Avoid using ContentBrowserClient::IsIllegalOrigin in ResourceDispatcherHost.

extensions/browser/guest_view/web_view/web_view_guest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/guest_view/web_view/web_view_guest.h"
 
 #include <stddef.h>
 
 #include <utility>
 
@@ skipping 13 matching lines @@
 #include "content/public/browser/native_web_keyboard_event.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_view.h"
+#include "content/public/browser/resource_dispatcher_host.h"
 #include "content/public/browser/resource_request_details.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/common/media_stream_request.h"
 #include "content/public/common/page_zoom.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/stop_find_action.h"
 #include "content/public/common/url_constants.h"
 #include "extensions/browser/api/declarative/rules_registry_service.h"
 #include "extensions/browser/api/extensions_api_client.h"
 #include "extensions/browser/api/guest_view/web_view/web_view_internal_api.h"
 #include "extensions/browser/api/web_request/web_request_api.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/browser/extensions_browser_client.h"
 #include "extensions/browser/guest_view/web_view/web_view_constants.h"
 #include "extensions/browser/guest_view/web_view/web_view_content_script_manager.h"
 #include "extensions/browser/guest_view/web_view/web_view_permission_helper.h"
 #include "extensions/browser/guest_view/web_view/web_view_permission_types.h"
-#include "extensions/browser/guest_view/web_view/web_view_renderer_state.h"
 #include "extensions/common/constants.h"
+#include "extensions/common/extension.h"
 #include "extensions/common/extension_messages.h"
 #include "extensions/common/manifest_constants.h"
 #include "extensions/strings/grit/extensions_strings.h"
 #include "ipc/ipc_message_macros.h"
 #include "net/base/escape.h"
 #include "net/base/net_errors.h"
 #include "ui/base/models/simple_menu_model.h"
 #include "ui/events/keycodes/keyboard_codes.h"
 #include "url/url_constants.h"
 
@@ skipping 858 matching lines @@
   web_view_info.rules_registry_id = rules_registry_id_;
 
   // Get content scripts IDs added by the guest.
   WebViewContentScriptManager* manager =
       WebViewContentScriptManager::Get(browser_context());
   DCHECK(manager);
   web_view_info.content_script_ids = manager->GetContentScriptIDSet(
       web_view_info.embedder_process_id, web_view_info.instance_id);
 
   content::BrowserThread::PostTask(
-      content::BrowserThread::IO,
-      FROM_HERE,
-      base::Bind(&WebViewRendererState::AddGuest,
+      content::BrowserThread::IO, FROM_HERE,
+      base::Bind(&WebViewGuest::AddGuestHelper,
                  base::Unretained(WebViewRendererState::GetInstance()),
                  web_contents()->GetRenderProcessHost()->GetID(),
-                 web_contents()->GetRoutingID(),
-                 web_view_info));
+                 web_contents()->GetRoutingID(), web_view_info,
+                 browser_context()->GetResourceContext()));
 }
 
 // static
 void WebViewGuest::RemoveWebViewStateFromIOThread(
     WebContents* web_contents) {
   content::BrowserThread::PostTask(
       content::BrowserThread::IO, FROM_HERE,
-      base::Bind(
-          &WebViewRendererState::RemoveGuest,
-          base::Unretained(WebViewRendererState::GetInstance()),
-          web_contents->GetRenderProcessHost()->GetID(),
-          web_contents->GetRoutingID()));
+      base::Bind(&WebViewGuest::RemoveGuestHelper,
+                 base::Unretained(WebViewRendererState::GetInstance()),
+                 web_contents->GetRenderProcessHost()->GetID(),
+                 web_contents->GetRoutingID(),
+                 web_contents->GetBrowserContext()->GetResourceContext()));
 }
 
 void WebViewGuest::RequestMediaAccessPermission(
     WebContents* source,
     const content::MediaStreamRequest& request,
     const content::MediaResponseCallback& callback) {
   web_view_permission_helper_->RequestMediaAccessPermission(source,
                                                             request,
                                                             callback);
 }
@@ skipping 532 matching lines @@
     // on the embedder.
     std::unique_ptr<base::DictionaryValue> args(new base::DictionaryValue());
     DispatchEventToView(base::WrapUnique(
         new GuestViewEvent(webview::kEventExitFullscreen, std::move(args))));
   }
   // Since we changed fullscreen state, sending a Resize message ensures that
   // renderer/ sees the change.
   web_contents()->GetRenderViewHost()->GetWidget()->WasResized();
 }
 
+// static
+void WebViewGuest::AddGuestHelper(
+    WebViewRendererState* renderer_state,
+    int guest_process_id,
+    int guest_routing_id,
+    const WebViewRendererState::WebViewInfo& web_view_info,
+    const content::ResourceContext* context) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
+
+  // Guest processes can access resources from the host (extensions). The
+  // ResourceDispatcherHost object performs access checks for certain origins
+  // like extensions when they are requested. We should inform the
+  // ResourceDispatcherHost instance about guests so it can enforce accesses
+  // correctly. This should be done only for new guest processes.
+  bool new_guest = !renderer_state->IsGuest(guest_process_id);
+  renderer_state->AddGuest(guest_process_id, guest_routing_id, web_view_info);
+  if (new_guest) {
+    DCHECK(content::ResourceDispatcherHost::Get());
+    content::ResourceDispatcherHost::Get()->AddGuestForOrigin(
+        context,
+        Extension::GetBaseURLFromExtensionId(web_view_info.owner_host).spec(),
+        guest_process_id);

[jam, 2016/08/01 20:06:01]

nit: it would be shorter to read this code if there were two PostTask calls
above instead of these two extra methods

[ananta, 2016/08/02 00:40:50]

Leaving this as is. I wanted to avoid two PostTasks to the IO thread.

+  }
+}
+
+// static
+void WebViewGuest::RemoveGuestHelper(WebViewRendererState* renderer_state,
+                                     int guest_process_id,
+                                     int guest_routing_id,
+                                     const content::ResourceContext* context) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
+
+  std::string owner_id;
+  renderer_state->GetOwnerInfo(guest_process_id, nullptr, &owner_id);
+
+  renderer_state->RemoveGuest(guest_process_id, guest_routing_id);
+  // If this is no longer a guest process, then inform the
+  // ResourceDispatcherHost accordingly so it can enforce accesses correctly.
+  if (!renderer_state->IsGuest(guest_process_id)) {
+    DCHECK(content::ResourceDispatcherHost::Get());
+    content::ResourceDispatcherHost::Get()->RemoveGuestForOrigin(
+        context,
+        Extension::GetBaseURLFromExtensionId(owner_id).spec(),
+        guest_process_id);
+  }
+}
+
 }  // namespace extensions