Add ability to clear content licenses

content/browser/storage_partition_impl.cc

Index: content/browser/storage_partition_impl.cc
diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
index 65bf56140be1ff27696d83e7f5f483486b15345b..69b6216e7ce630d5244348c8ee1bcdc0d212f59e 100644
--- a/content/browser/storage_partition_impl.cc
+++ b/content/browser/storage_partition_impl.cc
@@ -36,6 +36,18 @@
 #include "storage/browser/database/database_tracker.h"
 #include "storage/browser/quota/quota_manager.h"
 
+#if defined(ENABLE_PLUGINS)
+#include "base/compiler_specific.h"
+#include "base/files/file_enumerator.h"
+#include "base/stl_util.h"
+#include "ppapi/shared_impl/ppapi_constants.h"
+#include "storage/browser/fileapi/async_file_util.h"
+#include "storage/browser/fileapi/async_file_util_adapter.h"
+#include "storage/browser/fileapi/isolated_context.h"
+#include "storage/browser/fileapi/obfuscated_file_util.h"
+#include "storage/common/fileapi/file_system_util.h"
+#endif  // defined(ENABLE_PLUGINS)
+
 namespace content {
 
 namespace {
@@ -215,6 +227,375 @@ void ClearSessionStorageOnUIThread(
                  callback));
 }
 
+#if defined(ENABLE_PLUGINS)
+
+std::string StringTypeToString(const base::FilePath::StringType& value) {
+#if defined(OS_POSIX)
+  return value;
+#elif defined(OS_WIN)
+  return base::WideToUTF8(value);
+#endif
+}
+
+// Helper for checking the plugin private data for a specified origin and
+// plugin for the existance of any file that matches the time range specified.
+// All of the operations in this class are done on the IO thread.
+class PluginPrivateDataByOriginDeletionHelper {

[xhwang, 2016/06/01 05:44:29]

I am not a fan of having a non-trivial helper class defined in the same file as
the implementation, especially when it needs to be if-defined. This makes this
file large and harder to read. I see that we have
QuotaManagedDataDeletionHelper, but it's an internal class of
StoragePartitionImpl so it's a bit different.

Can we have a separate header file that only declares
ClearPluginPrivateDataOnFileTaskRunner(). Then in the cc file, we'll have
PluginPrivateDataByOriginDeletionHelper declared/defined in the anonymous
namespace, similar to what we are doing here?

[jrummell, 2016/06/02 00:01:08]

Done.

+ public:
+  PluginPrivateDataByOriginDeletionHelper(
+      storage::FileSystemContext* filesystem_context,
+      const GURL& origin,
+      const std::string& plugin_name,
+      const base::Time begin,
+      const base::Time end,
+      const base::Callback<void(bool, const GURL&)>& callback)
+      : filesystem_context_(filesystem_context),
+        origin_(origin),
+        plugin_name_(plugin_name),
+        begin_(begin),
+        end_(end),
+        callback_(callback) {
+    // Create the filesystem ID.
+    fsid_ = storage::IsolatedContext::GetInstance()
+                ->RegisterFileSystemForVirtualPath(
+                    storage::kFileSystemTypePluginPrivate,
+                    ppapi::kPluginPrivateRootName, base::FilePath());
+  }
+  ~PluginPrivateDataByOriginDeletionHelper() {}
+
+  // Checks the files contained in the plugin private filesystem for |origin_|
+  // and |plugin_name_| for any file whose last modified time is greater or
+  // equal to |begin_|. |callback_| is called when all actions are complete
+  // with true if any such file is found, false otherwise.

[xhwang, 2016/06/01 05:44:29]

nit: Then what is the GURL in the callback?

[jrummell, 2016/06/02 00:01:08]

Done.

+  void StartOnIOThread();

[xhwang, 2016/06/01 05:44:29]

nit: Should this be CheckFilesOnIOThread() to be consistent with
CheckOriginsOnFileTaskRunner() below?

[jrummell, 2016/06/02 00:01:08]

Done.

