Implementation of the "Redirect URLs to Packaged Apps" feature.

chrome/renderer/chrome_content_renderer_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_content_renderer_client.h"
 
 #include <string>
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/path_service.h"
 #include "base/string_util.h"
 #include "base/strings/string_tokenizer.h"
 #include "base/utf_string_conversions.h"
 #include "base/values.h"
 #include "chrome/common/child_process_logging.h"
 #include "chrome/common/chrome_content_client.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/content_settings_pattern.h"
 #include "chrome/common/extensions/api/extension_action/page_action_handler.h"
+#include "chrome/common/extensions/api/url_handlers/url_handlers_parser.h"
 #include "chrome/common/extensions/background_info.h"
 #include "chrome/common/extensions/csp_handler.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_constants.h"
 #include "chrome/common/extensions/extension_manifest_constants.h"
 #include "chrome/common/extensions/extension_process_policy.h"
 #include "chrome/common/extensions/extension_set.h"
 #include "chrome/common/extensions/incognito_handler.h"
 #include "chrome/common/extensions/manifest_handler.h"
 #include "chrome/common/extensions/manifest_handlers/app_isolation_info.h"
@@ skipping 36 matching lines @@
 #include "chrome/renderer/safe_browsing/phishing_classifier_delegate.h"
 #include "chrome/renderer/searchbox/searchbox.h"
 #include "chrome/renderer/searchbox/searchbox_extension.h"
 #include "chrome/renderer/spellchecker/spellcheck.h"
 #include "chrome/renderer/spellchecker/spellcheck_provider.h"
 #include "components/autofill/renderer/autofill_agent.h"
 #include "components/autofill/renderer/password_autofill_agent.h"
 #include "components/autofill/renderer/password_generation_manager.h"
 #include "components/visitedlink/renderer/visitedlink_slave.h"
 #include "content/public/common/content_constants.h"
+#include "content/public/common/url_handling_messages.h"
 #include "content/public/renderer/render_thread.h"
 #include "content/public/renderer/render_view.h"
 #include "content/public/renderer/render_view_visitor.h"
 #include "extensions/common/constants.h"
 #include "grit/generated_resources.h"
 #include "grit/locale_settings.h"
 #include "grit/renderer_resources.h"
 #include "ipc/ipc_sync_channel.h"
 #include "net/base/net_errors.h"
 #include "third_party/WebKit/Source/Platform/chromium/public/WebURL.h"
 #include "third_party/WebKit/Source/Platform/chromium/public/WebURLError.h"
 #include "third_party/WebKit/Source/Platform/chromium/public/WebURLRequest.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebCache.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDataSource.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDocument.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebElement.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrame.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebNavigationType.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginContainer.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPluginParams.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityPolicy.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/layout.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/webui/jstemplate_builder.h"
 #include "webkit/plugins/npapi/plugin_list.h"
 #include "webkit/plugins/ppapi/plugin_module.h"
@@ skipping 20 matching lines @@
 using webkit::WebPluginMimeType;
 using WebKit::WebPluginParams;
 using WebKit::WebSecurityOrigin;
 using WebKit::WebSecurityPolicy;
 using WebKit::WebString;
 using WebKit::WebURL;
 using WebKit::WebURLError;
 using WebKit::WebURLRequest;
 using WebKit::WebURLResponse;
 using WebKit::WebVector;
+using WebKit::WebNavigationType;
 
 namespace {
 
 const char kWebViewTagName[] = "WEBVIEW";
 const char kAdViewTagName[] = "ADVIEW";
 
 chrome::ChromeContentRendererClient* g_current_client;
 
