| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/renderer/content_settings_observer.h" | 5 #include "chrome/renderer/content_settings_observer.h" |
| 6 | 6 |
| 7 #include "chrome/common/render_messages.h" | 7 #include "chrome/common/render_messages.h" |
| 8 #include "chrome/common/ssl_insecure_content.h" | 8 #include "chrome/common/ssl_insecure_content.h" |
| 9 #include "content/public/common/url_constants.h" | 9 #include "content/public/common/url_constants.h" |
| 10 #include "content/public/renderer/document_state.h" | 10 #include "content/public/renderer/document_state.h" |
| 11 #include "content/public/renderer/render_frame.h" | 11 #include "content/public/renderer/render_frame.h" |
| 12 #include "content/public/renderer/render_view.h" | 12 #include "content/public/renderer/render_view.h" |
| 13 #include "third_party/WebKit/public/platform/URLConversion.h" | 13 #include "third_party/WebKit/public/platform/URLConversion.h" |
| 14 #include "third_party/WebKit/public/platform/WebContentSettingCallbacks.h" | 14 #include "third_party/WebKit/public/platform/WebContentSettingCallbacks.h" |
| 15 #include "third_party/WebKit/public/platform/WebSecurityOrigin.h" | 15 #include "third_party/WebKit/public/platform/WebSecurityOrigin.h" |
| 16 #include "third_party/WebKit/public/platform/WebURL.h" | 16 #include "third_party/WebKit/public/platform/WebURL.h" |
| 17 #include "third_party/WebKit/public/web/WebDataSource.h" | 17 #include "third_party/WebKit/public/web/WebDataSource.h" |
| 18 #include "third_party/WebKit/public/web/WebDocument.h" | 18 #include "third_party/WebKit/public/web/WebDocument.h" |
| 19 #include "third_party/WebKit/public/web/WebFrameClient.h" | 19 #include "third_party/WebKit/public/web/WebFrameClient.h" |
| 20 #include "third_party/WebKit/public/web/WebLocalFrame.h" | 20 #include "third_party/WebKit/public/web/WebLocalFrame.h" |
| 21 #include "third_party/WebKit/public/web/WebView.h" | 21 #include "third_party/WebKit/public/web/WebView.h" |
| 22 #include "url/origin.h" |
| 22 #include "url/url_constants.h" | 23 #include "url/url_constants.h" |
| 23 | 24 |
| 24 #if defined(ENABLE_EXTENSIONS) | 25 #if defined(ENABLE_EXTENSIONS) |
| 25 #include "extensions/common/constants.h" | 26 #include "extensions/common/constants.h" |
| 26 #include "extensions/common/extension.h" | 27 #include "extensions/common/extension.h" |
| 27 #include "extensions/common/permissions/api_permission.h" | 28 #include "extensions/common/permissions/api_permission.h" |
| 28 #include "extensions/common/permissions/permissions_data.h" | 29 #include "extensions/common/permissions/permissions_data.h" |
| 29 #include "extensions/renderer/dispatcher.h" | 30 #include "extensions/renderer/dispatcher.h" |
| 30 #include "extensions/renderer/renderer_extension_registry.h" | 31 #include "extensions/renderer/renderer_extension_registry.h" |
| 31 #endif | 32 #endif |
| 32 | 33 |
| 33 using blink::WebContentSettingCallbacks; | 34 using blink::WebContentSettingCallbacks; |
| 34 using blink::WebDataSource; | 35 using blink::WebDataSource; |
| 35 using blink::WebDocument; | 36 using blink::WebDocument; |
| 36 using blink::WebFrame; | 37 using blink::WebFrame; |
| 37 using blink::WebSecurityOrigin; | 38 using blink::WebSecurityOrigin; |
| 38 using blink::WebString; | 39 using blink::WebString; |
| 39 using blink::WebURL; | 40 using blink::WebURL; |
| 40 using blink::WebView; | 41 using blink::WebView; |
| 41 using content::DocumentState; | 42 using content::DocumentState; |
| 42 using content::NavigationState; | 43 using content::NavigationState; |
| 43 | 44 |
| 44 namespace { | 45 namespace { |
| 45 | 46 |
| 46 GURL GetOriginOrURL(const WebFrame* frame) { | 47 GURL GetOriginOrURL(const WebFrame* frame) { |
| 47 WebString top_origin = frame->top()->getSecurityOrigin().toString(); | 48 url::Origin top_origin = url::Origin(frame->top()->getSecurityOrigin()); |
