(new ChromeViewHostMsg_AllowDatabase( | 263 Send(new ChromeViewHostMsg_AllowDatabase( |
| 264 routing_id(), | 264 routing_id(), |
| 265 blink::WebStringToGURL(frame->securityOrigin().toString()), | 265 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), |
| 266 blink::WebStringToGURL(frame->top()->securityOrigin().toString()), | 266 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()), |
| 267 name, display_name, &result)); | 267 name, display_name, &result)); |
| 268 return result; | 268 return result; |
| 269 } | 269 } |
| 270 | 270 |
| 271 void ContentSettingsObserver::requestFileSystemAccessAsync( | 271 void ContentSettingsObserver::requestFileSystemAccessAsync( |
| 272 const WebContentSettingCallbacks& callbacks) { | 272 const WebContentSettingCallbacks& callbacks) { |
| 273 WebFrame* frame = render_frame()->GetWebFrame(); | 273 WebFrame* frame = render_frame()->GetWebFrame(); |
| 274 if (frame->securityOrigin().isUnique() || | 274 if (frame->getSecurityOrigin().isUnique() || |
| 275 frame->top()->securityOrigin().isUnique()) { | 275 frame->top()->getSecurityOrigin().isUnique()) { |
| 276 WebContentSettingCallbacks permissionCallbacks(callbacks); | 276 WebContentSettingCallbacks permissionCallbacks(callbacks); |
| 277 permissionCallbacks.doDeny(); | 277 permissionCallbacks.doDeny(); |
| 278 return; | 278 return; |
| 279 } | 279 } |
| 280 ++current_request_id_; | 280 ++current_request_id_; |
| 281 std::pair<PermissionRequestMap::iterator, bool> insert_result = | 281 std::pair<PermissionRequestMap::iterator, bool> insert_result = |
| 282 permission_requests_.insert( | 282 permission_requests_.insert( |
| 283 std::make_pair(current_request_id_, callbacks)); | 283 std::make_pair(current_request_id_, callbacks)); |
| 284 | 284 |
| 285 // Verify there are no duplicate insertions. | 285 // Verify there are no duplicate insertions. |
| 286 DCHECK(insert_result.second); | 286 DCHECK(insert_result.second); |
| 287 | 287 |
| 288 Send(new ChromeViewHostMsg_RequestFileSystemAccessAsync( | 288 Send(new ChromeViewHostMsg_RequestFileSystemAccessAsync( |
| 289 routing_id(), current_request_id_, | 289 routing_id(), current_request_id_, |
| 290 blink::WebStringToGURL(frame->securityOrigin().toString()), | 290 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), |
| 291 blink::WebStringToGURL(frame->top()->securityOrigin().toString()))); | 291 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()))); |
| 292 } | 292 } |
| 293 | 293 |
| 294 bool ContentSettingsObserver::allowImage(bool enabled_per_settings, | 294 bool ContentSettingsObserver::allowImage(bool enabled_per_settings, |
| 295 const WebURL& image_url) { | 295 const WebURL& image_url) { |
| 296 bool allow = enabled_per_settings; | 296 bool allow = enabled_per_settings; |
| 297 if (enabled_per_settings) { | 297 if (enabled_per_settings) { |
| 298 if (is_interstitial_page_) | 298 if (is_interstitial_page_) |
| 299 return true; | 299 return true; |
| 300 | 300 |
| 301 if (IsWhitelistedForContentSettings()) | 301 if (IsWhitelistedForContentSettings()) |
| 302 return true; | 302 return true; |
| 303 | 303 |
| 304 if (content_setting_rules_) { | 304 if (content_setting_rules_) { |
| 305 GURL secondary_url(image_url); | 305 GURL secondary_url(image_url); |
| 306 allow = | 306 allow = |
