IndexedDB: Pass url::Origin rather than GURL over IPC

content/browser/indexed_db/indexed_db_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 
 #include <stddef.h>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 26 matching lines @@
 #include "storage/browser/quota/quota_manager_proxy.h"
 #include "storage/common/database/database_identifier.h"
 #include "third_party/WebKit/public/platform/modules/indexeddb/WebIDBDatabaseException.h"
 #include "url/gurl.h"
 
 using storage::DatabaseUtil;
 using blink::WebIDBKey;
 
 namespace content {
 
+namespace {
+
+bool IsValidOrigin(const url::Origin& origin) {
+  return !origin.unique();
+}
+
+}  // namespace
+
 IndexedDBDispatcherHost::IndexedDBDispatcherHost(
     int ipc_process_id,
     net::URLRequestContextGetter* request_context_getter,
     IndexedDBContextImpl* indexed_db_context,
     ChromeBlobStorageContext* blob_storage_context)
     : BrowserMessageFilter(IndexedDBMsgStart),
       request_context_getter_(request_context_getter),
       request_context_(NULL),
       indexed_db_context_(indexed_db_context),
       blob_storage_context_(blob_storage_context),
@@ skipping 247 matching lines @@
       idb_store_metadata.indexes.push_back(idb_index_metadata);
     }
     metadata.object_stores.push_back(idb_store_metadata);
   }
   return metadata;
 }
 
 void IndexedDBDispatcherHost::OnIDBFactoryGetDatabaseNames(
     const IndexedDBHostMsg_FactoryGetDatabaseNames_Params& params) {
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
+
+  if (!IsValidOrigin(params.origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::IDBDH_INVALID_ORIGIN);

[Charlie Reis, 2016/04/13 20:21:07]

You're using the same value in multiple places, which means you won't be able to
distinguish which IPC is to blame if this kill happens in practice.  Maybe
that's fine for now, and you can split them apart if it turns out that you see a
bunch in the wild?

(Don't forget to check the histogram after a few days on Dev Channel, or
subscribe to alerts.)

[jsbell, 2016/04/13 21:52:45]

Yeah, this would only happen if (1) we've got a bug and allowing an invalid
origin to start using Indexed DB (so any IPC is equally bad, and has a common
fix) or (2) the renderer is corrupted/compromised.

+    return;
+  }
+
   base::FilePath indexed_db_path = indexed_db_context_->data_path();
-
   context()->GetIDBFactory()->GetDatabaseNames(
       new IndexedDBCallbacks(this, params.ipc_thread_id,
                              params.ipc_callbacks_id),
       params.origin, indexed_db_path, request_context_);
 }
 
 void IndexedDBDispatcherHost::OnIDBFactoryOpen(
     const IndexedDBHostMsg_FactoryOpen_Params& params) {
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
+
+  if (!IsValidOrigin(params.origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::IDBDH_INVALID_ORIGIN);
+    return;
+  }
+
   base::TimeTicks begin_time = base::TimeTicks::Now();
   base::FilePath indexed_db_path = indexed_db_context_->data_path();
 
   int64_t host_transaction_id = HostTransactionId(params.transaction_id);
 
   // TODO(dgrogan): Don't let a non-existing database be opened (and therefore
   // created) if this origin is already over quota.
   scoped_refptr<IndexedDBCallbacks> callbacks = new IndexedDBCallbacks(
       this, params.ipc_thread_id, params.ipc_callbacks_id,
-      params.ipc_database_callbacks_id, host_transaction_id, params.origin);
+      params.ipc_database_callbacks_id, host_transaction_id,
+      GURL(params.origin.Serialize()));
   callbacks->SetConnectionOpenStartTime(begin_time);
   scoped_refptr<IndexedDBDatabaseCallbacks> database_callbacks =
       new IndexedDBDatabaseCallbacks(
           this, params.ipc_thread_id, params.ipc_database_callbacks_id);
   IndexedDBPendingConnection connection(callbacks,
                                         database_callbacks,
                                         ipc_process_id_,
                                         host_transaction_id,
                                         params.version);
   DCHECK(request_context_);
   context()->GetIDBFactory()->Open(params.name, connection, request_context_,
                                    params.origin, indexed_db_path);
 }
 
 void IndexedDBDispatcherHost::OnIDBFactoryDeleteDatabase(
     const IndexedDBHostMsg_FactoryDeleteDatabase_Params& params) {
   DCHECK(indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
+
+  if (!IsValidOrigin(params.origin)) {
+    bad_message::ReceivedBadMessage(this, bad_message::IDBDH_INVALID_ORIGIN);
+    return;
+  }
+
   base::FilePath indexed_db_path = indexed_db_context_->data_path();
   DCHECK(request_context_);
   context()->GetIDBFactory()->DeleteDatabase(
       params.name, request_context_,
       new IndexedDBCallbacks(this, params.ipc_thread_id,
                              params.ipc_callbacks_id),
       params.origin, indexed_db_path);
 }
 
 // OnPutHelper exists only to allow us to hop threads while holding a reference
@@ skipping 653 matching lines @@
     DLOG(ERROR) << "Unable to reset prefetch";
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
     int32_t ipc_object_id) {
   DCHECK(parent_->context()->TaskRunner()->RunsTasksOnCurrentThread());
   parent_->DestroyObject(&map_, ipc_object_id);
 }
 
 }  // namespace content