| 48 // The |top_origin| is unique ("null") e.g., for file:// URLs. Use the | 49 // The |top_origin| is unique ("null") e.g., for file:// URLs. Use the |
| 49 // document URL as the primary URL in those cases. | 50 // document URL as the primary URL in those cases. |
| 50 // TODO(alexmos): This is broken for --site-per-process, since top() can be a | 51 // TODO(alexmos): This is broken for --site-per-process, since top() can be a |
| 51 // WebRemoteFrame which does not have a document(), and the WebRemoteFrame's | 52 // WebRemoteFrame which does not have a document(), and the WebRemoteFrame's |
| 52 // URL is not replicated. See https://crbug.com/628759. | 53 // URL is not replicated. See https://crbug.com/628759. |
| 53 if (top_origin == "null" && frame->top()->isWebLocalFrame()) | 54 if (top_origin.unique() && frame->top()->isWebLocalFrame()) |
| 54 return frame->top()->document().url(); | 55 return frame->top()->document().url(); |
| 55 return blink::WebStringToGURL(top_origin); | 56 return top_origin.GetURL(); |
| 56 } | 57 } |
| 57 | 58 |
| 58 ContentSetting GetContentSettingFromRules( | 59 ContentSetting GetContentSettingFromRules( |
| 59 const ContentSettingsForOneType& rules, | 60 const ContentSettingsForOneType& rules, |
| 60 const WebFrame* frame, | 61 const WebFrame* frame, |
| 61 const GURL& secondary_url) { | 62 const GURL& secondary_url) { |
| 62 ContentSettingsForOneType::const_iterator it; | 63 ContentSettingsForOneType::const_iterator it; |
| 63 // If there is only one rule, it's the default rule and we don't need to match | 64 // If there is only one rule, it's the default rule and we don't need to match |
| 64 // the patterns. | 65 // the patterns. |
| 65 if (rules.size() == 1) { | 66 if (rules.size() == 1) { |
| (...skipping 136 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 202 bool ContentSettingsObserver::allowDatabase(const WebString& name, | 203 bool ContentSettingsObserver::allowDatabase(const WebString& name, |
| 203 const WebString& display_name, | 204 const WebString& display_name, |
| 204 unsigned estimated_size) { | 205 unsigned estimated_size) { |
| 205 WebFrame* frame = render_frame()->GetWebFrame(); | 206 WebFrame* frame = render_frame()->GetWebFrame(); |
| 206 if (frame->getSecurityOrigin().isUnique() || | 207 if (frame->getSecurityOrigin().isUnique() || |
| 207 frame->top()->getSecurityOrigin().isUnique()) | 208 frame->top()->getSecurityOrigin().isUnique()) |
| 208 return false; | 209 return false; |
| 209 | 210 |
| 210 bool result = false; | 211 bool result = false; |
| 211 Send(new ChromeViewHostMsg_AllowDatabase( | 212 Send(new ChromeViewHostMsg_AllowDatabase( |
| 212 routing_id(), | 213 routing_id(), url::Origin(frame->getSecurityOrigin()).GetURL(), |
| 213 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), | 214 url::Origin(frame->top()->getSecurityOrigin()).GetURL(), name, |
| 214 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()), | 215 display_name, &result)); |
| 215 name, display_name, &result)); | |
| 216 return result; | 216 return result; |
| 217 } | 217 } |
| 218 | 218 |
| 219 void ContentSettingsObserver::requestFileSystemAccessAsync( | 219 void ContentSettingsObserver::requestFileSystemAccessAsync( |
| 220 const WebContentSettingCallbacks& callbacks) { | 220 const WebContentSettingCallbacks& callbacks) { |
| 221 WebFrame* frame = render_frame()->GetWebFrame(); | 221 WebFrame* frame = render_frame()->GetWebFrame(); |
| 222 if (frame->getSecurityOrigin().isUnique() || | 222 if (frame->getSecurityOrigin().isUnique() || |
| 223 frame->top()->getSecurityOrigin().isUnique()) { | 223 frame->top()->getSecurityOrigin().isUnique()) { |
| 224 WebContentSettingCallbacks permissionCallbacks(callbacks); | 224 WebContentSettingCallbacks permissionCallbacks(callbacks); |