| 307 GetContentSettingFromRules(content_setting_rules_->image_rules, | 307 GetContentSettingFromRules(content_setting_rules_->image_rules, |
| 308 render_frame()->GetWebFrame(), | 308 render_frame()->GetWebFrame(), |
| 309 secondary_url) != CONTENT_SETTING_BLOCK; | 309 secondary_url) != CONTENT_SETTING_BLOCK; |
| 310 } | 310 } |
| 311 } | 311 } |
| 312 if (!allow) | 312 if (!allow) |
| 313 DidBlockContentType(CONTENT_SETTINGS_TYPE_IMAGES); | 313 DidBlockContentType(CONTENT_SETTINGS_TYPE_IMAGES); |
| 314 return allow; | 314 return allow; |
| 315 } | 315 } |
| 316 | 316 |
| 317 bool ContentSettingsObserver::allowIndexedDB(const WebString& name, | 317 bool ContentSettingsObserver::allowIndexedDB(const WebString& name, |
| 318 const WebSecurityOrigin& origin) { | 318 const WebSecurityOrigin& origin) { |
| 319 WebFrame* frame = render_frame()->GetWebFrame(); | 319 WebFrame* frame = render_frame()->GetWebFrame(); |
| 320 if (frame->securityOrigin().isUnique() || | 320 if (frame->getSecurityOrigin().isUnique() || |
| 321 frame->top()->securityOrigin().isUnique()) | 321 frame->top()->getSecurityOrigin().isUnique()) |
| 322 return false; | 322 return false; |
| 323 | 323 |
| 324 bool result = false; | 324 bool result = false; |
| 325 Send(new ChromeViewHostMsg_AllowIndexedDB( | 325 Send(new ChromeViewHostMsg_AllowIndexedDB( |
| 326 routing_id(), | 326 routing_id(), |
| 327 blink::WebStringToGURL(frame->securityOrigin().toString()), | 327 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), |
| 328 blink::WebStringToGURL(frame->top()->securityOrigin().toString()), | 328 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()), |
| 329 name, &result)); | 329 name, &result)); |
| 330 return result; | 330 return result; |
| 331 } | 331 } |
| 332 | 332 |
| 333 bool ContentSettingsObserver::allowPlugins(bool enabled_per_settings) { | 333 bool ContentSettingsObserver::allowPlugins(bool enabled_per_settings) { |
| 334 return enabled_per_settings; | 334 return enabled_per_settings; |
| 335 } | 335 } |
| 336 | 336 |
| 337 bool ContentSettingsObserver::allowScript(bool enabled_per_settings) { | 337 bool ContentSettingsObserver::allowScript(bool enabled_per_settings) { |
| 338 if (!enabled_per_settings) | 338 if (!enabled_per_settings) |
| 339 return false; | 339 return false; |
| 340 if (is_interstitial_page_) | 340 if (is_interstitial_page_) |
| 341 return true; | 341 return true; |
| 342 | 342 |
| 343 WebFrame* frame = render_frame()->GetWebFrame(); | 343 WebFrame* frame = render_frame()->GetWebFrame(); |
| 344 std::map<WebFrame*, bool>::const_iterator it = | 344 std::map<WebFrame*, bool>::const_iterator it = |
| 345 cached_script_permissions_.find(frame); | 345 cached_script_permissions_.find(frame); |
| 346 if (it != cached_script_permissions_.end()) | 346 if (it != cached_script_permissions_.end()) |
| 347 return it->second; | 347 return it->second; |
| 348 | 348 |
| 349 // Evaluate the content setting rules before | 349 // Evaluate the content setting rules before |
| 350 // |IsWhitelistedForContentSettings|; if there is only the default rule | 350 // |IsWhitelistedForContentSettings|; if there is only the default rule |
| 351 // allowing all scripts, it's quicker this way. | 351 // allowing all scripts, it's quicker this way. |
| 352 bool allow = true; | 352 bool allow = true; |
