OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/renderer/content_settings_observer.h" | 5 #include "chrome/renderer/content_settings_observer.h" |
6 | 6 |
7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
8 #include "base/metrics/histogram.h" | 8 #include "base/metrics/histogram.h" |
9 #include "components/content_settings/content/common/content_settings_messages.h
" | 9 #include "components/content_settings/content/common/content_settings_messages.h
" |
10 #include "content/public/common/url_constants.h" | 10 #include "content/public/common/url_constants.h" |
(...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
85 INSECURE_CONTENT_NUM_EVENTS | 85 INSECURE_CONTENT_NUM_EVENTS |
86 }; | 86 }; |
87 | 87 |
88 // Constants for UMA statistic collection. | 88 // Constants for UMA statistic collection. |
89 static const char kDotJS[] = ".js"; | 89 static const char kDotJS[] = ".js"; |
90 static const char kDotCSS[] = ".css"; | 90 static const char kDotCSS[] = ".css"; |
91 static const char kDotSWF[] = ".swf"; | 91 static const char kDotSWF[] = ".swf"; |
92 static const char kDotHTML[] = ".html"; | 92 static const char kDotHTML[] = ".html"; |
93 | 93 |
94 GURL GetOriginOrURL(const WebFrame* frame) { | 94 GURL GetOriginOrURL(const WebFrame* frame) { |
95 WebString top_origin = frame->top()->securityOrigin().toString(); | 95 WebString top_origin = frame->top()->getSecurityOrigin().toString(); |
96 // The |top_origin| is unique ("null") e.g., for file:// URLs. Use the | 96 // The |top_origin| is unique ("null") e.g., for file:// URLs. Use the |
97 // document URL as the primary URL in those cases. | 97 // document URL as the primary URL in those cases. |
98 // TODO(alexmos): This is broken for --site-per-process, since top() can be a | 98 // TODO(alexmos): This is broken for --site-per-process, since top() can be a |
99 // WebRemoteFrame which does not have a document(), and the WebRemoteFrame's | 99 // WebRemoteFrame which does not have a document(), and the WebRemoteFrame's |
100 // URL is not replicated. | 100 // URL is not replicated. |
101 if (top_origin == "null") | 101 if (top_origin == "null") |
102 return frame->top()->document().url(); | 102 return frame->top()->document().url(); |
103 return blink::WebStringToGURL(top_origin); | 103 return blink::WebStringToGURL(top_origin); |
104 } | 104 } |
105 | 105 |
(...skipping 134 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
240 // |allowPlugins()| is called for the new page so that these functions can | 240 // |allowPlugins()| is called for the new page so that these functions can |
241 // correctly detect that a piece of content flipped from "not blocked" to | 241 // correctly detect that a piece of content flipped from "not blocked" to |
242 // "blocked". | 242 // "blocked". |
243 ClearBlockedContentSettings(); | 243 ClearBlockedContentSettings(); |
244 temporarily_allowed_plugins_.clear(); | 244 temporarily_allowed_plugins_.clear(); |
245 } | 245 } |
246 | 246 |
247 GURL url = frame->document().url(); | 247 GURL url = frame->document().url(); |
248 // If we start failing this DCHECK, please makes sure we don't regress | 248 // If we start failing this DCHECK, please makes sure we don't regress |
249 // this bug: http://code.google.com/p/chromium/issues/detail?id=79304 | 249 // this bug: http://code.google.com/p/chromium/issues/detail?id=79304 |
250 DCHECK(frame->document().securityOrigin().toString() == "null" || | 250 DCHECK(frame->document().getSecurityOrigin().toString() == "null" || |
251 !url.SchemeIs(url::kDataScheme)); | 251 !url.SchemeIs(url::kDataScheme)); |
252 } | 252 } |
253 | 253 |
254 bool ContentSettingsObserver::allowDatabase(const WebString& name, | 254 bool ContentSettingsObserver::allowDatabase(const WebString& name, |
255 const WebString& display_name, | 255 const WebString& display_name, |
256 unsigned long estimated_size) { | 256 unsigned long estimated_size) { |
257 WebFrame* frame = render_frame()->GetWebFrame(); | 257 WebFrame* frame = render_frame()->GetWebFrame(); |
258 if (frame->securityOrigin().isUnique() || | 258 if (frame->getSecurityOrigin().isUnique() || |
