| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "extensions/browser/url_request_util.h" | 5 #include "extensions/browser/url_request_util.h" |
| 6 | 6 |
| 7 #include <string> | 7 #include <string> |
| 8 | 8 |
| 9 #include "content/public/browser/resource_request_info.h" | 9 #include "content/public/browser/resource_request_info.h" |
| 10 #include "content/public/common/browser_side_navigation_policy.h" | 10 #include "content/public/common/browser_side_navigation_policy.h" |
| (...skipping 10 matching lines...) Expand all Loading... |
| 21 namespace extensions { | 21 namespace extensions { |
| 22 namespace url_request_util { | 22 namespace url_request_util { |
| 23 | 23 |
| 24 bool AllowCrossRendererResourceLoad(net::URLRequest* request, | 24 bool AllowCrossRendererResourceLoad(net::URLRequest* request, |
| 25 bool is_incognito, | 25 bool is_incognito, |
| 26 const Extension* extension, | 26 const Extension* extension, |
| 27 InfoMap* extension_info_map, | 27 InfoMap* extension_info_map, |
| 28 bool* allowed) { | 28 bool* allowed) { |
| 29 const content::ResourceRequestInfo* info = | 29 const content::ResourceRequestInfo* info = |
| 30 content::ResourceRequestInfo::ForRequest(request); | 30 content::ResourceRequestInfo::ForRequest(request); |
| 31 std::string resource_path = request->url().path(); | 31 base::StringPiece resource_path = request->url().path(); |
| 32 | 32 |
| 33 // PlzNavigate: this logic is performed for main frame requests in | 33 // PlzNavigate: this logic is performed for main frame requests in |
| 34 // ExtensionNavigationThrottle::WillStartRequest. | 34 // ExtensionNavigationThrottle::WillStartRequest. |
| 35 if (info->GetChildID() != -1 || | 35 if (info->GetChildID() != -1 || |
| 36 info->GetResourceType() != content::RESOURCE_TYPE_MAIN_FRAME || | 36 info->GetResourceType() != content::RESOURCE_TYPE_MAIN_FRAME || |
| 37 !content::IsBrowserSideNavigationEnabled()) { | 37 !content::IsBrowserSideNavigationEnabled()) { |
| 38 // Extensions with webview: allow loading certain resources by guest | 38 // Extensions with webview: allow loading certain resources by guest |
| 39 // renderers with privileged partition IDs as specified in owner's extension | 39 // renderers with privileged partition IDs as specified in owner's extension |
| 40 // the manifest file. | 40 // the manifest file. |
| 41 std::string owner_extension_id; | 41 std::string owner_extension_id; |
| 42 int owner_process_id; | 42 int owner_process_id; |
| 43 WebViewRendererState::GetInstance()->GetOwnerInfo( | 43 WebViewRendererState::GetInstance()->GetOwnerInfo( |
| 44 info->GetChildID(), &owner_process_id, &owner_extension_id); | 44 info->GetChildID(), &owner_process_id, &owner_extension_id); |
| 45 const Extension* owner_extension = | 45 const Extension* owner_extension = |
| 46 extension_info_map->extensions().GetByID(owner_extension_id); | 46 extension_info_map->extensions().GetByID(owner_extension_id); |
| 47 std::string partition_id; | 47 std::string partition_id; |
| 48 bool is_guest = WebViewRendererState::GetInstance()->GetPartitionID( | 48 bool is_guest = WebViewRendererState::GetInstance()->GetPartitionID( |
| 49 info->GetChildID(), &partition_id); | 49 info->GetChildID(), &partition_id); |
| 50 | 50 |
| 51 if (AllowCrossRendererResourceLoadHelper( | 51 if (AllowCrossRendererResourceLoadHelper( |
| 52 is_guest, extension, owner_extension, partition_id, resource_path, | 52 is_guest, extension, owner_extension, partition_id, |
| 53 info->GetPageTransition(), allowed)) { | 53 resource_path.as_string(), info->GetPageTransition(), allowed)) { |
| 54 return true; | 54 return true; |
| 55 } | 55 } |
| 56 } | 56 } |
| 57 | 57 |
| 58 // The following checks require that we have an actual extension object. If we | 58 // The following checks require that we have an actual extension object. If we |
| 59 // don't have it, allow the request handling to continue with the rest of the | 59 // don't have it, allow the request handling to continue with the rest of the |
| 60 // checks. | 60 // checks. |
| 61 if (!extension) { | 61 if (!extension) { |
| 62 *allowed = true; | 62 *allowed = true; |
| 63 return true; | 63 return true; |
| 64 } | 64 } |
| 65 | 65 |
