Support webview tag when the container extension is embedded in a webUI

content/browser/browser_plugin/browser_plugin_guest_manager.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_plugin/browser_plugin_guest_manager.h"
 
 #include "base/command_line.h"
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 #include "content/browser/browser_plugin/browser_plugin_host_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/browser_plugin/browser_plugin_constants.h"
 #include "content/common/browser_plugin/browser_plugin_messages.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/common/url_utils.h"
 #include "net/base/escape.h"
 #include "ui/events/keycodes/keyboard_codes.h"
 
 namespace content {
 
 // static
 BrowserPluginHostFactory* BrowserPluginGuestManager::factory_ = NULL;
 
 BrowserPluginGuestManager::BrowserPluginGuestManager()
     : next_instance_id_(browser_plugin::kInstanceIDNone) {
 }
 
 BrowserPluginGuestManager::~BrowserPluginGuestManager() {
 }
 
 // static
 BrowserPluginGuestManager* BrowserPluginGuestManager::Create() {
   if (factory_)
     return factory_->CreateBrowserPluginGuestManager();
   return new BrowserPluginGuestManager();
 }
 
 BrowserPluginGuest* BrowserPluginGuestManager::CreateGuest(
     SiteInstance* embedder_site_instance,
     int instance_id,
     const BrowserPluginHostMsg_Attach_Params& params,
     scoped_ptr<base::DictionaryValue> extra_params) {
   SiteInstance* guest_site_instance = NULL;
+  RenderProcessHost* embedder_process_host =
+      embedder_site_instance->GetProcess();
   // Validate that the partition id coming from the renderer is valid UTF-8,
   // since we depend on this in other parts of the code, such as FilePath
   // creation. If the validation fails, treat it as a bad message and kill the
   // renderer process.
   if (!IsStringUTF8(params.storage_partition_id)) {
     content::RecordAction(UserMetricsAction("BadMessageTerminate_BPGM"));
     base::KillProcess(
-        embedder_site_instance->GetProcess()->GetHandle(),
+        embedder_process_host->GetHandle(),
         content::RESULT_CODE_KILLED_BAD_MESSAGE, false);
     return NULL;
   }
 
   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kSitePerProcess)) {
     // When --site-per-process is specified, the behavior of BrowserPlugin
     // as <webview> is broken and we use it for rendering out-of-process
     // iframes instead. We use the src URL sent by the renderer to find the
     // right process in which to place this instance.
     // Note: Since BrowserPlugin doesn't support cross-process navigation,
     // the instance will stay in the initially assigned process, regardless
     // of the site it is navigated to.
     // TODO(nasko): Fix this, and such that cross-process navigations are
     // supported.
     guest_site_instance =
         embedder_site_instance->GetRelatedSiteInstance(GURL(params.src));
   } else {
-    const std::string& host = embedder_site_instance->GetSiteURL().host();
+    // Only trust |embedder_frame_url| reported by a WebUI renderer.
+    const GURL& embedder_site_url = embedder_site_instance->GetSiteURL();
+    GURL validated_frame_url(params.embedder_frame_url);
+    RenderViewHost::FilterURL(
+        embedder_process_host, false, &validated_frame_url);
+    const std::string& host = content::HasWebUIScheme(embedder_site_url) ?
+         validated_frame_url.host() : embedder_site_url.host();
 
     std::string url_encoded_partition = net::EscapeQueryParamValue(
         params.storage_partition_id, false);
     // The SiteInstance of a given webview tag is based on the fact that it's
     // a guest process in addition to which platform application the tag
     // belongs to and what storage partition is in use, rather than the URL
     // that the tag is being navigated to.
     GURL guest_site(
         base::StringPrintf("%s://%s/%s?%s", chrome::kGuestScheme,
                             host.c_str(),
@@ skipping 181 matching lines @@
     BrowserPluginGuest* guest = it->second->GetBrowserPluginGuest();
     if (embedder_web_contents == guest->embedder_web_contents()) {
       if (guest->UnlockMouseIfNecessary(event))
         return true;
     }
   }
   return false;
 }
 
 }  // namespace content