PepperFileRefHost: Port to use explicit permission grants in ChildProcessSecurityPolicy.

content/browser/renderer_host/pepper/pepper_internal_file_ref_backend.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/pepper/pepper_internal_file_ref_backend.h"
 
 #include <string>
 
 #include "base/callback.h"
 #include "base/file_util.h"
 #include "base/files/file_util_proxy.h"
+#include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/fileapi/browser_file_system_helper.h"
 #include "content/browser/renderer_host/pepper/pepper_file_system_browser_host.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/storage_partition.h"
 #include "net/base/escape.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/pp_file_info.h"
 #include "ppapi/c/pp_instance.h"
@@ skipping 227 matching lines @@
       PpapiPluginMsg_FileRef_ReadDirectoryEntriesReply(infos, file_types));
 }
 
 int32_t PepperInternalFileRefBackend::GetAbsolutePath(
     ppapi::host::ReplyMessageContext reply_context) {
   host_->SendReply(reply_context,
       PpapiPluginMsg_FileRef_GetAbsolutePathReply(path_));
   return PP_OK_COMPLETIONPENDING;
 }
 
-int32_t PepperInternalFileRefBackend::HasPermissions(int permissions) const {
-  base::PlatformFileError error;
-  CheckFileSystemPermissionsForProcess(GetFileSystemContext().get(),
-                                       render_process_id_,
-                                       GetFileSystemURL(),
-                                       permissions,
-                                       &error);
-  return ppapi::PlatformFileErrorToPepperError(error);
+int32_t PepperInternalFileRefBackend::CanRead() const {
+  fileapi::FileSystemURL url = GetFileSystemURL();
+  if (!FileSystemURLIsValid(GetFileSystemContext().get(), url))
+    return PP_ERROR_FAILED;

[dmichael (off chromium), 2013/07/24 17:27:44]

teravest: Do you know what we would do in the case of a bad FileSystemURL today?
I just want to make sure we're doing the same thing. I'm guessing this doesn't
really happen in practice anyway.

[teravest, 2013/07/24 17:51:21]

I'll look into this; the old code would just pass the bad URL along to the
fileapi layer (as far as I can tell), but I don't see how any operations would
succeed when we don't have a sane url.

[tommycli, 2013/07/24 18:05:30]

CheckFileSystemPermissionsForProcess would return a
base::PLATFORM_FILE_ERROR_INVALID_URL, which
ppapi::PlatformFileErrorToPepperError would convert to PP_ERROR_FAILED. So I
think I duplicated the original behavior for invalid URLs.

[tommycli, 2013/07/24 20:53:09]

Yeah it's kind of weird. Probably because You have a PepperFileRefHost that
calls into a backend that implements CanRead* etc. via virtual functions - and
Only PepperInternalFileRefBackend does the URL validation.

Agreed though - not 100% happy with design... more like 70% happy.

+  if (!ChildProcessSecurityPolicyImpl::GetInstance()->
+          CanReadFileSystemFile(render_process_id_, url)) {
+    return PP_ERROR_NOACCESS;
+  }
+  return PP_OK;
+}
+
+int32_t PepperInternalFileRefBackend::CanWrite() const {
+  fileapi::FileSystemURL url = GetFileSystemURL();
+  if (!FileSystemURLIsValid(GetFileSystemContext().get(), url))
+    return PP_ERROR_FAILED;
+  if (!ChildProcessSecurityPolicyImpl::GetInstance()->
+          CanWriteFileSystemFile(render_process_id_, url)) {
+    return PP_ERROR_NOACCESS;
+  }
+  return PP_OK;
+}
+
+int32_t PepperInternalFileRefBackend::CanCreate() const {
+  fileapi::FileSystemURL url = GetFileSystemURL();
+  if (!FileSystemURLIsValid(GetFileSystemContext().get(), url))
+    return PP_ERROR_FAILED;
+  if (!ChildProcessSecurityPolicyImpl::GetInstance()->
+          CanCreateFileSystemFile(render_process_id_, url)) {
+    return PP_ERROR_NOACCESS;
+  }
+  return PP_OK;
+}
+
+int32_t PepperInternalFileRefBackend::CanReadWrite() const {
+  fileapi::FileSystemURL url = GetFileSystemURL();
+  if (!FileSystemURLIsValid(GetFileSystemContext().get(), url))
+    return PP_ERROR_FAILED;
+  ChildProcessSecurityPolicyImpl* policy =
+      ChildProcessSecurityPolicyImpl::GetInstance();
+  if (!policy->CanReadFileSystemFile(render_process_id_, url) ||
+      !policy->CanWriteFileSystemFile(render_process_id_, url)) {
+    return PP_ERROR_NOACCESS;
+  }
+  return PP_OK;
 }
 
 }  // namespace content