| 66 // Disallow loading of packaged resources for hosted apps. We don't allow | 66 // Disallow loading of packaged resources for hosted apps. We don't allow |
| 67 // hybrid hosted/packaged apps. The one exception is access to icons, since | 67 // hybrid hosted/packaged apps. The one exception is access to icons, since |
| 68 // some extensions want to be able to do things like create their own | 68 // some extensions want to be able to do things like create their own |
| 69 // launchers. | 69 // launchers. |
| 70 std::string resource_root_relative_path = | 70 std::string resource_root_relative_path = |
| 71 request->url().path().empty() ? std::string() | 71 request->url().path().empty() |
| 72 : request->url().path().substr(1); | 72 ? std::string() |
| 73 : request->url().path().substr(1).as_string(); |
| 73 if (extension->is_hosted_app() && | 74 if (extension->is_hosted_app() && |
| 74 !IconsInfo::GetIcons(extension) | 75 !IconsInfo::GetIcons(extension) |
| 75 .ContainsPath(resource_root_relative_path)) { | 76 .ContainsPath(resource_root_relative_path)) { |
| 76 LOG(ERROR) << "Denying load of " << request->url().spec() << " from " | 77 LOG(ERROR) << "Denying load of " << request->url().spec() << " from " |
| 77 << "hosted app."; | 78 << "hosted app."; |
| 78 *allowed = false; | 79 *allowed = false; |
| 79 return true; | 80 return true; |
| 80 } | 81 } |
| 81 | 82 |
| 82 DCHECK_EQ(extension->url(), request->url().GetWithEmptyPath()); | 83 DCHECK_EQ(extension->url(), request->url().GetWithEmptyPath()); |
| (...skipping 13 matching lines...) Expand all Loading... |
| 96 } else if (info->GetResourceType() == content::RESOURCE_TYPE_SUB_FRAME) { | 97 } else if (info->GetResourceType() == content::RESOURCE_TYPE_SUB_FRAME) { |
| 97 // When navigating in subframe, allow if it is the same origin | 98 // When navigating in subframe, allow if it is the same origin |
| 98 // as the top-level frame. This can only be the case if the subframe | 99 // as the top-level frame. This can only be the case if the subframe |
| 99 // request is coming from the extension process. | 100 // request is coming from the extension process. |
| 100 if (extension_info_map->process_map().Contains(info->GetChildID())) { | 101 if (extension_info_map->process_map().Contains(info->GetChildID())) { |
| 101 *allowed = true; | 102 *allowed = true; |
| 102 return true; | 103 return true; |
| 103 } | 104 } |
| 104 | 105 |
| 105 // Also allow if the file is explicitly listed as a web_accessible_resource. | 106 // Also allow if the file is explicitly listed as a web_accessible_resource. |
| 106 if (WebAccessibleResourcesInfo::IsResourceWebAccessible(extension, | 107 if (WebAccessibleResourcesInfo::IsResourceWebAccessible( |
| 107 resource_path)) { | 108 extension, resource_path.as_string())) { |
| 108 *allowed = true; | 109 *allowed = true; |
| 109 return true; | 110 return true; |
| 110 } | 111 } |
| 111 } | 112 } |
| 112 | 113 |
| 113 // Since not all subresources are required to be listed in a v2 | 114 // Since not all subresources are required to be listed in a v2 |
| 114 // manifest, we must allow all subresource loads if there are any web | 115 // manifest, we must allow all subresource loads if there are any web |
| 115 // accessible resources. See http://crbug.com/179127. | 116 // accessible resources. See http://crbug.com/179127. |
| 116 if (!content::IsResourceTypeFrame(info->GetResourceType()) && | 117 if (!content::IsResourceTypeFrame(info->GetResourceType()) && |
| 117 WebAccessibleResourcesInfo::HasWebAccessibleResources(extension)) { | 118 WebAccessibleResourcesInfo::HasWebAccessibleResources(extension)) { |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 163 if (is_guest && !ui::PageTransitionIsWebTriggerable(page_transition)) { | 164 if (is_guest && !ui::PageTransitionIsWebTriggerable(page_transition)) { |
| 164 *allowed = false; | 165 *allowed = false; |
| 165 return true; | 166 return true; |
| 166 } | 167 } |
| 167 | 168 |
| 168 return false; | 169 return false; |
| 169 } | 170 } |
| 170 | 171 |
| 171 } // namespace url_request_util | 172 } // namespace url_request_util |
| 172 } // namespace extensions | 173 } // namespace extensions |
| OLD | NEW |