| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/renderer/extensions/resource_request_policy.h" | 5 #include "chrome/renderer/extensions/resource_request_policy.h" |
| 6 | 6 |
| 7 #include "base/logging.h" | 7 #include "base/logging.h" |
| 8 #include "base/strings/stringprintf.h" | 8 #include "base/strings/stringprintf.h" |
| 9 #include "chrome/common/extensions/chrome_manifest_url_handlers.h" | 9 #include "chrome/common/extensions/chrome_manifest_url_handlers.h" |
| 10 #include "chrome/common/url_constants.h" | 10 #include "chrome/common/url_constants.h" |
| (...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 49 // 404 from the browser process. | 49 // 404 from the browser process. |
| 50 return true; | 50 return true; |
| 51 } | 51 } |
| 52 | 52 |
| 53 // Disallow loading of packaged resources for hosted apps. We don't allow | 53 // Disallow loading of packaged resources for hosted apps. We don't allow |
| 54 // hybrid hosted/packaged apps. The one exception is access to icons, since | 54 // hybrid hosted/packaged apps. The one exception is access to icons, since |
| 55 // some extensions want to be able to do things like create their own | 55 // some extensions want to be able to do things like create their own |
| 56 // launchers. | 56 // launchers. |
| 57 std::string resource_root_relative_path = | 57 std::string resource_root_relative_path = |
| 58 resource_url.path().empty() ? std::string() | 58 resource_url.path().empty() ? std::string() |
| 59 : resource_url.path().substr(1); | 59 : resource_url.path().substr(1).as_string(); |
| 60 if (extension->is_hosted_app() && | 60 if (extension->is_hosted_app() && |
| 61 !IconsInfo::GetIcons(extension) | 61 !IconsInfo::GetIcons(extension) |
| 62 .ContainsPath(resource_root_relative_path)) { | 62 .ContainsPath(resource_root_relative_path)) { |
| 63 LOG(ERROR) << "Denying load of " << resource_url.spec() << " from " | 63 LOG(ERROR) << "Denying load of " << resource_url.spec() << " from " |
| 64 << "hosted app."; | 64 << "hosted app."; |
| 65 return false; | 65 return false; |
| 66 } | 66 } |
| 67 | 67 |
| 68 // Disallow loading of extension resources which are not explicitly listed | 68 // Disallow loading of extension resources which are not explicitly listed |
| 69 // as web or WebView accessible if the manifest version is 2 or greater. | 69 // as web or WebView accessible if the manifest version is 2 or greater. |
| 70 if (!WebAccessibleResourcesInfo::IsResourceWebAccessible( | 70 if (!WebAccessibleResourcesInfo::IsResourceWebAccessible( |
| 71 extension, resource_url.path()) && | 71 extension, resource_url.path().as_string()) && |
| 72 !WebviewInfo::IsResourceWebviewAccessible( | 72 !WebviewInfo::IsResourceWebviewAccessible( |
| 73 extension, dispatcher_->webview_partition_id(), | 73 extension, dispatcher_->webview_partition_id(), |
| 74 resource_url.path())) { | 74 resource_url.path().as_string())) { |
| 75 GURL frame_url = frame->document().url(); | 75 GURL frame_url = frame->document().url(); |
| 76 | 76 |
| 77 // The page_origin may be GURL("null") for unique origins like data URLs, | 77 // The page_origin may be GURL("null") for unique origins like data URLs, |
| 78 // but this is ok for the checks below. We only care if it matches the | 78 // but this is ok for the checks below. We only care if it matches the |
| 79 // current extension or has a devtools scheme. | 79 // current extension or has a devtools scheme. |
| 80 GURL page_origin = url::Origin(frame->top()->getSecurityOrigin()).GetURL(); | 80 GURL page_origin = url::Origin(frame->top()->getSecurityOrigin()).GetURL(); |
| 81 | 81 |
| 82 // Exceptions are: | 82 // Exceptions are: |
| 83 // - empty origin (needed for some edge cases when we have empty origins) | 83 // - empty origin (needed for some edge cases when we have empty origins) |
| 84 bool is_empty_origin = frame_url.is_empty(); | 84 bool is_empty_origin = frame_url.is_empty(); |
| (...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 128 frame->addMessageToConsole( | 128 frame->addMessageToConsole( |
| 129 blink::WebConsoleMessage(blink::WebConsoleMessage::LevelError, | 129 blink::WebConsoleMessage(blink::WebConsoleMessage::LevelError, |
| 130 blink::WebString::fromUTF8(message))); | 130 blink::WebString::fromUTF8(message))); |
| 131 return false; | 131 return false; |
| 132 } | 132 } |
| 133 | 133 |
| 134 return true; | 134 return true; |
| 135 } | 135 } |
| 136 | 136 |
| 137 } // namespace extensions | 137 } // namespace extensions |
| OLD | NEW |