Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/frame_host/render_frame_host_impl.h" | 5 #include "content/browser/frame_host/render_frame_host_impl.h" |
| 6 | 6 |
| 7 #include "base/bind.h" | 7 #include "base/bind.h" |
| 8 #include "base/containers/hash_tables.h" | 8 #include "base/containers/hash_tables.h" |
| 9 #include "base/lazy_instance.h" | 9 #include "base/lazy_instance.h" |
| 10 #include "base/metrics/user_metrics_action.h" | 10 #include "base/metrics/user_metrics_action.h" |
| (...skipping 270 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 281 IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL) | 281 IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL) |
| 282 IPC_MESSAGE_HANDLER(FrameHostMsg_BeforeUnload_ACK, OnBeforeUnloadACK) | 282 IPC_MESSAGE_HANDLER(FrameHostMsg_BeforeUnload_ACK, OnBeforeUnloadACK) |
| 283 IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK) | 283 IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK) |
| 284 IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu) | 284 IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu) |
| 285 IPC_MESSAGE_HANDLER(FrameHostMsg_JavaScriptExecuteResponse, | 285 IPC_MESSAGE_HANDLER(FrameHostMsg_JavaScriptExecuteResponse, |
| 286 OnJavaScriptExecuteResponse) | 286 OnJavaScriptExecuteResponse) |
| 287 IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptMessage, | 287 IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptMessage, |
| 288 OnRunJavaScriptMessage) | 288 OnRunJavaScriptMessage) |
| 289 IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm, | 289 IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm, |
| 290 OnRunBeforeUnloadConfirm) | 290 OnRunBeforeUnloadConfirm) |
| 291 IPC_MESSAGE_HANDLER(FrameHostMsg_DidAccessInitialDocument, | |
| 292 OnDidAccessInitialDocument) | |
| 291 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_RequestPermission, | 293 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_RequestPermission, |
| 292 OnRequestDesktopNotificationPermission) | 294 OnRequestDesktopNotificationPermission) |
| 293 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Show, | 295 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Show, |
| 294 OnShowDesktopNotification) | 296 OnShowDesktopNotification) |
| 295 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Cancel, | 297 IPC_MESSAGE_HANDLER(DesktopNotificationHostMsg_Cancel, |
| 296 OnCancelDesktopNotification) | 298 OnCancelDesktopNotification) |
| 297 IPC_END_MESSAGE_MAP_EX() | 299 IPC_END_MESSAGE_MAP_EX() |
| 298 | 300 |
| 299 if (!msg_is_ok) { | 301 if (!msg_is_ok) { |
| 300 // The message had a handler, but its de-serialization failed. | 302 // The message had a handler, but its de-serialization failed. |
| (...skipping 129 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 430 // than our FilterURL checks below. If a renderer violates this policy, it | 432 // than our FilterURL checks below. If a renderer violates this policy, it |
| 431 // should be killed. | 433 // should be killed. |
| 432 if (!CanCommitURL(validated_params.url)) { | 434 if (!CanCommitURL(validated_params.url)) { |
| 433 VLOG(1) << "Blocked URL " << validated_params.url.spec(); | 435 VLOG(1) << "Blocked URL " << validated_params.url.spec(); |
| 434 validated_params.url = GURL(kAboutBlankURL); | 436 validated_params.url = GURL(kAboutBlankURL); |
| 435 RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled")); | 437 RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled")); |
| 436 // Kills the process. | 438 // Kills the process. |
| 437 process->ReceivedBadMessage(); | 439 process->ReceivedBadMessage(); |
| 438 } | 440 } |
| 439 | 441 |
| 440 // Now that something has committed, we don't need to track whether the | |
| 441 // initial page has been accessed. | |
| 442 render_view_host_->has_accessed_initial_document_ = false; | |
|
Avi (use Gerrit)
2014/04/25 20:24:44
See the comment in WebContentsImpl.
