OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/browser/child_process_security_policy_impl.h" | 5 #include "content/browser/child_process_security_policy_impl.h" |
6 | 6 |
7 #include <algorithm> | 7 #include <algorithm> |
8 #include <utility> | 8 #include <utility> |
9 | 9 |
10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
(...skipping 111 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
122 // Revokes all permissions granted to a file. | 122 // Revokes all permissions granted to a file. |
123 void RevokeAllPermissionsForFile(const base::FilePath& file) { | 123 void RevokeAllPermissionsForFile(const base::FilePath& file) { |
124 base::FilePath stripped = file.StripTrailingSeparators(); | 124 base::FilePath stripped = file.StripTrailingSeparators(); |
125 file_permissions_.erase(stripped); | 125 file_permissions_.erase(stripped); |
126 request_file_set_.erase(stripped); | 126 request_file_set_.erase(stripped); |
127 } | 127 } |
128 | 128 |
129 // Grant certain permissions to a file. | 129 // Grant certain permissions to a file. |
130 void GrantPermissionsForFileSystem(const std::string& filesystem_id, | 130 void GrantPermissionsForFileSystem(const std::string& filesystem_id, |
131 int permissions) { | 131 int permissions) { |
132 if (!ContainsKey(filesystem_permissions_, filesystem_id)) | 132 if (!base::ContainsKey(filesystem_permissions_, filesystem_id)) |
133 storage::IsolatedContext::GetInstance()->AddReference(filesystem_id); | 133 storage::IsolatedContext::GetInstance()->AddReference(filesystem_id); |
134 filesystem_permissions_[filesystem_id] |= permissions; | 134 filesystem_permissions_[filesystem_id] |= permissions; |
135 } | 135 } |
136 | 136 |
137 bool HasPermissionsForFileSystem(const std::string& filesystem_id, | 137 bool HasPermissionsForFileSystem(const std::string& filesystem_id, |
138 int permissions) { | 138 int permissions) { |
139 FileSystemMap::const_iterator it = | 139 FileSystemMap::const_iterator it = |
140 filesystem_permissions_.find(filesystem_id); | 140 filesystem_permissions_.find(filesystem_id); |
141 if (it == filesystem_permissions_.end()) | 141 if (it == filesystem_permissions_.end()) |
142 return false; | 142 return false; |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
177 | 177 |
178 // Determine whether permission has been granted to commit |url|. | 178 // Determine whether permission has been granted to commit |url|. |
179 bool CanCommitURL(const GURL& url) { | 179 bool CanCommitURL(const GURL& url) { |
180 // Having permission to a scheme implies permission to all of its URLs. | 180 // Having permission to a scheme implies permission to all of its URLs. |
181 SchemeMap::const_iterator scheme_judgment( | 181 SchemeMap::const_iterator scheme_judgment( |
182 scheme_policy_.find(url.scheme())); | 182 scheme_policy_.find(url.scheme())); |
183 if (scheme_judgment != scheme_policy_.end()) | 183 if (scheme_judgment != scheme_policy_.end()) |
184 return scheme_judgment->second; | 184 return scheme_judgment->second; |
185 | 185 |
186 // Otherwise, check for permission for specific origin. | 186 // Otherwise, check for permission for specific origin. |
187 if (ContainsKey(origin_set_, url::Origin(url))) | 187 if (base::ContainsKey(origin_set_, url::Origin(url))) |
188 return true; | 188 return true; |
189 | 189 |
190 // file:// URLs are more granular. The child may have been given | 190 // file:// URLs are more granular. The child may have been given |
191 // permission to a specific file but not the file:// scheme in general. | 191 // permission to a specific file but not the file:// scheme in general. |
192 if (url.SchemeIs(url::kFileScheme)) { | 192 if (url.SchemeIs(url::kFileScheme)) { |
193 base::FilePath path; | 193 base::FilePath path; |
194 if (net::FileURLToFilePath(url, &path)) | 194 if (net::FileURLToFilePath(url, &path)) |
195 return ContainsKey(request_file_set_, path); | 195 return base::ContainsKey(request_file_set_, path); |
196 } | 196 } |
197 | 197 |
198 return false; // Unmentioned schemes are disallowed. | 198 return false; // Unmentioned schemes are disallowed. |
199 } | 199 } |
200 | 200 |
201 // Determine if the certain permissions have been granted to a file. | 201 // Determine if the certain permissions have been granted to a file. |
202 bool HasPermissionsForFile(const base::FilePath& file, int permissions) { | 202 bool HasPermissionsForFile(const base::FilePath& file, int permissions) { |
203 #if defined(OS_ANDROID) | 203 #if defined(OS_ANDROID) |
204 if (file.IsContentUri()) | 204 if (file.IsContentUri()) |
205 return HasPermissionsForContentUri(file, permissions); | 205 return HasPermissionsForContentUri(file, permissions); |
(...skipping 100 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
306 | 306 |
