[Android] Block access to java.lang.Object.getClass in injected Java objects

content/browser/renderer_host/java/java_bound_object.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/java/java_bound_object.h"
 
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
 #include "base/memory/singleton.h"
 #include "base/numerics/safe_conversions.h"
@@ skipping 21 matching lines @@
 // Note that in some cases, we differ from from the spec in order to maintain
 // existing behavior. These areas are marked LIVECONNECT_COMPLIANCE. We may
 // revisit this decision in the future.
 
 namespace content {
 namespace {
 
 const char kJavaLangClass[] = "java/lang/Class";
 const char kJavaLangObject[] = "java/lang/Object";
 const char kJavaLangReflectMethod[] = "java/lang/reflect/Method";
+const char kJavaLangSecurityExceptionClass[] = "java/lang/SecurityException";
 const char kGetClass[] = "getClass";
 const char kGetMethods[] = "getMethods";
 const char kIsAnnotationPresent[] = "isAnnotationPresent";
 const char kReturningJavaLangClass[] = "()Ljava/lang/Class;";
 const char kReturningJavaLangReflectMethodArray[] =
     "()[Ljava/lang/reflect/Method;";
 const char kTakesJavaLangClassReturningBoolean[] = "(Ljava/lang/Class;)Z";
+// This is an exception message, so no need to localize.
+const char kAccessToObjectGetClassIsBlocked[] =
+    "Access to java.lang.Object.getClass is blocked";

[palmer, 2014/04/03 21:53:58]

Nit: As you think of more bad classes/methods to block, you'll want to
generalize this.

[mnaganov (inactive), 2014/04/04 10:16:49]

As I have explained in the bug, so far 'getClass' is the only thing we intend to
block.

 
 // Our special NPObject type.  We extend an NPObject with a pointer to a
 // JavaBoundObject.  We also add static methods for each of the NPObject
 // callbacks, which are registered by our NPClass. These methods simply
 // delegate to the private implementation methods of JavaBoundObject.
 struct JavaNPObject : public NPObject {
   JavaBoundObject* bound_object;
 
   static const NPClass kNPClass;
 
@@ skipping 754 matching lines @@
 }
 
 JavaBoundObject::JavaBoundObject(
     const JavaRef<jobject>& object,
     const JavaRef<jclass>& safe_annotation_clazz,
     const base::WeakPtr<JavaBridgeDispatcherHostManager>& manager,
     bool can_enumerate_methods)
     : java_object_(AttachCurrentThread(), object.obj()),
       manager_(manager),
       are_methods_set_up_(false),
+      object_get_class_method_id_(NULL),
       can_enumerate_methods_(can_enumerate_methods),
       safe_annotation_clazz_(safe_annotation_clazz) {
   BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
         base::Bind(&JavaBridgeDispatcherHostManager::JavaBoundObjectCreated,
                    manager_,
                    base::android::ScopedJavaGlobalRef<jobject>(object)));
   // Other than informing the JavaBridgeDispatcherHostManager that a java bound
   // object has been created (above), we don't do anything else with our Java
   // object when first created. We do it all lazily when a method is first
@@ skipping 56 matching lines @@
   }
 
   // Coerce
   std::vector<jvalue> parameters(arg_count);
   for (size_t i = 0; i < arg_count; ++i) {
     parameters[i] = CoerceJavaScriptValueToJavaValue(args[i],
                                                      method->parameter_type(i),
                                                      true);
   }
 
-  ScopedJavaLocalRef<jobject> obj = java_object_.get(AttachCurrentThread());
+  JNIEnv* env = AttachCurrentThread();
+  ScopedJavaLocalRef<jobject> obj = java_object_.get(env);
+
+  // Block access to java.lang.Object.getClass.
+  // As it is declared to be final, it is sufficient to compare methodIDs.
+  if (method->id() == object_get_class_method_id_) {
+    BrowserThread::PostTask(
+        BrowserThread::UI, FROM_HERE,
+        base::Bind(&JavaBoundObject::ThrowSecurityException,
+                   kAccessToObjectGetClassIsBlocked));
+    return false;
+  }
 
   bool ok = false;
   if (!obj.is_null()) {
     // Call
     ok = CallJNIMethod(obj.obj(), method->return_type(),
                        method->id(), &parameters[0], result,
                        safe_annotation_clazz_,
                        manager_,
                        can_enumerate_methods_);
   }
 
   // Now that we're done with the jvalue, release any local references created
   // by CoerceJavaScriptValueToJavaValue().
-  JNIEnv* env = AttachCurrentThread();
   for (size_t i = 0; i < arg_count; ++i) {
     ReleaseJavaValueIfRequired(env, &parameters[i], method->parameter_type(i));
   }
 
   return ok;
 }
 
 void JavaBoundObject::EnsureMethodsAreSetUp() const {
   if (are_methods_set_up_)
     return;
   are_methods_set_up_ = true;
 
   JNIEnv* env = AttachCurrentThread();
+
+  object_get_class_method_id_ = GetMethodIDFromClassName(
+      env,
+      kJavaLangObject,
+      kGetClass,
+      kReturningJavaLangClass);
+
   ScopedJavaLocalRef<jobject> obj = java_object_.get(env);
 
   if (obj.is_null()) {
     return;
   }
 
   ScopedJavaLocalRef<jclass> clazz(env, static_cast<jclass>(
-      env->CallObjectMethod(obj.obj(),  GetMethodIDFromClassName(
-          env,
-          kJavaLangObject,
-          kGetClass,
-          kReturningJavaLangClass))));
+      env->CallObjectMethod(obj.obj(), object_get_class_method_id_)));
 
   ScopedJavaLocalRef<jobjectArray> methods(env, static_cast<jobjectArray>(
       env->CallObjectMethod(clazz.obj(), GetMethodIDFromClassName(
           env,
           kJavaLangClass,
           kGetMethods,
           kReturningJavaLangReflectMethodArray))));
 
   size_t num_methods = env->GetArrayLength(methods.obj());
   // Java objects always have public methods.
@@ skipping 15 matching lines @@
 
       if (!safe)
         continue;
     }
 
     JavaMethod* method = new JavaMethod(java_method);
     methods_.insert(std::make_pair(method->name(), method));
   }
 }
 
+// static
+void JavaBoundObject::ThrowSecurityException(const char* message) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  JNIEnv* env = AttachCurrentThread();
+  base::android::ScopedJavaLocalRef<jclass> clazz(
+      env, env->FindClass(kJavaLangSecurityExceptionClass));
+  env->ThrowNew(clazz.obj(), message);
+}
+
 }  // namespace content