Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/child_process_security_policy_impl.h" | 5 #include "content/browser/child_process_security_policy_impl.h" |
| 6 | 6 |
| 7 #include <algorithm> | 7 #include <algorithm> |
| 8 #include <utility> | 8 #include <utility> |
| 9 | 9 |
| 10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
| (...skipping 773 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 784 result = ChildProcessHasPermissionsForFile(iter->second, | 784 result = ChildProcessHasPermissionsForFile(iter->second, |
| 785 file, | 785 file, |
| 786 permissions); | 786 permissions); |
| 787 } | 787 } |
| 788 } | 788 } |
| 789 return result; | 789 return result; |
| 790 } | 790 } |
| 791 | 791 |
| 792 bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystemFile( | 792 bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystemFile( |
| 793 int child_id, | 793 int child_id, |
| 794 const storage::FileSystemURL& url, | 794 const storage::FileSystemURL& filesystem_url, |
| 795 int permissions) { | 795 int permissions) { |
| 796 if (!url.is_valid()) | 796 if (!filesystem_url.is_valid()) |
| 797 return false; | 797 return false; |
| 798 | 798 |
| 799 // If |url.origin()| is not committable in this process, then this page | 799 // If |filesystem_url.origin()| is not committable in this process, then this |
| 800 // page | |
|
Charlie Reis
2016/10/04 23:25:58
nit: Fix line wrap.
ncarter (slow)
2016/10/06 18:11:24
Done.
| |
| 800 // should not be able to place content in that origin via the filesystem | 801 // should not be able to place content in that origin via the filesystem |
| 801 // API either. | 802 // API either. |
| 802 bool can_commit_origin = CanCommitURL(child_id, url.origin()); | 803 bool can_commit_origin = CanCommitURL(child_id, filesystem_url.origin()); |
| 803 UMA_HISTOGRAM_BOOLEAN("ChildProcessSecurityPolicy.FileSystemCanCommitOrigin", | 804 UMA_HISTOGRAM_BOOLEAN("ChildProcessSecurityPolicy.FileSystemCanCommitOrigin", |
| 804 can_commit_origin); | 805 can_commit_origin); |
| 805 if (!can_commit_origin) | 806 if (!can_commit_origin) |
| 806 return false; | 807 return false; |
| 807 | 808 |
| 808 if (url.path().ReferencesParent()) | 809 if (filesystem_url.path().ReferencesParent()) |
| 809 return false; | 810 return false; |
| 810 | 811 |
| 811 // Any write access is disallowed on the root path. | 812 // Any write access is disallowed on the root path. |
| 812 if (storage::VirtualPath::IsRootPath(url.path()) && | 813 if (storage::VirtualPath::IsRootPath(filesystem_url.path()) && |
| 813 (permissions & ~READ_FILE_GRANT)) { | 814 (permissions & ~READ_FILE_GRANT)) { |
| 814 return false; | 815 return false; |
| 815 } | 816 } |
| 816 | 817 |
| 817 if (url.mount_type() == storage::kFileSystemTypeIsolated) { | 818 if (filesystem_url.mount_type() == storage::kFileSystemTypeIsolated) { |
| 818 // When Isolated filesystems is overlayed on top of another filesystem, | 819 // When Isolated filesystems is overlayed on top of another filesystem, |
| 819 // its per-filesystem permission overrides the underlying filesystem | 820 // its per-filesystem permission overrides the underlying filesystem |
| 820 // permissions). | 821 // permissions). |
| 821 return HasPermissionsForFileSystem( | 822 return HasPermissionsForFileSystem( |
| 822 child_id, url.mount_filesystem_id(), permissions); | 823 child_id, filesystem_url.mount_filesystem_id(), permissions); |
| 823 } | 824 } |
| 824 | 825 |
| 825 FileSystemPermissionPolicyMap::iterator found = | 826 FileSystemPermissionPolicyMap::iterator found = |
| 826 file_system_policy_map_.find(url.type()); | 827 file_system_policy_map_.find(filesystem_url.type()); |
| 827 if (found == file_system_policy_map_.end()) | 828 if (found == file_system_policy_map_.end()) |
| 828 return false; | 829 return false; |
| 829 | 830 |
| 830 if ((found->second & storage::FILE_PERMISSION_READ_ONLY) && | 831 if ((found->second & storage::FILE_PERMISSION_READ_ONLY) && |
| 831 permissions & ~READ_FILE_GRANT) { | 832 permissions & ~READ_FILE_GRANT) { |
| 832 return false; | 833 return false; |
| 833 } | 834 } |
| 834 | 835 |
| 835 if (found->second & storage::FILE_PERMISSION_USE_FILE_PERMISSION) | 836 if (found->second & storage::FILE_PERMISSION_USE_FILE_PERMISSION) |
| 836 return HasPermissionsForFile(child_id, url.path(), permissions); | 837 return HasPermissionsForFile(child_id, filesystem_url.path(), permissions); |
| 837 | 838 |