 // Explicitly register all extension ManifestHandlers needed to parse
 // fields used in the renderer.
 void RegisterExtensionManifestHandlers() {
   (new extensions::AppIsolationHandler)->Register();
   (new extensions::BackgroundManifestHandler)->Register();
   (new extensions::CSPHandler(false))->Register();  // not platform app.
   (new extensions::CSPHandler(true))->Register();  // platform app.
   (new extensions::DevToolsPageHandler)->Register();
   (new extensions::IncognitoHandler)->Register();
   (new extensions::PageActionHandler)->Register();
   (new extensions::SandboxedPageHandler)->Register();
+  (new extensions::UrlHandlersParser)->Register();
   (new extensions::WebAccessibleResourcesHandler)->Register();
 }
 
 static void AppendParams(const std::vector<string16>& additional_names,
                          const std::vector<string16>& additional_values,
                          WebVector<WebString>* existing_names,
                          WebVector<WebString>* existing_values) {
   DCHECK(additional_names.size() == additional_values.size());
   DCHECK(existing_names->size() == existing_values->size());
 
@@ skipping 719 matching lines @@
 bool ChromeContentRendererClient::AllowPopup() {
   extensions::ChromeV8Context* current_context =
       extension_dispatcher_->v8_context_set().GetCurrent();
   return current_context && current_context->extension() &&
       (current_context->context_type() ==
        extensions::Feature::BLESSED_EXTENSION_CONTEXT ||
        current_context->context_type() ==
        extensions::Feature::CONTENT_SCRIPT_CONTEXT);
 }
 
+bool ChromeContentRendererClient::HandleNavigation(
+    WebKit::WebFrame* frame,
+    const WebKit::WebURLRequest& request,
+    WebKit::WebNavigationType type,
+    WebKit::WebNavigationPolicy default_policy,
+    bool is_redirect) {
+  switch (type) {
+    // For user-initiated gestures, try to find a platform app that has
+    // registered a URL handler that matches the URL being navigated to.
+    // If found, delegate further URL processing to the browser (the browser
+    // is supposed to launch the app), and return true to cancel navigation on
+    // on the renderer side. Otherwise, return false to continue navigation.
+    case WebKit::WebNavigationTypeLinkClicked:
+    case WebKit::WebNavigationTypeFormSubmitted:
+    case WebKit::WebNavigationTypeFormResubmitted: {
+      const GURL& url = request.url();
+      const ExtensionSet* exts = extension_dispatcher_->extensions();
+      for (ExtensionSet::const_iterator it = exts->begin();
+           it != exts->end(); ++it) {
+        if (extensions::UrlHandlers::CanExtensionHandleUrl(*it, url)) {
+          const GURL referrer_url(
+              request.httpHeaderField(WebString::fromUTF8("Referer")));
+          return RenderThread::Get()->Send(
+              new RendererHostMsg_ForwardUrlToBrowser(url, referrer_url));

[not at google - send to devlin, 2013/08/29 17:35:56]

I wonder whether there are any issues here with the browser trusting the
renderer.

[sergeygs, 2013/09/02 07:36:21]

In this first version, apps are severely restricted in what URLs they can handle
(only ones from an app-owned domain). So even with a compromised renderer, I
don't really see what sensible harm it could do other than opening a GDocs
document in the GDocs app.
Still, if you concern is valid, what do you think could be done here to detect
and prevent an attack?

+        }
+      }
+      break;
+    }
+
+    default:
+      break;
+  }
+  return false;
+}
+
 bool ChromeContentRendererClient::ShouldFork(WebFrame* frame,
                                              const GURL& url,
                                              const std::string& http_method,
                                              bool is_initial_navigation,
                                              bool* send_referrer) {
   DCHECK(!frame->parent());
 
   // If this is the Instant process, fork all navigations originating from the
   // renderer.  The destination page will then be bucketed back to this Instant
   // process if it is an Instant url, or to another process if not.
@@ skipping 328 matching lines @@
 
   for (size_t i = 0; i < request_os_file_handle_allowed_hosts_.size(); ++i) {
     if (MatchPattern(inner.host(), request_os_file_handle_allowed_hosts_[i]))
       return true;
   }
 
   return false;
 }
 
 }  // namespace chrome