| 225 permissionCallbacks.doDeny(); | 225 permissionCallbacks.doDeny(); |
| 226 return; | 226 return; |
| 227 } | 227 } |
| 228 ++current_request_id_; | 228 ++current_request_id_; |
| 229 std::pair<PermissionRequestMap::iterator, bool> insert_result = | 229 std::pair<PermissionRequestMap::iterator, bool> insert_result = |
| 230 permission_requests_.insert( | 230 permission_requests_.insert( |
| 231 std::make_pair(current_request_id_, callbacks)); | 231 std::make_pair(current_request_id_, callbacks)); |
| 232 | 232 |
| 233 // Verify there are no duplicate insertions. | 233 // Verify there are no duplicate insertions. |
| 234 DCHECK(insert_result.second); | 234 DCHECK(insert_result.second); |
| 235 | 235 |
| 236 Send(new ChromeViewHostMsg_RequestFileSystemAccessAsync( | 236 Send(new ChromeViewHostMsg_RequestFileSystemAccessAsync( |
| 237 routing_id(), current_request_id_, | 237 routing_id(), current_request_id_, |
| 238 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), | 238 url::Origin(frame->getSecurityOrigin()).GetURL(), |
| 239 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()))); | 239 url::Origin(frame->top()->getSecurityOrigin()).GetURL())); |
| 240 } | 240 } |
| 241 | 241 |
| 242 bool ContentSettingsObserver::allowImage(bool enabled_per_settings, | 242 bool ContentSettingsObserver::allowImage(bool enabled_per_settings, |
| 243 const WebURL& image_url) { | 243 const WebURL& image_url) { |
| 244 bool allow = enabled_per_settings; | 244 bool allow = enabled_per_settings; |
| 245 if (enabled_per_settings) { | 245 if (enabled_per_settings) { |
| 246 if (is_interstitial_page_) | 246 if (is_interstitial_page_) |
| 247 return true; | 247 return true; |
| 248 | 248 |
| 249 if (IsWhitelistedForContentSettings()) | 249 if (IsWhitelistedForContentSettings()) |
| (...skipping 14 matching lines...) Expand all Loading... |
| 264 | 264 |
| 265 bool ContentSettingsObserver::allowIndexedDB(const WebString& name, | 265 bool ContentSettingsObserver::allowIndexedDB(const WebString& name, |
| 266 const WebSecurityOrigin& origin) { | 266 const WebSecurityOrigin& origin) { |
| 267 WebFrame* frame = render_frame()->GetWebFrame(); | 267 WebFrame* frame = render_frame()->GetWebFrame(); |
| 268 if (frame->getSecurityOrigin().isUnique() || | 268 if (frame->getSecurityOrigin().isUnique() || |
| 269 frame->top()->getSecurityOrigin().isUnique()) | 269 frame->top()->getSecurityOrigin().isUnique()) |
| 270 return false; | 270 return false; |
| 271 | 271 |
| 272 bool result = false; | 272 bool result = false; |
| 273 Send(new ChromeViewHostMsg_AllowIndexedDB( | 273 Send(new ChromeViewHostMsg_AllowIndexedDB( |
| 274 routing_id(), | 274 routing_id(), url::Origin(frame->getSecurityOrigin()).GetURL(), |
| 275 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), | 275 url::Origin(frame->top()->getSecurityOrigin()).GetURL(), name, &result)); |
| 276 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()), | |
| 277 name, &result)); | |
| 278 return result; | 276 return result; |
| 279 } | 277 } |
| 280 | 278 |
| 281 bool ContentSettingsObserver::allowPlugins(bool enabled_per_settings) { | 279 bool ContentSettingsObserver::allowPlugins(bool enabled_per_settings) { |
| 282 return enabled_per_settings; | 280 return enabled_per_settings; |
| 283 } | 281 } |
| 284 | 282 |
| 285 bool ContentSettingsObserver::allowScript(bool enabled_per_settings) { | 283 bool ContentSettingsObserver::allowScript(bool enabled_per_settings) { |
| 286 if (!enabled_per_settings) | 284 if (!enabled_per_settings) |
| 287 return false; | 285 return false; |
| 288 if (is_interstitial_page_) | 286 if (is_interstitial_page_) |
| 289 return true; | 287 return true; |
| 290 | 288 |
| 291 WebFrame* frame = render_frame()->GetWebFrame(); | 289 WebFrame* frame = render_frame()->GetWebFrame(); |