| 838 if (found->second & storage::FILE_PERMISSION_SANDBOX) | 839 if (found->second & storage::FILE_PERMISSION_SANDBOX) |
| 839 return true; | 840 return true; |
| 840 | 841 |
| 841 return false; | 842 return false; |
| 842 } | 843 } |
| 843 | 844 |
| 844 bool ChildProcessSecurityPolicyImpl::CanReadFileSystemFile( | 845 bool ChildProcessSecurityPolicyImpl::CanReadFileSystemFile( |
| 845 int child_id, | 846 int child_id, |
| 846 const storage::FileSystemURL& url) { | 847 const storage::FileSystemURL& filesystem_url) { |
| 847 return HasPermissionsForFileSystemFile(child_id, url, READ_FILE_GRANT); | 848 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 849 READ_FILE_GRANT); | |
| 848 } | 850 } |
| 849 | 851 |
| 850 bool ChildProcessSecurityPolicyImpl::CanWriteFileSystemFile( | 852 bool ChildProcessSecurityPolicyImpl::CanWriteFileSystemFile( |
| 851 int child_id, | 853 int child_id, |
| 852 const storage::FileSystemURL& url) { | 854 const storage::FileSystemURL& filesystem_url) { |
| 853 return HasPermissionsForFileSystemFile(child_id, url, WRITE_FILE_GRANT); | 855 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 856 WRITE_FILE_GRANT); | |
| 854 } | 857 } |
| 855 | 858 |
| 856 bool ChildProcessSecurityPolicyImpl::CanCreateFileSystemFile( | 859 bool ChildProcessSecurityPolicyImpl::CanCreateFileSystemFile( |
| 857 int child_id, | 860 int child_id, |
| 858 const storage::FileSystemURL& url) { | 861 const storage::FileSystemURL& filesystem_url) { |
| 859 return HasPermissionsForFileSystemFile(child_id, url, CREATE_NEW_FILE_GRANT); | 862 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 863 CREATE_NEW_FILE_GRANT); | |
| 860 } | 864 } |
| 861 | 865 |
| 862 bool ChildProcessSecurityPolicyImpl::CanCreateReadWriteFileSystemFile( | 866 bool ChildProcessSecurityPolicyImpl::CanCreateReadWriteFileSystemFile( |
| 863 int child_id, | 867 int child_id, |
| 864 const storage::FileSystemURL& url) { | 868 const storage::FileSystemURL& filesystem_url) { |
| 865 return HasPermissionsForFileSystemFile(child_id, url, | 869 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 866 CREATE_READ_WRITE_FILE_GRANT); | 870 CREATE_READ_WRITE_FILE_GRANT); |
| 867 } | 871 } |
| 868 | 872 |
| 869 bool ChildProcessSecurityPolicyImpl::CanCopyIntoFileSystemFile( | 873 bool ChildProcessSecurityPolicyImpl::CanCopyIntoFileSystemFile( |
| 870 int child_id, | 874 int child_id, |
| 871 const storage::FileSystemURL& url) { | 875 const storage::FileSystemURL& filesystem_url) { |
| 872 return HasPermissionsForFileSystemFile(child_id, url, COPY_INTO_FILE_GRANT); | 876 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 877 COPY_INTO_FILE_GRANT); | |
| 873 } | 878 } |
| 874 | 879 |
| 875 bool ChildProcessSecurityPolicyImpl::CanDeleteFileSystemFile( | 880 bool ChildProcessSecurityPolicyImpl::CanDeleteFileSystemFile( |
| 876 int child_id, | 881 int child_id, |
| 877 const storage::FileSystemURL& url) { | 882 const storage::FileSystemURL& filesystem_url) { |
| 878 return HasPermissionsForFileSystemFile(child_id, url, DELETE_FILE_GRANT); | 883 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 884 DELETE_FILE_GRANT); | |
| 879 } | 885 } |
| 880 | 886 |
| 881 bool ChildProcessSecurityPolicyImpl::HasWebUIBindings(int child_id) { | 887 bool ChildProcessSecurityPolicyImpl::HasWebUIBindings(int child_id) { |
| 882 base::AutoLock lock(lock_); | 888 base::AutoLock lock(lock_); |
| 883 | 889 |
| 884 SecurityStateMap::iterator state = security_state_.find(child_id); | 890 SecurityStateMap::iterator state = security_state_.find(child_id); |
| 885 if (state == security_state_.end()) | 891 if (state == security_state_.end()) |
| 886 return false; | 892 return false; |
| 887 | 893 |
| 888 return state->second->has_web_ui_bindings(); | 894 return state->second->has_web_ui_bindings(); |
| (...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 972 base::AutoLock lock(lock_); | 978 base::AutoLock lock(lock_); |
| 973 | 979 |
| 974 SecurityStateMap::iterator state = security_state_.find(child_id); | 980 SecurityStateMap::iterator state = security_state_.find(child_id); |
| 975 if (state == security_state_.end()) | 981 if (state == security_state_.end()) |
| 976 return false; | 982 return false; |
| 977 | 983 |
| 978 return state->second->can_send_midi_sysex(); | 984 return state->second->can_send_midi_sysex(); |
| 979 } | 985 } |
| 980 | 986 |
| 981 } // namespace content | 987 } // namespace content |
| OLD | NEW |