259 frame->top()->securityOrigin().isUnique()) | 259 frame->top()->getSecurityOrigin().isUnique()) |
260 return false; | 260 return false; |
261 | 261 |
262 bool result = false; | 262 bool result = false; |
263 Send(new ChromeViewHostMsg_AllowDatabase( | 263 Send(new ChromeViewHostMsg_AllowDatabase( |
264 routing_id(), | 264 routing_id(), |
265 blink::WebStringToGURL(frame->securityOrigin().toString()), | 265 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), |
266 blink::WebStringToGURL(frame->top()->securityOrigin().toString()), | 266 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()), |
267 name, display_name, &result)); | 267 name, display_name, &result)); |
268 return result; | 268 return result; |
269 } | 269 } |
270 | 270 |
271 void ContentSettingsObserver::requestFileSystemAccessAsync( | 271 void ContentSettingsObserver::requestFileSystemAccessAsync( |
272 const WebContentSettingCallbacks& callbacks) { | 272 const WebContentSettingCallbacks& callbacks) { |
273 WebFrame* frame = render_frame()->GetWebFrame(); | 273 WebFrame* frame = render_frame()->GetWebFrame(); |
274 if (frame->securityOrigin().isUnique() || | 274 if (frame->getSecurityOrigin().isUnique() || |
275 frame->top()->securityOrigin().isUnique()) { | 275 frame->top()->getSecurityOrigin().isUnique()) { |
276 WebContentSettingCallbacks permissionCallbacks(callbacks); | 276 WebContentSettingCallbacks permissionCallbacks(callbacks); |
277 permissionCallbacks.doDeny(); | 277 permissionCallbacks.doDeny(); |
278 return; | 278 return; |
279 } | 279 } |
280 ++current_request_id_; | 280 ++current_request_id_; |
281 std::pair<PermissionRequestMap::iterator, bool> insert_result = | 281 std::pair<PermissionRequestMap::iterator, bool> insert_result = |
282 permission_requests_.insert( | 282 permission_requests_.insert( |
283 std::make_pair(current_request_id_, callbacks)); | 283 std::make_pair(current_request_id_, callbacks)); |
284 | 284 |
285 // Verify there are no duplicate insertions. | 285 // Verify there are no duplicate insertions. |
286 DCHECK(insert_result.second); | 286 DCHECK(insert_result.second); |
287 | 287 |
288 Send(new ChromeViewHostMsg_RequestFileSystemAccessAsync( | 288 Send(new ChromeViewHostMsg_RequestFileSystemAccessAsync( |
289 routing_id(), current_request_id_, | 289 routing_id(), current_request_id_, |
290 blink::WebStringToGURL(frame->securityOrigin().toString()), | 290 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), |
291 blink::WebStringToGURL(frame->top()->securityOrigin().toString()))); | 291 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()))); |
292 } | 292 } |
293 | 293 |
294 bool ContentSettingsObserver::allowImage(bool enabled_per_settings, | 294 bool ContentSettingsObserver::allowImage(bool enabled_per_settings, |
295 const WebURL& image_url) { | 295 const WebURL& image_url) { |
296 bool allow = enabled_per_settings; | 296 bool allow = enabled_per_settings; |
297 if (enabled_per_settings) { | 297 if (enabled_per_settings) { |
298 if (is_interstitial_page_) | 298 if (is_interstitial_page_) |
299 return true; | 299 return true; |
300 | 300 |
301 if (IsWhitelistedForContentSettings()) | 301 if (IsWhitelistedForContentSettings()) |
302 return true; | 302 return true; |
303 | 303 |
304 if (content_setting_rules_) { | 304 if (content_setting_rules_) { |
305 GURL secondary_url(image_url); | 305 GURL secondary_url(image_url); |
306 allow = | 306 allow = |
307 GetContentSettingFromRules(content_setting_rules_->image_rules, | 307 GetContentSettingFromRules(content_setting_rules_->image_rules, |
308 render_frame()->GetWebFrame(), | 308 render_frame()->GetWebFrame(), |
309 secondary_url) != CONTENT_SETTING_BLOCK; | 309 secondary_url) != CONTENT_SETTING_BLOCK; |
310 } | 310 } |
311 } | 311 } |
312 if (!allow) | 312 if (!allow) |
313 DidBlockContentType(CONTENT_SETTINGS_TYPE_IMAGES); | 313 DidBlockContentType(CONTENT_SETTINGS_TYPE_IMAGES); |
314 return allow; | 314 return allow; |
315 } | 315 } |
316 | 316 |
317 bool ContentSettingsObserver::allowIndexedDB(const WebString& name, | 317 bool ContentSettingsObserver::allowIndexedDB(const WebString& name, |
