<webview>: Change how plugin load works inside guests.

chrome/browser/guestview/webview/plugin_permission_helper.cc

+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/guestview/webview/plugin_permission_helper.h"
+
+#include "chrome/browser/guestview/webview/webview_guest.h"
+#include "chrome/browser/plugins/chrome_plugin_service_filter.h"
+#include "chrome/common/render_messages.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/browser/render_view_host.h"
+
+using content::RenderViewHost;
+using content::WebContents;
+
+DEFINE_WEB_CONTENTS_USER_DATA_KEY(PluginPermissionHelper);

[Fady Samuel, 2013/09/26 12:53:32]

Not a code issue but I actually really like the pattern of isolating things into
helpers. It makes WebViewGuest look a lot less cluttered!

+
+PluginPermissionHelper::PluginPermissionHelper(WebContents* contents)
+    : content::WebContentsObserver(contents),
+      weak_factory_(this) {
+}
+
+PluginPermissionHelper::~PluginPermissionHelper() {
+}
+
+bool PluginPermissionHelper::OnMessageReceived(const IPC::Message& message) {
+  IPC_BEGIN_MESSAGE_MAP(PluginPermissionHelper, message)
+    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_BlockedUnauthorizedPlugin,
+                        OnBlockedUnauthorizedPlugin)
+    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_CouldNotLoadPlugin,
+                        OnCouldNotLoadPlugin)
+    IPC_MESSAGE_UNHANDLED(return false)
+  IPC_END_MESSAGE_MAP()
+
+  return true;
+}
+
+void PluginPermissionHelper::OnBlockedUnauthorizedPlugin(
+    const string16& name,
+    const std::string& identifier) {
+  const char kPluginName[] = "name";
+  const char kPluginIdentifier[] = "identifier";
+
+  GuestView* guest = GuestView::FromWebContents(web_contents());
+  if (!guest)
+    return;
+  WebViewGuest* webview = guest->AsWebView();
+  if (!webview)

[Fady Samuel, 2013/09/26 12:53:32]

I suspect we'll use this pattern more frequently in the future, because it also
serves a security check: Once a WebContents is bound to a WebView, it can't
become an AdView or *View, it's always a WebView, and so on.

Could you please move this to a small method WebViewGuest::FromWebContents,
similar to WebViewGuest::From? Thanks. This will prevent people from assuming
that using the WebView API implies that the GuestView is a WebViewGuest and
static_cast to a WebViewGuest as a compromised renderer could lie about this to
try to get elevated privileges to a guest.

[sadrul, 2013/09/26 15:28:10]

Good idea. Done.

+    return;
+
+  base::DictionaryValue info;
+  info.SetString(std::string(kPluginName), name);
+  info.SetString(std::string(kPluginIdentifier), identifier);
+  webview->RequestPermission(
+      BROWSER_PLUGIN_PERMISSION_TYPE_LOAD_PLUGIN,
+      info,
+      base::Bind(&PluginPermissionHelper::OnPermissionResponse,
+                 weak_factory_.GetWeakPtr(),
+                 identifier));
+}
+
+void PluginPermissionHelper::OnCouldNotLoadPlugin(
+    const base::FilePath& plugin_path) {
+}
+
+void PluginPermissionHelper::OnPermissionResponse(const std::string& identifier,
+                                                  bool allow,
+                                                  const std::string& input) {
+  if (allow) {
+    RenderViewHost* host = web_contents()->GetRenderViewHost();
+    ChromePluginServiceFilter::GetInstance()->AuthorizeAllPlugins(
+        host->GetProcess()->GetID());
+    host->Send(new ChromeViewMsg_LoadBlockedPlugins(
+        host->GetRoutingID(), identifier));
+  }
+}