| |
| 443 | |
| 444 // Without this check, an evil renderer can trick the browser into creating | 442 // Without this check, an evil renderer can trick the browser into creating |
| 445 // a navigation entry for a banned URL. If the user clicks the back button | 443 // a navigation entry for a banned URL. If the user clicks the back button |
| 446 // followed by the forward button (or clicks reload, or round-trips through | 444 // followed by the forward button (or clicks reload, or round-trips through |
| 447 // session restore, etc), we'll think that the browser commanded the | 445 // session restore, etc), we'll think that the browser commanded the |
| 448 // renderer to load the URL and grant the renderer the privileges to request | 446 // renderer to load the URL and grant the renderer the privileges to request |
| 449 // the URL. To prevent this attack, we block the renderer from inserting | 447 // the URL. To prevent this attack, we block the renderer from inserting |
| 450 // banned URLs into the navigation controller in the first place. | 448 // banned URLs into the navigation controller in the first place. |
| 451 process->FilterURL(false, &validated_params.url); | 449 process->FilterURL(false, &validated_params.url); |
| 452 process->FilterURL(true, &validated_params.referrer.url); | 450 process->FilterURL(true, &validated_params.referrer.url); |
| 453 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); | 451 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); |
| (...skipping 217 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 671 | 669 |
| 672 void RenderFrameHostImpl::OnCancelDesktopNotification(int notification_id) { | 670 void RenderFrameHostImpl::OnCancelDesktopNotification(int notification_id) { |
| 673 if (!cancel_notification_callbacks_.count(notification_id)) { | 671 if (!cancel_notification_callbacks_.count(notification_id)) { |
| 674 NOTREACHED(); | 672 NOTREACHED(); |
| 675 return; | 673 return; |
| 676 } | 674 } |
| 677 cancel_notification_callbacks_[notification_id].Run(); | 675 cancel_notification_callbacks_[notification_id].Run(); |
| 678 cancel_notification_callbacks_.erase(notification_id); | 676 cancel_notification_callbacks_.erase(notification_id); |
| 679 } | 677 } |
| 680 | 678 |
| 679 void RenderFrameHostImpl::OnDidAccessInitialDocument() { | |
| 680 delegate_->DidAccessInitialDocument(); | |
| 681 } | |
| 682 | |
| 681 void RenderFrameHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) { | 683 void RenderFrameHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) { |
| 682 render_view_host_->SetPendingShutdown(on_swap_out); | 684 render_view_host_->SetPendingShutdown(on_swap_out); |
| 683 } | 685 } |
| 684 | 686 |
| 685 bool RenderFrameHostImpl::CanCommitURL(const GURL& url) { | 687 bool RenderFrameHostImpl::CanCommitURL(const GURL& url) { |
| 686 // TODO(creis): We should also check for WebUI pages here. Also, when the | 688 // TODO(creis): We should also check for WebUI pages here. Also, when the |
| 687 // out-of-process iframes implementation is ready, we should check for | 689 // out-of-process iframes implementation is ready, we should check for |
| 688 // cross-site URLs that are not allowed to commit in this process. | 690 // cross-site URLs that are not allowed to commit in this process. |
| 689 | 691 |
| 690 // Give the client a chance to disallow URLs from committing. | 692 // Give the client a chance to disallow URLs from committing. |
| (...skipping 147 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 838 cancel_notification_callbacks_.erase(notification_id); | 840 cancel_notification_callbacks_.erase(notification_id); |
| 839 } | 841 } |
| 840 | 842 |
| 841 void RenderFrameHostImpl::DesktopNotificationPermissionRequestDone( | 843 void RenderFrameHostImpl::DesktopNotificationPermissionRequestDone( |
| 842 int callback_context) { | 844 int callback_context) { |
| 843 Send(new DesktopNotificationMsg_PermissionRequestDone( | 845 Send(new DesktopNotificationMsg_PermissionRequestDone( |
| 844 routing_id_, callback_context)); | 846 routing_id_, callback_context)); |
| 845 } | 847 } |
| 846 | 848 |
| 847 } // namespace content | 849 } // namespace content |
| OLD | NEW |