318 const WebSecurityOrigin& origin) { | 318 const WebSecurityOrigin& origin) { |
319 WebFrame* frame = render_frame()->GetWebFrame(); | 319 WebFrame* frame = render_frame()->GetWebFrame(); |
320 if (frame->securityOrigin().isUnique() || | 320 if (frame->getSecurityOrigin().isUnique() || |
321 frame->top()->securityOrigin().isUnique()) | 321 frame->top()->getSecurityOrigin().isUnique()) |
322 return false; | 322 return false; |
323 | 323 |
324 bool result = false; | 324 bool result = false; |
325 Send(new ChromeViewHostMsg_AllowIndexedDB( | 325 Send(new ChromeViewHostMsg_AllowIndexedDB( |
326 routing_id(), | 326 routing_id(), |
327 blink::WebStringToGURL(frame->securityOrigin().toString()), | 327 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), |
328 blink::WebStringToGURL(frame->top()->securityOrigin().toString()), | 328 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()), |
329 name, &result)); | 329 name, &result)); |
330 return result; | 330 return result; |
331 } | 331 } |
332 | 332 |
333 bool ContentSettingsObserver::allowPlugins(bool enabled_per_settings) { | 333 bool ContentSettingsObserver::allowPlugins(bool enabled_per_settings) { |
334 return enabled_per_settings; | 334 return enabled_per_settings; |
335 } | 335 } |
336 | 336 |
337 bool ContentSettingsObserver::allowScript(bool enabled_per_settings) { | 337 bool ContentSettingsObserver::allowScript(bool enabled_per_settings) { |
338 if (!enabled_per_settings) | 338 if (!enabled_per_settings) |
339 return false; | 339 return false; |
340 if (is_interstitial_page_) | 340 if (is_interstitial_page_) |
341 return true; | 341 return true; |
342 | 342 |
343 WebFrame* frame = render_frame()->GetWebFrame(); | 343 WebFrame* frame = render_frame()->GetWebFrame(); |
344 std::map<WebFrame*, bool>::const_iterator it = | 344 std::map<WebFrame*, bool>::const_iterator it = |
345 cached_script_permissions_.find(frame); | 345 cached_script_permissions_.find(frame); |
346 if (it != cached_script_permissions_.end()) | 346 if (it != cached_script_permissions_.end()) |
347 return it->second; | 347 return it->second; |
348 | 348 |
349 // Evaluate the content setting rules before | 349 // Evaluate the content setting rules before |
350 // |IsWhitelistedForContentSettings|; if there is only the default rule | 350 // |IsWhitelistedForContentSettings|; if there is only the default rule |
351 // allowing all scripts, it's quicker this way. | 351 // allowing all scripts, it's quicker this way. |
352 bool allow = true; | 352 bool allow = true; |
353 if (content_setting_rules_) { | 353 if (content_setting_rules_) { |
354 ContentSetting setting = GetContentSettingFromRules( | 354 ContentSetting setting = GetContentSettingFromRules( |
355 content_setting_rules_->script_rules, | 355 content_setting_rules_->script_rules, frame, |
356 frame, | |
357 blink::WebStringToGURL( | 356 blink::WebStringToGURL( |
358 frame->document().securityOrigin().toString())); | 357 frame->document().getSecurityOrigin().toString())); |
359 allow = setting != CONTENT_SETTING_BLOCK; | 358 allow = setting != CONTENT_SETTING_BLOCK; |
360 } | 359 } |
361 allow = allow || IsWhitelistedForContentSettings(); | 360 allow = allow || IsWhitelistedForContentSettings(); |
362 | 361 |
363 cached_script_permissions_[frame] = allow; | 362 cached_script_permissions_[frame] = allow; |
364 return allow; | 363 return allow; |
365 } | 364 } |
366 | 365 |
367 bool ContentSettingsObserver::allowScriptFromSource( | 366 bool ContentSettingsObserver::allowScriptFromSource( |
368 bool enabled_per_settings, | 367 bool enabled_per_settings, |
369 const blink::WebURL& script_url) { | 368 const blink::WebURL& script_url) { |
370 if (!enabled_per_settings) | 369 if (!enabled_per_settings) |
371 return false; | 370 return false; |
372 if (is_interstitial_page_) | 371 if (is_interstitial_page_) |
373 return true; | 372 return true; |
374 | 373 |
375 bool allow = true; | 374 bool allow = true; |
376 if (content_setting_rules_) { | 375 if (content_setting_rules_) { |
377 ContentSetting setting = | 376 ContentSetting setting = |