| 353 if (content_setting_rules_) { | 353 if (content_setting_rules_) { |
| 354 ContentSetting setting = GetContentSettingFromRules( | 354 ContentSetting setting = GetContentSettingFromRules( |
| 355 content_setting_rules_->script_rules, | 355 content_setting_rules_->script_rules, frame, |
| 356 frame, | |
| 357 blink::WebStringToGURL( | 356 blink::WebStringToGURL( |
| 358 frame->document().securityOrigin().toString())); | 357 frame->document().getSecurityOrigin().toString())); |
| 359 allow = setting != CONTENT_SETTING_BLOCK; | 358 allow = setting != CONTENT_SETTING_BLOCK; |
| 360 } | 359 } |
| 361 allow = allow || IsWhitelistedForContentSettings(); | 360 allow = allow || IsWhitelistedForContentSettings(); |
| 362 | 361 |
| 363 cached_script_permissions_[frame] = allow; | 362 cached_script_permissions_[frame] = allow; |
| 364 return allow; | 363 return allow; |
| 365 } | 364 } |
| 366 | 365 |
| 367 bool ContentSettingsObserver::allowScriptFromSource( | 366 bool ContentSettingsObserver::allowScriptFromSource( |
| 368 bool enabled_per_settings, | 367 bool enabled_per_settings, |
| 369 const blink::WebURL& script_url) { | 368 const blink::WebURL& script_url) { |
| 370 if (!enabled_per_settings) | 369 if (!enabled_per_settings) |
| 371 return false; | 370 return false; |
| 372 if (is_interstitial_page_) | 371 if (is_interstitial_page_) |
| 373 return true; | 372 return true; |
| 374 | 373 |
| 375 bool allow = true; | 374 bool allow = true; |
| 376 if (content_setting_rules_) { | 375 if (content_setting_rules_) { |
| 377 ContentSetting setting = | 376 ContentSetting setting = |
| 378 GetContentSettingFromRules(content_setting_rules_->script_rules, | 377 GetContentSettingFromRules(content_setting_rules_->script_rules, |
| 379 render_frame()->GetWebFrame(), | 378 render_frame()->GetWebFrame(), |
| 380 GURL(script_url)); | 379 GURL(script_url)); |
| 381 allow = setting != CONTENT_SETTING_BLOCK; | 380 allow = setting != CONTENT_SETTING_BLOCK; |
| 382 } | 381 } |
| 383 return allow || IsWhitelistedForContentSettings(); | 382 return allow || IsWhitelistedForContentSettings(); |
| 384 } | 383 } |
| 385 | 384 |
| 386 bool ContentSettingsObserver::allowStorage(bool local) { | 385 bool ContentSettingsObserver::allowStorage(bool local) { |
| 387 WebFrame* frame = render_frame()->GetWebFrame(); | 386 WebFrame* frame = render_frame()->GetWebFrame(); |
| 388 if (frame->securityOrigin().isUnique() || | 387 if (frame->getSecurityOrigin().isUnique() || |
| 389 frame->top()->securityOrigin().isUnique()) | 388 frame->top()->getSecurityOrigin().isUnique()) |
| 390 return false; | 389 return false; |
| 391 bool result = false; | 390 bool result = false; |
| 392 | 391 |
| 393 StoragePermissionsKey key( | 392 StoragePermissionsKey key( |
| 394 blink::WebStringToGURL(frame->document().securityOrigin().toString()), | 393 blink::WebStringToGURL(frame->document().getSecurityOrigin().toString()), |
| 395 local); | 394 local); |
| 396 std::map<StoragePermissionsKey, bool>::const_iterator permissions = | 395 std::map<StoragePermissionsKey, bool>::const_iterator permissions = |
| 397 cached_storage_permissions_.find(key); | 396 cached_storage_permissions_.find(key); |
| 398 if (permissions != cached_storage_permissions_.end()) | 397 if (permissions != cached_storage_permissions_.end()) |
| 399 return permissions->second; | 398 return permissions->second; |