| 292 const auto it = cached_script_permissions_.find(frame); | 290 const auto it = cached_script_permissions_.find(frame); |
| 293 if (it != cached_script_permissions_.end()) | 291 if (it != cached_script_permissions_.end()) |
| 294 return it->second; | 292 return it->second; |
| 295 | 293 |
| 296 // Evaluate the content setting rules before | 294 // Evaluate the content setting rules before |
| 297 // |IsWhitelistedForContentSettings|; if there is only the default rule | 295 // |IsWhitelistedForContentSettings|; if there is only the default rule |
| 298 // allowing all scripts, it's quicker this way. | 296 // allowing all scripts, it's quicker this way. |
| 299 bool allow = true; | 297 bool allow = true; |
| 300 if (content_setting_rules_) { | 298 if (content_setting_rules_) { |
| 301 ContentSetting setting = GetContentSettingFromRules( | 299 ContentSetting setting = GetContentSettingFromRules( |
| 302 content_setting_rules_->script_rules, frame, | 300 content_setting_rules_->script_rules, frame, |
| 303 blink::WebStringToGURL( | 301 url::Origin(frame->document().getSecurityOrigin()).GetURL()); |
| 304 frame->document().getSecurityOrigin().toString())); | |
| 305 allow = setting != CONTENT_SETTING_BLOCK; | 302 allow = setting != CONTENT_SETTING_BLOCK; |
| 306 } | 303 } |
| 307 allow = allow || IsWhitelistedForContentSettings(); | 304 allow = allow || IsWhitelistedForContentSettings(); |
| 308 | 305 |
| 309 cached_script_permissions_[frame] = allow; | 306 cached_script_permissions_[frame] = allow; |
| 310 return allow; | 307 return allow; |
| 311 } | 308 } |
| 312 | 309 |
| 313 bool ContentSettingsObserver::allowScriptFromSource( | 310 bool ContentSettingsObserver::allowScriptFromSource( |
| 314 bool enabled_per_settings, | 311 bool enabled_per_settings, |
| (...skipping 14 matching lines...) Expand all Loading... |
| 329 return allow || IsWhitelistedForContentSettings(); | 326 return allow || IsWhitelistedForContentSettings(); |
| 330 } | 327 } |
| 331 | 328 |
| 332 bool ContentSettingsObserver::allowStorage(bool local) { | 329 bool ContentSettingsObserver::allowStorage(bool local) { |
| 333 WebFrame* frame = render_frame()->GetWebFrame(); | 330 WebFrame* frame = render_frame()->GetWebFrame(); |
| 334 if (frame->getSecurityOrigin().isUnique() || | 331 if (frame->getSecurityOrigin().isUnique() || |
| 335 frame->top()->getSecurityOrigin().isUnique()) | 332 frame->top()->getSecurityOrigin().isUnique()) |
| 336 return false; | 333 return false; |
| 337 | 334 |
| 338 StoragePermissionsKey key( | 335 StoragePermissionsKey key( |
| 339 blink::WebStringToGURL(frame->document().getSecurityOrigin().toString()), | 336 url::Origin(frame->document().getSecurityOrigin()).GetURL(), local); |
| 340 local); | |
| 341 const auto permissions = cached_storage_permissions_.find(key); | 337 const auto permissions = cached_storage_permissions_.find(key); |
| 342 if (permissions != cached_storage_permissions_.end()) | 338 if (permissions != cached_storage_permissions_.end()) |
| 343 return permissions->second; | 339 return permissions->second; |
| 344 | 340 |
| 345 bool result = false; | 341 bool result = false; |
| 346 Send(new ChromeViewHostMsg_AllowDOMStorage( | 342 Send(new ChromeViewHostMsg_AllowDOMStorage( |
| 347 routing_id(), | 343 routing_id(), url::Origin(frame->getSecurityOrigin()).GetURL(), |
| 348 blink::WebStringToGURL(frame->getSecurityOrigin().toString()), | 344 url::Origin(frame->top()->getSecurityOrigin()).GetURL(), local, &result)); |
| 349 blink::WebStringToGURL(frame->top()->getSecurityOrigin().toString()), | |
| 350 local, &result)); | |
| 351 cached_storage_permissions_[key] = result; | 345 cached_storage_permissions_[key] = result; |
| 352 return result; | 346 return result; |
| 353 } | 347 } |
| 354 | 348 |
| 355 bool ContentSettingsObserver::allowReadFromClipboard(bool default_value) { | 349 bool ContentSettingsObserver::allowReadFromClipboard(bool default_value) { |