+
+ private:
+  void OnFileSystemOpened(base::File::Error result);
+  void OnDirectoryRead(const std::string& root,
+                       base::File::Error result,
+                       const storage::AsyncFileUtil::EntryList& file_list,
+                       bool has_more);
+  void OnFileInfo(const std::string& file_name,
+                  base::File::Error result,
+                  const base::File::Info& file_info);
+
+  // Keeps track of the pending work. When |task_count_| goes to 0 then
+  // |callback_| is called and this helper object is destroyed.
+  void IncrementTaskCount();
+  void DecrementTaskCount();

[xhwang, 2016/06/01 05:44:29]

The whole {In|De}crementTaskCount business is a bit dangerous. If we forget a
call somewhere then the object could be leaked. I think we can achieve the same
by just bind a unique_ptr of this object in the |callback_|, so that when the
callback is reset after fired or dropped, the object will be destructed
automatically.

Since you are just being consistent with existing code so you don't have to make
this change. Just some suggestions for the owners of this file.

[jrummell, 2016/06/02 00:01:08]

Acknowledged. However, this may be tricky as the object will fire a lot of async
requests (e.g. GetFileInfo() for every file), and callback should only be called
when they are all satisfied (or use WeakPtrs, etc.).

+
+  // Not owned by this object. Caller is responsible for keeping the
+  // FileSystemContext alive until |callback_| is called.
+  storage::FileSystemContext* filesystem_context_;
+
+  const GURL origin_;
+  const std::string plugin_name_;
+  const base::Time begin_;
+  const base::Time end_;
+  const base::Callback<void(bool, const GURL&)> callback_;
+  std::string fsid_;
+  int task_count_ = 0;
+  bool delete_this_origin_data_ = false;

[xhwang, 2016/06/01 05:44:29]

What does |delete_this_origin_data_| exactly mean? Could you please add a
comment?

[jrummell, 2016/06/02 00:01:08]

Done.

+};
+
+void PluginPrivateDataByOriginDeletionHelper::StartOnIOThread() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK(storage::ValidateIsolatedFileSystemId(fsid_));
+
+  IncrementTaskCount();
+  filesystem_context_->OpenPluginPrivateFileSystem(
+      origin_, storage::kFileSystemTypePluginPrivate, fsid_, plugin_name_,
+      storage::OPEN_FILE_SYSTEM_FAIL_IF_NONEXISTENT,
+      base::Bind(&PluginPrivateDataByOriginDeletionHelper::OnFileSystemOpened,
+                 base::Unretained(this)));

[xhwang, 2016/06/01 05:44:29]

Comment why base::Unretained is safe, e.g. this class owns itself. Maybe we
should have a class level comment about the ownership.

[jrummell, 2016/06/02 00:01:08]

Done.