| 400 | 399 |
| 401 Send(new ChromeViewHostMsg_AllowDOMStorage( | 400 Send(new ChromeViewHostMsg_AllowDOMStorage( |
| 402 routing_id(), | 401 routing_id(), |
| 403 blink::WebStringToGURL(frame->securityOrigin().toString()), | 402 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), |
| 404 blink::WebStringToGURL(frame->top()->securityOrigin().toString()), | 403 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()), |
| 405 local, &result)); | 404 local, &result)); |
| 406 cached_storage_permissions_[key] = result; | 405 cached_storage_permissions_[key] = result; |
| 407 return result; | 406 return result; |
| 408 } | 407 } |
| 409 | 408 |
| 410 bool ContentSettingsObserver::allowReadFromClipboard(bool default_value) { | 409 bool ContentSettingsObserver::allowReadFromClipboard(bool default_value) { |
| 411 bool allowed = default_value; | 410 bool allowed = default_value; |
| 412 #if defined(ENABLE_EXTENSIONS) | 411 #if defined(ENABLE_EXTENSIONS) |
| 413 extensions::ScriptContext* current_context = | 412 extensions::ScriptContext* current_context = |
| 414 extension_dispatcher_->script_context_set().GetCurrent(); | 413 extension_dispatcher_->script_context_set().GetCurrent(); |
| (...skipping 72 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 487 return false; | 486 return false; |
| 488 } | 487 } |
| 489 | 488 |
| 490 return true; | 489 return true; |
| 491 } | 490 } |
| 492 | 491 |
| 493 void ContentSettingsObserver::didUseKeygen() { | 492 void ContentSettingsObserver::didUseKeygen() { |
| 494 WebFrame* frame = render_frame()->GetWebFrame(); | 493 WebFrame* frame = render_frame()->GetWebFrame(); |
| 495 Send(new ChromeViewHostMsg_DidUseKeygen( | 494 Send(new ChromeViewHostMsg_DidUseKeygen( |
| 496 routing_id(), | 495 routing_id(), |
| 497 blink::WebStringToGURL(frame->securityOrigin().toString()))); | 496 blink::WebStringToGURL(frame->getSecurityOrigin().toString()))); |
| 498 } | 497 } |
| 499 | 498 |
| 500 void ContentSettingsObserver::didNotAllowPlugins() { | 499 void ContentSettingsObserver::didNotAllowPlugins() { |
| 501 DidBlockContentType(CONTENT_SETTINGS_TYPE_PLUGINS); | 500 DidBlockContentType(CONTENT_SETTINGS_TYPE_PLUGINS); |
| 502 } | 501 } |
| 503 | 502 |
| 504 void ContentSettingsObserver::didNotAllowScript() { | 503 void ContentSettingsObserver::didNotAllowScript() { |
| 505 DidBlockContentType(CONTENT_SETTINGS_TYPE_JAVASCRIPT); | 504 DidBlockContentType(CONTENT_SETTINGS_TYPE_JAVASCRIPT); |
| 506 } | 505 } |
| 507 | 506 |
| (...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 556 | 555 |
| 557 void ContentSettingsObserver::ClearBlockedContentSettings() { | 556 void ContentSettingsObserver::ClearBlockedContentSettings() { |
| 558 content_blocked_.clear(); | 557 content_blocked_.clear(); |
| 559 cached_storage_permissions_.clear(); | 558 cached_storage_permissions_.clear(); |
| 560 cached_script_permissions_.clear(); | 559 cached_script_permissions_.clear(); |
| 561 } | 560 } |
| 562 | 561 |
| 563 bool ContentSettingsObserver::IsPlatformApp() { | 562 bool ContentSettingsObserver::IsPlatformApp() { |
| 564 #if defined(ENABLE_EXTENSIONS) | 563 #if defined(ENABLE_EXTENSIONS) |
| 565 WebFrame* frame = render_frame()->GetWebFrame(); | 564 WebFrame* frame = render_frame()->GetWebFrame(); |