| 356 bool allowed = default_value; | 350 bool allowed = default_value; |
| 357 #if defined(ENABLE_EXTENSIONS) | 351 #if defined(ENABLE_EXTENSIONS) |
| 358 extensions::ScriptContext* current_context = | 352 extensions::ScriptContext* current_context = |
| 359 extension_dispatcher_->script_context_set().GetCurrent(); | 353 extension_dispatcher_->script_context_set().GetCurrent(); |
| 360 if (current_context) { | 354 if (current_context) { |
| (...skipping 42 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 403 return true; | 397 return true; |
| 404 } | 398 } |
| 405 | 399 |
| 406 bool ContentSettingsObserver::allowAutoplay(bool default_value) { | 400 bool ContentSettingsObserver::allowAutoplay(bool default_value) { |
| 407 if (!content_setting_rules_) | 401 if (!content_setting_rules_) |
| 408 return default_value; | 402 return default_value; |
| 409 | 403 |
| 410 WebFrame* frame = render_frame()->GetWebFrame(); | 404 WebFrame* frame = render_frame()->GetWebFrame(); |
| 411 return GetContentSettingFromRules( | 405 return GetContentSettingFromRules( |
| 412 content_setting_rules_->autoplay_rules, frame, | 406 content_setting_rules_->autoplay_rules, frame, |
| 413 blink::WebStringToGURL( | 407 url::Origin(frame->document().getSecurityOrigin()).GetURL()) == |
| 414 frame->document().getSecurityOrigin().toString())) == | |
| 415 CONTENT_SETTING_ALLOW; | 408 CONTENT_SETTING_ALLOW; |
| 416 } | 409 } |
| 417 | 410 |
| 418 void ContentSettingsObserver::passiveInsecureContentFound( | 411 void ContentSettingsObserver::passiveInsecureContentFound( |
| 419 const blink::WebURL& resource_url) { | 412 const blink::WebURL& resource_url) { |
| 420 ReportInsecureContent(SslInsecureContentType::DISPLAY); | 413 ReportInsecureContent(SslInsecureContentType::DISPLAY); |
| 421 FilteredReportInsecureContentDisplayed(GURL(resource_url)); | 414 FilteredReportInsecureContentDisplayed(GURL(resource_url)); |
| 422 } | 415 } |
| 423 | 416 |
| 424 void ContentSettingsObserver::didUseKeygen() { | 417 void ContentSettingsObserver::didUseKeygen() { |
| 425 WebFrame* frame = render_frame()->GetWebFrame(); | 418 WebFrame* frame = render_frame()->GetWebFrame(); |
| 426 Send(new ChromeViewHostMsg_DidUseKeygen( | 419 Send(new ChromeViewHostMsg_DidUseKeygen( |
| 427 routing_id(), | 420 routing_id(), url::Origin(frame->getSecurityOrigin()).GetURL())); |
| 428 blink::WebStringToGURL(frame->getSecurityOrigin().toString()))); | |
| 429 } | 421 } |
| 430 | 422 |
| 431 void ContentSettingsObserver::didNotAllowPlugins() { | 423 void ContentSettingsObserver::didNotAllowPlugins() { |
| 432 DidBlockContentType(CONTENT_SETTINGS_TYPE_PLUGINS); | 424 DidBlockContentType(CONTENT_SETTINGS_TYPE_PLUGINS); |
| 433 } | 425 } |
| 434 | 426 |
| 435 void ContentSettingsObserver::didNotAllowScript() { | 427 void ContentSettingsObserver::didNotAllowScript() { |
| 436 DidBlockContentType(CONTENT_SETTINGS_TYPE_JAVASCRIPT); | 428 DidBlockContentType(CONTENT_SETTINGS_TYPE_JAVASCRIPT); |
| 437 } | 429 } |
| 438 | 430 |
| (...skipping 102 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 541 | 533 |
| 542 // If the scheme is file:, an empty file name indicates a directory listing, | 534 // If the scheme is file:, an empty file name indicates a directory listing, |
| 543 // which requires JavaScript to function properly. | 535 // which requires JavaScript to function properly. |
| 544 if (base::EqualsASCII(protocol, url::kFileScheme)) { | 536 if (base::EqualsASCII(protocol, url::kFileScheme)) { |
| 545 return document_url.SchemeIs(url::kFileScheme) && | 537 return document_url.SchemeIs(url::kFileScheme) && |
| 546 document_url.ExtractFileName().empty(); | 538 document_url.ExtractFileName().empty(); |
| 547 } | 539 } |
| 548 | 540 |
| 549 return false; | 541 return false; |
| 550 } | 542 } |
| OLD | NEW |