+}
+
+void PluginPrivateDataByOriginDeletionHelper::OnFileSystemOpened(
+    base::File::Error result) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DVLOG(3) << "Opened filesystem for " << origin_ << ":" << plugin_name_
+           << ", result: " << result;
+
+  // If we can't open the directory, we can't delete files so simply return.
+  if (result != base::File::FILE_OK) {
+    DecrementTaskCount();
+    return;
+  }
+
+  storage::AsyncFileUtil* file_util = filesystem_context_->GetAsyncFileUtil(
+      storage::kFileSystemTypePluginPrivate);
+  std::string root = storage::GetIsolatedFileSystemRootURIString(
+      origin_, fsid_, ppapi::kPluginPrivateRootName);
+  std::unique_ptr<storage::FileSystemOperationContext> operation_context =
+      base::WrapUnique(
+          new storage::FileSystemOperationContext(filesystem_context_));
+  file_util->ReadDirectory(
+      std::move(operation_context), filesystem_context_->CrackURL(GURL(root)),
+      base::Bind(&PluginPrivateDataByOriginDeletionHelper::OnDirectoryRead,
+                 base::Unretained(this), root));
+}
+
+void PluginPrivateDataByOriginDeletionHelper::OnDirectoryRead(
+    const std::string& root,
+    base::File::Error result,
+    const storage::AsyncFileUtil::EntryList& file_list,
+    bool has_more) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DVLOG(3) << __FUNCTION__ << " result: " << result
+           << ", #files: " << file_list.size();
+
+  // Quit if there is an error.
+  if (result != base::File::FILE_OK) {
+    DLOG(ERROR) << "Unable to read directory for " << origin_ << ":"
+                << plugin_name_;
+    DecrementTaskCount();
+    return;
+  }
+
+  // No error, process the files returned. No need to do this if we have
+  // already decided to delete all the data for this origin.
+  if (!delete_this_origin_data_) {
+    storage::AsyncFileUtil* file_util = filesystem_context_->GetAsyncFileUtil(
+        storage::kFileSystemTypePluginPrivate);
+    for (const auto& file : file_list) {
+      DVLOG(3) << __FUNCTION__ << " file: " << file.name;
+      DCHECK(!file.is_directory);  // Nested directories not implemented.
+
+      std::unique_ptr<storage::FileSystemOperationContext> operation_context =
+          base::WrapUnique(
+              new storage::FileSystemOperationContext(filesystem_context_));
+      storage::FileSystemURL file_url = filesystem_context_->CrackURL(
+          GURL(root + StringTypeToString(file.name)));
+      IncrementTaskCount();
+      file_util->GetFileInfo(
+          std::move(operation_context), file_url,
+          storage::FileSystemOperation::GET_METADATA_FIELD_SIZE |
+              storage::FileSystemOperation::GET_METADATA_FIELD_LAST_MODIFIED,
+          base::Bind(&PluginPrivateDataByOriginDeletionHelper::OnFileInfo,
+                     base::Unretained(this), StringTypeToString(file.name)));
+    }
+  }
+
+  // If there are more files in this directory, wait for the next call.
+  if (has_more)
+    return;
+
+  DecrementTaskCount();
+}
+
+void PluginPrivateDataByOriginDeletionHelper::OnFileInfo(
+    const std::string& file_name,
+    base::File::Error result,
+    const base::File::Info& file_info) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+
+  if (result == base::File::FILE_OK) {
+    DVLOG(3) << __FUNCTION__ << " name: " << file_name
+             << ", size: " << file_info.size
+             << ", modified: " << file_info.last_modified;
+    if (file_info.last_modified >= begin_ && file_info.last_modified <= end_)
+      delete_this_origin_data_ = true;
+  }
+
+  DecrementTaskCount();
+}
+
+void PluginPrivateDataByOriginDeletionHelper::IncrementTaskCount() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  ++task_count_;
+}
+
+void PluginPrivateDataByOriginDeletionHelper::DecrementTaskCount() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_GT(task_count_, 0);
+  --task_count_;
+  if (task_count_)
+    return;
+
+  // If there are no more tasks in progress, then run |callback_| on the
+  // proper thread.
+  filesystem_context_->default_file_task_runner()->PostTask(
+      FROM_HERE, base::Bind(callback_, delete_this_origin_data_, origin_));
+  delete this;
+}
+
+// Helper for deleting the plugin private data.
+// All of the operations in this class are done on the file task runner.
+class PluginPrivateDataDeletionHelper {
+ public:
+  PluginPrivateDataDeletionHelper(
+      scoped_refptr<storage::FileSystemContext> filesystem_context,
+      const base::Time begin,
+      const base::Time end,
+      const base::Closure& callback)
+      : filesystem_context_(std::move(filesystem_context)),
+        begin_(begin),
+        end_(end),
+        callback_(callback) {}
+  ~PluginPrivateDataDeletionHelper() {}
+
+  void CheckOriginsOnFileTaskRunner(const std::set<GURL>& origins);
+
+ private:
+  // Keeps track of the pending work. When |task_count_| goes to 0 then
+  // |callback_| is called and this helper object is destroyed.
+  void IncrementTaskCount();
+  void DecrementTaskCount(bool delete_data_for_origin, const GURL& origin);
+
+  // Keep a reference to FileSystemContext until we are done with it.
+  scoped_refptr<storage::FileSystemContext> filesystem_context_;
+
+  const base::Time begin_;
+  const base::Time end_;
+  const base::Closure callback_;
+  int task_count_ = 0;
+};
+
+void PluginPrivateDataDeletionHelper::CheckOriginsOnFileTaskRunner(
+    const std::set<GURL>& origins) {
+  DCHECK(filesystem_context_->default_file_task_runner()
+             ->RunsTasksOnCurrentThread());
+  IncrementTaskCount();