378 GetContentSettingFromRules(content_setting_rules_->script_rules, | 377 GetContentSettingFromRules(content_setting_rules_->script_rules, |
379 render_frame()->GetWebFrame(), | 378 render_frame()->GetWebFrame(), |
380 GURL(script_url)); | 379 GURL(script_url)); |
381 allow = setting != CONTENT_SETTING_BLOCK; | 380 allow = setting != CONTENT_SETTING_BLOCK; |
382 } | 381 } |
383 return allow || IsWhitelistedForContentSettings(); | 382 return allow || IsWhitelistedForContentSettings(); |
384 } | 383 } |
385 | 384 |
386 bool ContentSettingsObserver::allowStorage(bool local) { | 385 bool ContentSettingsObserver::allowStorage(bool local) { |
387 WebFrame* frame = render_frame()->GetWebFrame(); | 386 WebFrame* frame = render_frame()->GetWebFrame(); |
388 if (frame->securityOrigin().isUnique() || | 387 if (frame->getSecurityOrigin().isUnique() || |
389 frame->top()->securityOrigin().isUnique()) | 388 frame->top()->getSecurityOrigin().isUnique()) |
390 return false; | 389 return false; |
391 bool result = false; | 390 bool result = false; |
392 | 391 |
393 StoragePermissionsKey key( | 392 StoragePermissionsKey key( |
394 blink::WebStringToGURL(frame->document().securityOrigin().toString()), | 393 blink::WebStringToGURL(frame->document().getSecurityOrigin().toString()), |
395 local); | 394 local); |
396 std::map<StoragePermissionsKey, bool>::const_iterator permissions = | 395 std::map<StoragePermissionsKey, bool>::const_iterator permissions = |
397 cached_storage_permissions_.find(key); | 396 cached_storage_permissions_.find(key); |
398 if (permissions != cached_storage_permissions_.end()) | 397 if (permissions != cached_storage_permissions_.end()) |
399 return permissions->second; | 398 return permissions->second; |
400 | 399 |
401 Send(new ChromeViewHostMsg_AllowDOMStorage( | 400 Send(new ChromeViewHostMsg_AllowDOMStorage( |
402 routing_id(), | 401 routing_id(), |
403 blink::WebStringToGURL(frame->securityOrigin().toString()), | 402 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), |
404 blink::WebStringToGURL(frame->top()->securityOrigin().toString()), | 403 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()), |
405 local, &result)); | 404 local, &result)); |
406 cached_storage_permissions_[key] = result; | 405 cached_storage_permissions_[key] = result; |
407 return result; | 406 return result; |
408 } | 407 } |
409 | 408 |
410 bool ContentSettingsObserver::allowReadFromClipboard(bool default_value) { | 409 bool ContentSettingsObserver::allowReadFromClipboard(bool default_value) { |
411 bool allowed = default_value; | 410 bool allowed = default_value; |
412 #if defined(ENABLE_EXTENSIONS) | 411 #if defined(ENABLE_EXTENSIONS) |
413 extensions::ScriptContext* current_context = | 412 extensions::ScriptContext* current_context = |
414 extension_dispatcher_->script_context_set().GetCurrent(); | 413 extension_dispatcher_->script_context_set().GetCurrent(); |
(...skipping 72 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
487 return false; | 486 return false; |
488 } | 487 } |
489 | 488 |
490 return true; | 489 return true; |
491 } | 490 } |
492 | 491 |
493 void ContentSettingsObserver::didUseKeygen() { | 492 void ContentSettingsObserver::didUseKeygen() { |
494 WebFrame* frame = render_frame()->GetWebFrame(); | 493 WebFrame* frame = render_frame()->GetWebFrame(); |
495 Send(new ChromeViewHostMsg_DidUseKeygen( | 494 Send(new ChromeViewHostMsg_DidUseKeygen( |
496 routing_id(), | 495 routing_id(), |
497 blink::WebStringToGURL(frame->securityOrigin().toString()))); | 496 blink::WebStringToGURL(frame->getSecurityOrigin().toString()))); |
498 } | 497 } |
499 | 498 |
500 void ContentSettingsObserver::didNotAllowPlugins() { | 499 void ContentSettingsObserver::didNotAllowPlugins() { |
501 DidBlockContentType(CONTENT_SETTINGS_TYPE_PLUGINS); | 500 DidBlockContentType(CONTENT_SETTINGS_TYPE_PLUGINS); |
502 } | 501 } |
503 | 502 |
504 void ContentSettingsObserver::didNotAllowScript() { | 503 void ContentSettingsObserver::didNotAllowScript() { |
505 DidBlockContentType(CONTENT_SETTINGS_TYPE_JAVASCRIPT); | 504 DidBlockContentType(CONTENT_SETTINGS_TYPE_JAVASCRIPT); |
