OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/browser/frame_host/render_frame_host_impl.h" | 5 #include "content/browser/frame_host/render_frame_host_impl.h" |
6 | 6 |
7 #include <utility> | 7 #include <utility> |
8 | 8 |
9 #include "base/bind.h" | 9 #include "base/bind.h" |
10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
(...skipping 1176 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1187 // Without this check, an evil renderer can trick the browser into creating | 1187 // Without this check, an evil renderer can trick the browser into creating |
1188 // a navigation entry for a banned URL. If the user clicks the back button | 1188 // a navigation entry for a banned URL. If the user clicks the back button |
1189 // followed by the forward button (or clicks reload, or round-trips through | 1189 // followed by the forward button (or clicks reload, or round-trips through |
1190 // session restore, etc), we'll think that the browser commanded the | 1190 // session restore, etc), we'll think that the browser commanded the |
1191 // renderer to load the URL and grant the renderer the privileges to request | 1191 // renderer to load the URL and grant the renderer the privileges to request |
1192 // the URL. To prevent this attack, we block the renderer from inserting | 1192 // the URL. To prevent this attack, we block the renderer from inserting |
1193 // banned URLs into the navigation controller in the first place. | 1193 // banned URLs into the navigation controller in the first place. |
1194 process->FilterURL(false, &validated_params.url); | 1194 process->FilterURL(false, &validated_params.url); |
1195 process->FilterURL(true, &validated_params.referrer.url); | 1195 process->FilterURL(true, &validated_params.referrer.url); |
1196 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); | 1196 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); |
1197 it != validated_params.redirects.end(); ++it) { | 1197 it != validated_params.redirects.end(); ++it) { |
1198 process->FilterURL(false, &(*it)); | 1198 process->FilterURL(false, &(*it)); |
1199 } | 1199 } |
1200 process->FilterURL(true, &validated_params.searchable_form_url); | 1200 process->FilterURL(true, &validated_params.searchable_form_url); |
1201 | 1201 |
1202 // Without this check, the renderer can trick the browser into using | 1202 // Without this check, the renderer can trick the browser into using |
1203 // filenames it can't access in a future session restore. | 1203 // filenames it can't access in a future session restore. |
1204 if (!CanAccessFilesOfPageState(validated_params.page_state)) { | 1204 if (!CanAccessFilesOfPageState(validated_params.page_state)) { |
1205 bad_message::ReceivedBadMessage( | 1205 bad_message::ReceivedBadMessage( |
1206 GetProcess(), bad_message::RFH_CAN_ACCESS_FILES_OF_PAGE_STATE); | 1206 GetProcess(), bad_message::RFH_CAN_ACCESS_FILES_OF_PAGE_STATE); |
1207 return; | 1207 return; |
(...skipping 2002 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3210 NavigationEntryImpl* pending_entry = | 3210 NavigationEntryImpl* pending_entry = |
3211 NavigationEntryImpl::FromNavigationEntry( | 3211 NavigationEntryImpl::FromNavigationEntry( |
3212 frame_tree_node()->navigator()->GetController()->GetPendingEntry()); | 3212 frame_tree_node()->navigator()->GetController()->GetPendingEntry()); |
3213 if (pending_entry && pending_entry->GetUniqueID() == params.nav_entry_id) { | 3213 if (pending_entry && pending_entry->GetUniqueID() == params.nav_entry_id) { |
3214 pending_nav_entry_id = params.nav_entry_id; | 3214 pending_nav_entry_id = params.nav_entry_id; |
3215 is_renderer_initiated = pending_entry->is_renderer_initiated(); | 3215 is_renderer_initiated = pending_entry->is_renderer_initiated(); |
3216 } | 3216 } |
3217 | 3217 |
3218 return NavigationHandleImpl::Create( | 3218 return NavigationHandleImpl::Create( |
3219 params.url, frame_tree_node_, is_renderer_initiated, | 3219 params.url, frame_tree_node_, is_renderer_initiated, |
3220 params.was_within_same_page, params.is_srcdoc, base::TimeTicks::Now(), | 3220 params.was_within_same_page, base::TimeTicks::Now(), |
3221 pending_nav_entry_id, false); // started_from_context_menu | 3221 pending_nav_entry_id, false); // started_from_context_menu |
3222 } | 3222 } |
3223 | 3223 |
3224 // Determine if the current NavigationHandle can be used. | 3224 // Determine if the current NavigationHandle can be used. |
3225 if (navigation_handle_ && navigation_handle_->GetURL() == params.url) { | 3225 if (navigation_handle_ && navigation_handle_->GetURL() == params.url) { |
3226 return std::move(navigation_handle_); | 3226 return std::move(navigation_handle_); |
3227 } | 3227 } |
3228 | 3228 |
3229 // If the URL does not match what the NavigationHandle expects, treat the | 3229 // If the URL does not match what the NavigationHandle expects, treat the |
3230 // commit as a new navigation. This can happen when loading a Data | 3230 // commit as a new navigation. This can happen when loading a Data |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3262 | 3262 |
3263 // Reset any existing NavigationHandle. | 3263 // Reset any existing NavigationHandle. |
3264 navigation_handle_.reset(); | 3264 navigation_handle_.reset(); |
3265 } | 3265 } |
3266 | 3266 |
3267 // There is no pending NavigationEntry in these cases, so pass 0 as the | 3267 // There is no pending NavigationEntry in these cases, so pass 0 as the |
3268 // pending_nav_entry_id. If the previous handle was a prematurely aborted | 3268 // pending_nav_entry_id. If the previous handle was a prematurely aborted |
3269 // navigation loaded via LoadDataWithBaseURL, propagate the entry id. | 3269 // navigation loaded via LoadDataWithBaseURL, propagate the entry id. |
3270 return NavigationHandleImpl::Create( | 3270 return NavigationHandleImpl::Create( |
3271 params.url, frame_tree_node_, is_renderer_initiated, | 3271 params.url, frame_tree_node_, is_renderer_initiated, |
3272 params.was_within_same_page, params.is_srcdoc, base::TimeTicks::Now(), | 3272 params.was_within_same_page, base::TimeTicks::Now(), |
3273 entry_id_for_data_nav, false); // started_from_context_menu | 3273 entry_id_for_data_nav, false); // started_from_context_menu |
3274 } | 3274 } |
3275 | 3275 |
3276 } // namespace content | 3276 } // namespace content |
OLD | NEW |