| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/child_process_security_policy_impl.h" | 5 #include "content/browser/child_process_security_policy_impl.h" |
| 6 | 6 |
| 7 #include <algorithm> | 7 #include <algorithm> |
| 8 #include <utility> | 8 #include <utility> |
| 9 | 9 |
| 10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
| (...skipping 773 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 784 result = ChildProcessHasPermissionsForFile(iter->second, | 784 result = ChildProcessHasPermissionsForFile(iter->second, |
| 785 file, | 785 file, |
| 786 permissions); | 786 permissions); |
| 787 } | 787 } |
| 788 } | 788 } |
| 789 return result; | 789 return result; |
| 790 } | 790 } |
| 791 | 791 |
| 792 bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystemFile( | 792 bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystemFile( |
| 793 int child_id, | 793 int child_id, |
| 794 const storage::FileSystemURL& url, | 794 const storage::FileSystemURL& filesystem_url, |
| 795 int permissions) { | 795 int permissions) { |
| 796 if (!url.is_valid()) | 796 if (!filesystem_url.is_valid()) |
| 797 return false; | 797 return false; |
| 798 | 798 |
| 799 // If |url.origin()| is not committable in this process, then this page | 799 // If |filesystem_url.origin()| is not committable in this process, then this |
| 800 // should not be able to place content in that origin via the filesystem | 800 // page should not be able to place content in that origin via the filesystem |
| 801 // API either. | 801 // API either. |
| 802 if (!CanCommitURL(child_id, url.origin())) { | 802 if (!CanCommitURL(child_id, filesystem_url.origin())) { |
| 803 UMA_HISTOGRAM_BOOLEAN("FileSystem.OriginFailedCanCommitURL", true); | 803 UMA_HISTOGRAM_BOOLEAN("FileSystem.OriginFailedCanCommitURL", true); |
| 804 return false; | 804 return false; |
| 805 } | 805 } |
| 806 | 806 |
| 807 if (url.path().ReferencesParent()) | 807 if (filesystem_url.path().ReferencesParent()) |
| 808 return false; | 808 return false; |
| 809 | 809 |
| 810 // Any write access is disallowed on the root path. | 810 // Any write access is disallowed on the root path. |
| 811 if (storage::VirtualPath::IsRootPath(url.path()) && | 811 if (storage::VirtualPath::IsRootPath(filesystem_url.path()) && |
| 812 (permissions & ~READ_FILE_GRANT)) { | 812 (permissions & ~READ_FILE_GRANT)) { |
| 813 return false; | 813 return false; |
| 814 } | 814 } |
| 815 | 815 |
| 816 if (url.mount_type() == storage::kFileSystemTypeIsolated) { | 816 if (filesystem_url.mount_type() == storage::kFileSystemTypeIsolated) { |
| 817 // When Isolated filesystems is overlayed on top of another filesystem, | 817 // When Isolated filesystems is overlayed on top of another filesystem, |
| 818 // its per-filesystem permission overrides the underlying filesystem | 818 // its per-filesystem permission overrides the underlying filesystem |
| 819 // permissions). | 819 // permissions). |
| 820 return HasPermissionsForFileSystem( | 820 return HasPermissionsForFileSystem( |
| 821 child_id, url.mount_filesystem_id(), permissions); | 821 child_id, filesystem_url.mount_filesystem_id(), permissions); |
| 822 } | 822 } |
| 823 | 823 |
| 824 FileSystemPermissionPolicyMap::iterator found = | 824 FileSystemPermissionPolicyMap::iterator found = |
| 825 file_system_policy_map_.find(url.type()); | 825 file_system_policy_map_.find(filesystem_url.type()); |
| 826 if (found == file_system_policy_map_.end()) | 826 if (found == file_system_policy_map_.end()) |
| 827 return false; | 827 return false; |
| 828 | 828 |
| 829 if ((found->second & storage::FILE_PERMISSION_READ_ONLY) && | 829 if ((found->second & storage::FILE_PERMISSION_READ_ONLY) && |
| 830 permissions & ~READ_FILE_GRANT) { | 830 permissions & ~READ_FILE_GRANT) { |
| 831 return false; | 831 return false; |
| 832 } | 832 } |
| 833 | 833 |
| 834 if (found->second & storage::FILE_PERMISSION_USE_FILE_PERMISSION) | 834 if (found->second & storage::FILE_PERMISSION_USE_FILE_PERMISSION) |
| 835 return HasPermissionsForFile(child_id, url.path(), permissions); | 835 return HasPermissionsForFile(child_id, filesystem_url.path(), permissions); |
| 836 | 836 |
| 837 if (found->second & storage::FILE_PERMISSION_SANDBOX) | 837 if (found->second & storage::FILE_PERMISSION_SANDBOX) |