307 // We know about the following pseudo schemes and treat them specially. | 307 // We know about the following pseudo schemes and treat them specially. |
308 RegisterPseudoScheme(url::kAboutScheme); | 308 RegisterPseudoScheme(url::kAboutScheme); |
309 RegisterPseudoScheme(url::kJavaScriptScheme); | 309 RegisterPseudoScheme(url::kJavaScriptScheme); |
310 RegisterPseudoScheme(kViewSourceScheme); | 310 RegisterPseudoScheme(kViewSourceScheme); |
311 } | 311 } |
312 | 312 |
313 ChildProcessSecurityPolicyImpl::~ChildProcessSecurityPolicyImpl() { | 313 ChildProcessSecurityPolicyImpl::~ChildProcessSecurityPolicyImpl() { |
314 web_safe_schemes_.clear(); | 314 web_safe_schemes_.clear(); |
315 pseudo_schemes_.clear(); | 315 pseudo_schemes_.clear(); |
316 STLDeleteContainerPairSecondPointers(security_state_.begin(), | 316 base::STLDeleteContainerPairSecondPointers(security_state_.begin(), |
317 security_state_.end()); | 317 security_state_.end()); |
318 security_state_.clear(); | 318 security_state_.clear(); |
319 } | 319 } |
320 | 320 |
321 // static | 321 // static |
322 ChildProcessSecurityPolicy* ChildProcessSecurityPolicy::GetInstance() { | 322 ChildProcessSecurityPolicy* ChildProcessSecurityPolicy::GetInstance() { |
323 return ChildProcessSecurityPolicyImpl::GetInstance(); | 323 return ChildProcessSecurityPolicyImpl::GetInstance(); |
324 } | 324 } |
325 | 325 |
326 ChildProcessSecurityPolicyImpl* ChildProcessSecurityPolicyImpl::GetInstance() { | 326 ChildProcessSecurityPolicyImpl* ChildProcessSecurityPolicyImpl::GetInstance() { |
327 return base::Singleton<ChildProcessSecurityPolicyImpl>::get(); | 327 return base::Singleton<ChildProcessSecurityPolicyImpl>::get(); |
(...skipping 29 matching lines...) Expand all Loading... |
357 DCHECK_EQ(0U, pseudo_schemes_.count(scheme)) | 357 DCHECK_EQ(0U, pseudo_schemes_.count(scheme)) |
358 << "Web-safe implies not pseudo."; | 358 << "Web-safe implies not pseudo."; |
359 | 359 |
360 web_safe_schemes_.insert(scheme); | 360 web_safe_schemes_.insert(scheme); |
361 } | 361 } |
362 | 362 |
363 bool ChildProcessSecurityPolicyImpl::IsWebSafeScheme( | 363 bool ChildProcessSecurityPolicyImpl::IsWebSafeScheme( |
364 const std::string& scheme) { | 364 const std::string& scheme) { |
365 base::AutoLock lock(lock_); | 365 base::AutoLock lock(lock_); |
366 | 366 |
367 return ContainsKey(web_safe_schemes_, scheme); | 367 return base::ContainsKey(web_safe_schemes_, scheme); |
368 } | 368 } |
369 | 369 |
370 void ChildProcessSecurityPolicyImpl::RegisterPseudoScheme( | 370 void ChildProcessSecurityPolicyImpl::RegisterPseudoScheme( |
371 const std::string& scheme) { | 371 const std::string& scheme) { |
372 base::AutoLock lock(lock_); | 372 base::AutoLock lock(lock_); |
373 DCHECK_EQ(0U, pseudo_schemes_.count(scheme)) << "Add schemes at most once."; | 373 DCHECK_EQ(0U, pseudo_schemes_.count(scheme)) << "Add schemes at most once."; |
374 DCHECK_EQ(0U, web_safe_schemes_.count(scheme)) | 374 DCHECK_EQ(0U, web_safe_schemes_.count(scheme)) |
375 << "Pseudo implies not web-safe."; | 375 << "Pseudo implies not web-safe."; |
376 | 376 |
377 pseudo_schemes_.insert(scheme); | 377 pseudo_schemes_.insert(scheme); |
378 } | 378 } |
379 | 379 |
380 bool ChildProcessSecurityPolicyImpl::IsPseudoScheme( | 380 bool ChildProcessSecurityPolicyImpl::IsPseudoScheme( |
381 const std::string& scheme) { | 381 const std::string& scheme) { |
382 base::AutoLock lock(lock_); | 382 base::AutoLock lock(lock_); |
383 | 383 |
384 return ContainsKey(pseudo_schemes_, scheme); | 384 return base::ContainsKey(pseudo_schemes_, scheme); |
385 } | 385 } |
386 | 386 |
387 void ChildProcessSecurityPolicyImpl::GrantRequestURL( | 387 void ChildProcessSecurityPolicyImpl::GrantRequestURL( |
388 int child_id, const GURL& url) { | 388 int child_id, const GURL& url) { |
389 | 389 |
390 if (!url.is_valid()) | 390 if (!url.is_valid()) |
391 return; // Can't grant the capability to request invalid URLs. | 391 return; // Can't grant the capability to request invalid URLs. |
392 | 392 |
393 if (IsWebSafeScheme(url.scheme())) | 393 if (IsWebSafeScheme(url.scheme())) |
394 return; // The scheme has already been whitelisted for every child process. | 394 return; // The scheme has already been whitelisted for every child process. |
(...skipping 463 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
858 base::AutoLock lock(lock_); | 858 base::AutoLock lock(lock_); |
859 | 859 |
860 SecurityStateMap::iterator state = security_state_.find(child_id); | 860 SecurityStateMap::iterator state = security_state_.find(child_id); |
861 if (state == security_state_.end()) | 861 if (state == security_state_.end()) |
862 return false; | 862 return false; |
863 | 863 |
864 return state->second->can_send_midi_sysex(); | 864 return state->second->can_send_midi_sysex(); |
865 } | 865 } |
866 | 866 |
867 } // namespace content | 867 } // namespace content |
OLD | NEW |