Tighten IO thread blob/filesystem URL checks for apps with webview permission.

content/browser/child_process_security_policy_impl.cc

Index: content/browser/child_process_security_policy_impl.cc
diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index 66a4c3add715ddab6d56d994ed22f6d496124368..d7fd241f5adebd7b7f10cad5bd52e6018fda1be0 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc
@@ -201,6 +201,10 @@ class ChildProcessSecurityPolicyImpl::SecurityState {
     can_send_midi_sysex_ = true;
   }
 
+  bool CanCommitOrigin(const url::Origin& origin) {
+    return base::ContainsKey(origin_set_, origin);
+  }
+
   // Determine whether permission has been granted to commit |url|.
   bool CanCommitURL(const GURL& url) {
     DCHECK(!url.SchemeIsBlob() && !url.SchemeIsFileSystem())
@@ -212,7 +216,7 @@ class ChildProcessSecurityPolicyImpl::SecurityState {
       return scheme_judgment->second;
 
     // Otherwise, check for permission for specific origin.
-    if (base::ContainsKey(origin_set_, url::Origin(url)))
+    if (CanCommitOrigin(url::Origin(url)))
       return true;
 
     // file:// URLs are more granular.  The child may have been given
@@ -934,6 +938,16 @@ bool ChildProcessSecurityPolicyImpl::CanAccessDataForOrigin(int child_id,
   return state->second->CanAccessDataForOrigin(gurl);
 }
 
+bool ChildProcessSecurityPolicyImpl::HasSpecificPermissionForOrigin(
+    int child_id,
+    const url::Origin& origin) {
+  base::AutoLock lock(lock_);
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  if (state == security_state_.end())
+    return false;

[ncarter (slow), 2016/10/20 17:46:50]

In previous interactions with CPSP, these |return false| cases were the source
of headaches (hence the lame return true on line 936).

I'm mentioning this so that we can remember it as a possible cause, if the DWOC
happens in practice -- races between the final few IPCs before a process dies,
and ChildProcessSecurityPolicyImpl::Remove() for that process_id.

[alexmos, 2016/10/20 18:40:23]

Acknowledged.

+  return state->second->CanCommitOrigin(origin);
+}
+
 void ChildProcessSecurityPolicyImpl::LockToOrigin(int child_id,
                                                   const GURL& gurl) {
   // "gurl" can be currently empty in some cases, such as file://blah.