| 838 return true; | 838 return true; |
| 839 | 839 |
| 840 return false; | 840 return false; |
| 841 } | 841 } |
| 842 | 842 |
| 843 bool ChildProcessSecurityPolicyImpl::CanReadFileSystemFile( | 843 bool ChildProcessSecurityPolicyImpl::CanReadFileSystemFile( |
| 844 int child_id, | 844 int child_id, |
| 845 const storage::FileSystemURL& url) { | 845 const storage::FileSystemURL& filesystem_url) { |
| 846 return HasPermissionsForFileSystemFile(child_id, url, READ_FILE_GRANT); | 846 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 847 READ_FILE_GRANT); |
| 847 } | 848 } |
| 848 | 849 |
| 849 bool ChildProcessSecurityPolicyImpl::CanWriteFileSystemFile( | 850 bool ChildProcessSecurityPolicyImpl::CanWriteFileSystemFile( |
| 850 int child_id, | 851 int child_id, |
| 851 const storage::FileSystemURL& url) { | 852 const storage::FileSystemURL& filesystem_url) { |
| 852 return HasPermissionsForFileSystemFile(child_id, url, WRITE_FILE_GRANT); | 853 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 854 WRITE_FILE_GRANT); |
| 853 } | 855 } |
| 854 | 856 |
| 855 bool ChildProcessSecurityPolicyImpl::CanCreateFileSystemFile( | 857 bool ChildProcessSecurityPolicyImpl::CanCreateFileSystemFile( |
| 856 int child_id, | 858 int child_id, |
| 857 const storage::FileSystemURL& url) { | 859 const storage::FileSystemURL& filesystem_url) { |
| 858 return HasPermissionsForFileSystemFile(child_id, url, CREATE_NEW_FILE_GRANT); | 860 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 861 CREATE_NEW_FILE_GRANT); |
| 859 } | 862 } |
| 860 | 863 |
| 861 bool ChildProcessSecurityPolicyImpl::CanCreateReadWriteFileSystemFile( | 864 bool ChildProcessSecurityPolicyImpl::CanCreateReadWriteFileSystemFile( |
| 862 int child_id, | 865 int child_id, |
| 863 const storage::FileSystemURL& url) { | 866 const storage::FileSystemURL& filesystem_url) { |
| 864 return HasPermissionsForFileSystemFile(child_id, url, | 867 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 865 CREATE_READ_WRITE_FILE_GRANT); | 868 CREATE_READ_WRITE_FILE_GRANT); |
| 866 } | 869 } |
| 867 | 870 |
| 868 bool ChildProcessSecurityPolicyImpl::CanCopyIntoFileSystemFile( | 871 bool ChildProcessSecurityPolicyImpl::CanCopyIntoFileSystemFile( |
| 869 int child_id, | 872 int child_id, |
| 870 const storage::FileSystemURL& url) { | 873 const storage::FileSystemURL& filesystem_url) { |
| 871 return HasPermissionsForFileSystemFile(child_id, url, COPY_INTO_FILE_GRANT); | 874 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 875 COPY_INTO_FILE_GRANT); |
| 872 } | 876 } |
| 873 | 877 |
| 874 bool ChildProcessSecurityPolicyImpl::CanDeleteFileSystemFile( | 878 bool ChildProcessSecurityPolicyImpl::CanDeleteFileSystemFile( |
| 875 int child_id, | 879 int child_id, |
| 876 const storage::FileSystemURL& url) { | 880 const storage::FileSystemURL& filesystem_url) { |
| 877 return HasPermissionsForFileSystemFile(child_id, url, DELETE_FILE_GRANT); | 881 return HasPermissionsForFileSystemFile(child_id, filesystem_url, |
| 882 DELETE_FILE_GRANT); |
| 878 } | 883 } |
| 879 | 884 |
| 880 bool ChildProcessSecurityPolicyImpl::HasWebUIBindings(int child_id) { | 885 bool ChildProcessSecurityPolicyImpl::HasWebUIBindings(int child_id) { |
| 881 base::AutoLock lock(lock_); | 886 base::AutoLock lock(lock_); |
| 882 | 887 |
| 883 SecurityStateMap::iterator state = security_state_.find(child_id); | 888 SecurityStateMap::iterator state = security_state_.find(child_id); |
| 884 if (state == security_state_.end()) | 889 if (state == security_state_.end()) |
| 885 return false; | 890 return false; |
| 886 | 891 |
| 887 return state->second->has_web_ui_bindings(); | 892 return state->second->has_web_ui_bindings(); |
| (...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 971 base::AutoLock lock(lock_); | 976 base::AutoLock lock(lock_); |
| 972 | 977 |
| 973 SecurityStateMap::iterator state = security_state_.find(child_id); | 978 SecurityStateMap::iterator state = security_state_.find(child_id); |
| 974 if (state == security_state_.end()) | 979 if (state == security_state_.end()) |
| 975 return false; | 980 return false; |
| 976 | 981 |
| 977 return state->second->can_send_midi_sysex(); | 982 return state->second->can_send_midi_sysex(); |
| 978 } | 983 } |
| 979 | 984 |
| 980 } // namespace content | 985 } // namespace content |
| OLD | NEW |