+
+  base::Callback<void(bool, const GURL&)> decrement_callback =
+      base::Bind(&PluginPrivateDataDeletionHelper::DecrementTaskCount,
+                 base::Unretained(this));
+  storage::AsyncFileUtil* async_file_util =
+      filesystem_context_->GetAsyncFileUtil(
+          storage::kFileSystemTypePluginPrivate);
+  storage::ObfuscatedFileUtil* obfuscated_file_util =
+      static_cast<storage::ObfuscatedFileUtil*>(
+          static_cast<storage::AsyncFileUtilAdapter*>(async_file_util)
+              ->sync_file_util());
+  for (const auto& origin : origins) {
+    // Determine the available plugin private filesystem directories
+    // for this origin.
+    base::File::Error error;
+    base::FilePath path = obfuscated_file_util->GetDirectoryForOriginAndType(
+        origin, "", false, &error);
+    if (error != base::File::FILE_OK) {
+      DLOG(ERROR) << "Unable to read directory for " << origin;
+      continue;
+    }
+
+    // Currently the plugin private filesystem is only used by Encrypted
+    // Media Content Decryption Modules, which are treated as pepper plugins.
+    // Each CDM gets a directory based on the mimetype (e.g. plugin
+    // application/x-ppapi-widevine-cdm uses directory
+    // application_x-ppapi-widevine-cdm). Enumerate through the set of
+    // directories so that data from any CDM used by this origin is deleted.
+    base::FileEnumerator file_enumerator(path, false,
+                                         base::FileEnumerator::DIRECTORIES);
+    for (base::FilePath plugin_path = file_enumerator.Next();
+         !plugin_path.empty(); plugin_path = file_enumerator.Next()) {
+      IncrementTaskCount();
+      PluginPrivateDataByOriginDeletionHelper* helper =
+          new PluginPrivateDataByOriginDeletionHelper(
+              filesystem_context_.get(), origin.GetOrigin(),
+              plugin_path.BaseName().MaybeAsASCII(), begin_, end_,
+              decrement_callback);
+      BrowserThread::PostTask(
+          BrowserThread::IO, FROM_HERE,
+          base::Bind(&PluginPrivateDataByOriginDeletionHelper::StartOnIOThread,
+                     base::Unretained(helper)));
+
+      // |helper| will delete itself when it is done.
+    }
+  }
+
+  // Cancels out the call to IncrementTaskCount() at the start of this method.
+  // If there are no origins specified then this will cause this helper to
+  // be destroyed.
+  DecrementTaskCount(false, GURL());
+}
+
+void PluginPrivateDataDeletionHelper::IncrementTaskCount() {
+  DCHECK(filesystem_context_->default_file_task_runner()
+             ->RunsTasksOnCurrentThread());
+  ++task_count_;
+}
+
+void PluginPrivateDataDeletionHelper::DecrementTaskCount(
+    bool delete_data_for_origin,
+    const GURL& origin) {
+  DCHECK(filesystem_context_->default_file_task_runner()
+             ->RunsTasksOnCurrentThread());
+
+  // Since the PluginPrivateDataByOriginDeletionHelper runs on the IO thread,
+  // delete all the data for |origin| if needed.
+  if (delete_data_for_origin) {
+    DCHECK(!origin.is_empty());
+    DVLOG(3) << "Deleting plugin data for " << origin;
+    storage::FileSystemBackend* backend =
+        filesystem_context_->GetFileSystemBackend(
+            storage::kFileSystemTypePluginPrivate);
+    storage::FileSystemQuotaUtil* quota_util = backend->GetQuotaUtil();
+    base::File::Error result = quota_util->DeleteOriginDataOnFileTaskRunner(
+        filesystem_context_.get(), nullptr, origin,
+        storage::kFileSystemTypePluginPrivate);
+    ALLOW_UNUSED_LOCAL(result);
+    DLOG_IF(ERROR, result != base::File::FILE_OK)
+        << "Unable to delete the plugin data for " << origin;
+  }
+
+  DCHECK_GT(task_count_, 0);
+  --task_count_;
+  if (task_count_)
+    return;
+
+  // If there are no more tasks in progress, run |callback_| and then
+  // this helper can be deleted.
+  callback_.Run();
+  delete this;
+}
+
+void ClearPluginPrivateDataOnFileTaskRunner(
+    scoped_refptr<storage::FileSystemContext> filesystem_context,
+    const GURL& storage_origin,
+    const base::Time begin,
+    const base::Time end,
+    const base::Closure& callback) {
+  DCHECK(filesystem_context->default_file_task_runner()
+             ->RunsTasksOnCurrentThread());
+  DVLOG(3) << "Clearing plugin data for origin: " << storage_origin;
+
+  storage::FileSystemBackend* backend =
+      filesystem_context->GetFileSystemBackend(
+          storage::kFileSystemTypePluginPrivate);
+  storage::FileSystemQuotaUtil* quota_util = backend->GetQuotaUtil();
+
+  // Determine the set of origins used.
+  std::set<GURL> origins;
+  quota_util->GetOriginsForTypeOnFileTaskRunner(
+      storage::kFileSystemTypePluginPrivate, &origins);
+
+  if (origins.empty()) {
+    // No origins, so nothing to do.
+    callback.Run();
+    return;
+  }
+
+  // If a specific origin is provided, then check that it is in the list
+  // returned and remove all the other origins.
+  if (!storage_origin.is_empty()) {
+    if (!ContainsKey(origins, storage_origin)) {
+      // Nothing matches, so nothing to do.
+      callback.Run();
+      return;
+    }
+
+    // List should only contain the one value that matches.
+    origins.clear();
+    origins.insert(storage_origin);
+  }
+
+  PluginPrivateDataDeletionHelper* helper = new PluginPrivateDataDeletionHelper(
+      std::move(filesystem_context), begin, end, callback);
+  helper->CheckOriginsOnFileTaskRunner(origins);
+  // |helper| will delete itself when all origins have been checked.
+}
+#endif  // defined(ENABLE_PLUGINS)
+
 }  // namespace
 