506 } | 505 } |
507 | 506 |
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
556 | 555 |
557 void ContentSettingsObserver::ClearBlockedContentSettings() { | 556 void ContentSettingsObserver::ClearBlockedContentSettings() { |
558 content_blocked_.clear(); | 557 content_blocked_.clear(); |
559 cached_storage_permissions_.clear(); | 558 cached_storage_permissions_.clear(); |
560 cached_script_permissions_.clear(); | 559 cached_script_permissions_.clear(); |
561 } | 560 } |
562 | 561 |
563 bool ContentSettingsObserver::IsPlatformApp() { | 562 bool ContentSettingsObserver::IsPlatformApp() { |
564 #if defined(ENABLE_EXTENSIONS) | 563 #if defined(ENABLE_EXTENSIONS) |
565 WebFrame* frame = render_frame()->GetWebFrame(); | 564 WebFrame* frame = render_frame()->GetWebFrame(); |
566 WebSecurityOrigin origin = frame->document().securityOrigin(); | 565 WebSecurityOrigin origin = frame->document().getSecurityOrigin(); |
567 const extensions::Extension* extension = GetExtension(origin); | 566 const extensions::Extension* extension = GetExtension(origin); |
568 return extension && extension->is_platform_app(); | 567 return extension && extension->is_platform_app(); |
569 #else | 568 #else |
570 return false; | 569 return false; |
571 #endif | 570 #endif |
572 } | 571 } |
573 | 572 |
574 #if defined(ENABLE_EXTENSIONS) | 573 #if defined(ENABLE_EXTENSIONS) |
575 const extensions::Extension* ContentSettingsObserver::GetExtension( | 574 const extensions::Extension* ContentSettingsObserver::GetExtension( |
576 const WebSecurityOrigin& origin) const { | 575 const WebSecurityOrigin& origin) const { |
(...skipping 12 matching lines...) Expand all Loading... |
589 bool ContentSettingsObserver::IsWhitelistedForContentSettings() const { | 588 bool ContentSettingsObserver::IsWhitelistedForContentSettings() const { |
590 if (should_whitelist_) | 589 if (should_whitelist_) |
591 return true; | 590 return true; |
592 | 591 |
593 // Whitelist ftp directory listings, as they require JavaScript to function | 592 // Whitelist ftp directory listings, as they require JavaScript to function |
594 // properly. | 593 // properly. |
595 if (render_frame()->IsFTPDirectoryListing()) | 594 if (render_frame()->IsFTPDirectoryListing()) |
596 return true; | 595 return true; |
597 | 596 |
598 WebFrame* web_frame = render_frame()->GetWebFrame(); | 597 WebFrame* web_frame = render_frame()->GetWebFrame(); |
599 return IsWhitelistedForContentSettings(web_frame->document().securityOrigin(), | 598 return IsWhitelistedForContentSettings( |
600 web_frame->document().url()); | 599 web_frame->document().getSecurityOrigin(), web_frame->document().url()); |
601 } | 600 } |
602 | 601 |
603 bool ContentSettingsObserver::IsWhitelistedForContentSettings( | 602 bool ContentSettingsObserver::IsWhitelistedForContentSettings( |
604 const WebSecurityOrigin& origin, | 603 const WebSecurityOrigin& origin, |
605 const GURL& document_url) { | 604 const GURL& document_url) { |
606 if (document_url == GURL(content::kUnreachableWebDataURL)) | 605 if (document_url == GURL(content::kUnreachableWebDataURL)) |
607 return true; | 606 return true; |
608 | 607 |
609 if (origin.isUnique()) | 608 if (origin.isUnique()) |
610 return false; // Uninitialized document? | 609 return false; // Uninitialized document? |
(...skipping 17 matching lines...) Expand all Loading... |
628 | 627 |
629 // If the scheme is file:, an empty file name indicates a directory listing, | 628 // If the scheme is file:, an empty file name indicates a directory listing, |
630 // which requires JavaScript to function properly. | 629 // which requires JavaScript to function properly. |
631 if (base::EqualsASCII(protocol, url::kFileScheme)) { | 630 if (base::EqualsASCII(protocol, url::kFileScheme)) { |
632 return document_url.SchemeIs(url::kFileScheme) && | 631 return document_url.SchemeIs(url::kFileScheme) && |
633 document_url.ExtractFileName().empty(); | 632 document_url.ExtractFileName().empty(); |
634 } | 633 } |
635 | 634 |
636 return false; | 635 return false; |
637 } | 636 } |
OLD | NEW |