OLD | NEW |
---|---|
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/browser/frame_host/render_frame_host_impl.h" | 5 #include "content/browser/frame_host/render_frame_host_impl.h" |
6 | 6 |
7 #include "base/bind.h" | 7 #include "base/bind.h" |
8 #include "base/containers/hash_tables.h" | 8 #include "base/containers/hash_tables.h" |
9 #include "base/lazy_instance.h" | 9 #include "base/lazy_instance.h" |
10 #include "base/metrics/user_metrics_action.h" | 10 #include "base/metrics/user_metrics_action.h" |
(...skipping 270 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
281 IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL) | 281 IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL) |
282 IPC_MESSAGE_HANDLER(FrameHostMsg_BeforeUnload_ACK, OnBeforeUnloadACK) | 282 IPC_MESSAGE_HANDLER(FrameHostMsg_BeforeUnload_ACK, OnBeforeUnloadACK) |
283 IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK) | 283 IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK) |
284 IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu) | 284 IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu) |
285 IPC_MESSAGE_HANDLER(FrameHostMsg_JavaScriptExecuteResponse, | 285 IPC_MESSAGE_HANDLER(FrameHostMsg_JavaScriptExecuteResponse, |
286 OnJavaScriptExecuteResponse) | 286 OnJavaScriptExecuteResponse) |
287 IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptMessage, | 287 IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptMessage, |
288 OnRunJavaScriptMessage) | 288 OnRunJavaScriptMessage) |
289 IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm, | 289 IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm, |
290 OnRunBeforeUnloadConfirm) | 290 OnRunBeforeUnloadConfirm) |
291 IPC_MESSAGE_HANDLER(FrameHostMsg_DidAccessInitialDocument, | |
292 OnDidAccessInitialDocument) | |
291 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_RequestPermission, | 293 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_RequestPermission, |
292 OnRequestDesktopNotificationPermission) | 294 OnRequestDesktopNotificationPermission) |
293 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Show, | 295 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Show, |
294 OnShowDesktopNotification) | 296 OnShowDesktopNotification) |
295 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Cancel, | 297 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Cancel, |
296 OnCancelDesktopNotification) | 298 OnCancelDesktopNotification) |
297 IPC_END_MESSAGE_MAP_EX() | 299 IPC_END_MESSAGE_MAP_EX() |
298 | 300 |
299 if (!msg_is_ok) { | 301 if (!msg_is_ok) { |
300 // The message had a handler, but its de-serialization failed. | 302 // The message had a handler, but its de-serialization failed. |
(...skipping 129 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
430 // than our FilterURL checks below. If a renderer violates this policy, it | 432 // than our FilterURL checks below. If a renderer violates this policy, it |
431 // should be killed. | 433 // should be killed. |
432 if (!CanCommitURL(validated_params.url)) { | 434 if (!CanCommitURL(validated_params.url)) { |
433 VLOG(1) << "Blocked URL " << validated_params.url.spec(); | 435 VLOG(1) << "Blocked URL " << validated_params.url.spec(); |
434 validated_params.url = GURL(kAboutBlankURL); | 436 validated_params.url = GURL(kAboutBlankURL); |
435 RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled")); | 437 RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled")); |
436 // Kills the process. | 438 // Kills the process. |
437 process->ReceivedBadMessage(); | 439 process->ReceivedBadMessage(); |
438 } | 440 } |
439 | 441 |
440 // Now that something has committed, we don't need to track whether the | |
441 // initial page has been accessed. | |
442 render_view_host_->has_accessed_initial_document_ = false; | |
Avi (use Gerrit)
2014/04/25 20:24:44
See the comment in WebContentsImpl.
| |
443 | |
444 // Without this check, an evil renderer can trick the browser into creating | 442 // Without this check, an evil renderer can trick the browser into creating |
445 // a navigation entry for a banned URL. If the user clicks the back button | 443 // a navigation entry for a banned URL. If the user clicks the back button |
446 // followed by the forward button (or clicks reload, or round-trips through | 444 // followed by the forward button (or clicks reload, or round-trips through |
447 // session restore, etc), we'll think that the browser commanded the | 445 // session restore, etc), we'll think that the browser commanded the |
448 // renderer to load the URL and grant the renderer the privileges to request | 446 // renderer to load the URL and grant the renderer the privileges to request |
449 // the URL. To prevent this attack, we block the renderer from inserting | 447 // the URL. To prevent this attack, we block the renderer from inserting |
450 // banned URLs into the navigation controller in the first place. | 448 // banned URLs into the navigation controller in the first place. |
451 process->FilterURL(false, &validated_params.url); | 449 process->FilterURL(false, &validated_params.url); |
452 process->FilterURL(true, &validated_params.referrer.url); | 450 process->FilterURL(true, &validated_params.referrer.url); |
453 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); | 451 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); |
(...skipping 217 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
671 | 669 |
672 void RenderFrameHostImpl::OnCancelDesktopNotification(int notification_id) { | 670 void RenderFrameHostImpl::OnCancelDesktopNotification(int notification_id) { |
673 if (!cancel_notification_callbacks_.count(notification_id)) { | 671 if (!cancel_notification_callbacks_.count(notification_id)) { |
674 NOTREACHED(); | 672 NOTREACHED(); |
675 return; | 673 return; |
676 } | 674 } |
677 cancel_notification_callbacks_[notification_id].Run(); | 675 cancel_notification_callbacks_[notification_id].Run(); |
678 cancel_notification_callbacks_.erase(notification_id); | 676 cancel_notification_callbacks_.erase(notification_id); |
679 } | 677 } |
680 | 678 |
679 void RenderFrameHostImpl::OnDidAccessInitialDocument() { | |
680 delegate_->DidAccessInitialDocument(); | |
681 } | |
682 | |
681 void RenderFrameHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) { | 683 void RenderFrameHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) { |
682 render_view_host_->SetPendingShutdown(on_swap_out); | 684 render_view_host_->SetPendingShutdown(on_swap_out); |
683 } | 685 } |
684 | 686 |
685 bool RenderFrameHostImpl::CanCommitURL(const GURL& url) { | 687 bool RenderFrameHostImpl::CanCommitURL(const GURL& url) { |
686 // TODO(creis): We should also check for WebUI pages here. Also, when the | 688 // TODO(creis): We should also check for WebUI pages here. Also, when the |
687 // out-of-process iframes implementation is ready, we should check for | 689 // out-of-process iframes implementation is ready, we should check for |
688 // cross-site URLs that are not allowed to commit in this process. | 690 // cross-site URLs that are not allowed to commit in this process. |
689 | 691 |
690 // Give the client a chance to disallow URLs from committing. | 692 // Give the client a chance to disallow URLs from committing. |
(...skipping 147 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
838 cancel_notification_callbacks_.erase(notification_id); | 840 cancel_notification_callbacks_.erase(notification_id); |
839 } | 841 } |
840 | 842 |
841 void RenderFrameHostImpl::DesktopNotificationPermissionRequestDone( | 843 void RenderFrameHostImpl::DesktopNotificationPermissionRequestDone( |
842 int callback_context) { | 844 int callback_context) { |
843 Send(new DesktopNotificationMsg_PermissionRequestDone( | 845 Send(new DesktopNotificationMsg_PermissionRequestDone( |
844 routing_id_, callback_context)); | 846 routing_id_, callback_context)); |
845 } | 847 } |
846 | 848 |
847 } // namespace content | 849 } // namespace content |
OLD | NEW |