| 566 WebSecurityOrigin origin = frame->document().securityOrigin(); | 565 WebSecurityOrigin origin = frame->document().getSecurityOrigin(); |
| 567 const extensions::Extension* extension = GetExtension(origin); | 566 const extensions::Extension* extension = GetExtension(origin); |
| 568 return extension && extension->is_platform_app(); | 567 return extension && extension->is_platform_app(); |
| 569 #else | 568 #else |
| 570 return false; | 569 return false; |
| 571 #endif | 570 #endif |
| 572 } | 571 } |
| 573 | 572 |
| 574 #if defined(ENABLE_EXTENSIONS) | 573 #if defined(ENABLE_EXTENSIONS) |
| 575 const extensions::Extension* ContentSettingsObserver::GetExtension( | 574 const extensions::Extension* ContentSettingsObserver::GetExtension( |
| 576 const WebSecurityOrigin& origin) const { | 575 const WebSecurityOrigin& origin) const { |
| (...skipping 12 matching lines...) Expand all Loading... |
| 589 bool ContentSettingsObserver::IsWhitelistedForContentSettings() const { | 588 bool ContentSettingsObserver::IsWhitelistedForContentSettings() const { |
| 590 if (should_whitelist_) | 589 if (should_whitelist_) |
| 591 return true; | 590 return true; |
| 592 | 591 |
| 593 // Whitelist ftp directory listings, as they require JavaScript to function | 592 // Whitelist ftp directory listings, as they require JavaScript to function |
| 594 // properly. | 593 // properly. |
| 595 if (render_frame()->IsFTPDirectoryListing()) | 594 if (render_frame()->IsFTPDirectoryListing()) |
| 596 return true; | 595 return true; |
| 597 | 596 |
| 598 WebFrame* web_frame = render_frame()->GetWebFrame(); | 597 WebFrame* web_frame = render_frame()->GetWebFrame(); |
| 599 return IsWhitelistedForContentSettings(web_frame->document().securityOrigin(), | 598 return IsWhitelistedForContentSettings( |
| 600 web_frame->document().url()); | 599 web_frame->document().getSecurityOrigin(), web_frame->document().url()); |
| 601 } | 600 } |
| 602 | 601 |
| 603 bool ContentSettingsObserver::IsWhitelistedForContentSettings( | 602 bool ContentSettingsObserver::IsWhitelistedForContentSettings( |
| 604 const WebSecurityOrigin& origin, | 603 const WebSecurityOrigin& origin, |
| 605 const GURL& document_url) { | 604 const GURL& document_url) { |
| 606 if (document_url == GURL(content::kUnreachableWebDataURL)) | 605 if (document_url == GURL(content::kUnreachableWebDataURL)) |
| 607 return true; | 606 return true; |
| 608 | 607 |
| 609 if (origin.isUnique()) | 608 if (origin.isUnique()) |
| 610 return false; // Uninitialized document? | 609 return false; // Uninitialized document? |
| (...skipping 17 matching lines...) Expand all Loading... |
| 628 | 627 |
| 629 // If the scheme is file:, an empty file name indicates a directory listing, | 628 // If the scheme is file:, an empty file name indicates a directory listing, |
| 630 // which requires JavaScript to function properly. | 629 // which requires JavaScript to function properly. |
| 631 if (base::EqualsASCII(protocol, url::kFileScheme)) { | 630 if (base::EqualsASCII(protocol, url::kFileScheme)) { |
| 632 return document_url.SchemeIs(url::kFileScheme) && | 631 return document_url.SchemeIs(url::kFileScheme) && |
| 633 document_url.ExtractFileName().empty(); | 632 document_url.ExtractFileName().empty(); |
| 634 } | 633 } |
| 635 | 634 |
| 636 return false; | 635 return false; |
| 637 } | 636 } |
| OLD | NEW |