 // Static.
@@ -316,6 +697,7 @@ struct StoragePartitionImpl::DataDeletionHelper {
       storage::QuotaManager* quota_manager,
       storage::SpecialStoragePolicy* special_storage_policy,
       WebRTCIdentityStore* webrtc_identity_store,
+      storage::FileSystemContext* filesystem_context,
       const base::Time begin,
       const base::Time end);
 
@@ -635,7 +1017,8 @@ void StoragePartitionImpl::ClearDataImpl(
   helper->ClearDataOnUIThread(
       storage_origin, origin_matcher, cookie_matcher, GetPath(), rq_context,
       dom_storage_context_.get(), quota_manager_.get(),
-      special_storage_policy_.get(), webrtc_identity_store_.get(), begin, end);
+      special_storage_policy_.get(), webrtc_identity_store_.get(),
+      filesystem_context_.get(), begin, end);
 }
 
 void StoragePartitionImpl::
@@ -775,6 +1158,7 @@ void StoragePartitionImpl::DataDeletionHelper::ClearDataOnUIThread(
     storage::QuotaManager* quota_manager,
     storage::SpecialStoragePolicy* special_storage_policy,
     WebRTCIdentityStore* webrtc_identity_store,
+    storage::FileSystemContext* filesystem_context,
     const base::Time begin,
     const base::Time end) {
   DCHECK_NE(remove_mask, 0u);
@@ -855,6 +1239,16 @@ void StoragePartitionImpl::DataDeletionHelper::ClearDataOnUIThread(
                    decrement_callback));
   }
 
+#if defined(ENABLE_PLUGINS)
+  if (remove_mask & REMOVE_DATA_MASK_PLUGIN_PRIVATE_DATA) {
+    IncrementTaskCountOnUI();
+    filesystem_context->default_file_task_runner()->PostTask(
+        FROM_HERE, base::Bind(&ClearPluginPrivateDataOnFileTaskRunner,
+                              make_scoped_refptr(filesystem_context),
+                              storage_origin, begin, end, decrement_callback));

[xhwang, 2016/06/01 05:44:29]

Please see my previous comment. Since we could be writing the temporary file in
multiple stages, what will happen if we wrote the first part, then the files are
deleted, and then we try to write the second part? That should end up with a
failure. We shouldn't get corrupted files in any cases. If possible, it'd be
nice to add tests to cover this case as well.

Also, is it possible that we could read a partial file?

[jrummell, 2016/06/02 00:01:08]

Depends on the OS. On Linux the file storage remains available even after the
directory is deleted. On Windows DeleteOriginDataOnFileTaskRunner() returns an
error but appears to delete the directory anyway (and the file remains
accessible). Not sure about other OSes, trybots will tell. Attempting to open a
file after the directory is deleted produces an error. Added a test for this.

+  }
+#endif  // defined(ENABLE_PLUGINS)
+
   DecrementTaskCountOnUI();
 }