| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/frame_host/render_frame_host_impl.h" | 5 #include "content/browser/frame_host/render_frame_host_impl.h" |
| 6 | 6 |
| 7 #include <utility> | 7 #include <utility> |
| 8 | 8 |
| 9 #include "base/bind.h" | 9 #include "base/bind.h" |
| 10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
| (...skipping 1185 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1196 // Without this check, an evil renderer can trick the browser into creating | 1196 // Without this check, an evil renderer can trick the browser into creating |
| 1197 // a navigation entry for a banned URL. If the user clicks the back button | 1197 // a navigation entry for a banned URL. If the user clicks the back button |
| 1198 // followed by the forward button (or clicks reload, or round-trips through | 1198 // followed by the forward button (or clicks reload, or round-trips through |
| 1199 // session restore, etc), we'll think that the browser commanded the | 1199 // session restore, etc), we'll think that the browser commanded the |
| 1200 // renderer to load the URL and grant the renderer the privileges to request | 1200 // renderer to load the URL and grant the renderer the privileges to request |
| 1201 // the URL. To prevent this attack, we block the renderer from inserting | 1201 // the URL. To prevent this attack, we block the renderer from inserting |
| 1202 // banned URLs into the navigation controller in the first place. | 1202 // banned URLs into the navigation controller in the first place. |
| 1203 process->FilterURL(false, &validated_params.url); | 1203 process->FilterURL(false, &validated_params.url); |
| 1204 process->FilterURL(true, &validated_params.referrer.url); | 1204 process->FilterURL(true, &validated_params.referrer.url); |
| 1205 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); | 1205 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); |
| 1206 it != validated_params.redirects.end(); ++it) { | 1206 it != validated_params.redirects.end(); ++it) { |
| 1207 process->FilterURL(false, &(*it)); | 1207 process->FilterURL(false, &(*it)); |
| 1208 } | 1208 } |
| 1209 process->FilterURL(true, &validated_params.searchable_form_url); | 1209 process->FilterURL(true, &validated_params.searchable_form_url); |
| 1210 | 1210 |
| 1211 // Without this check, the renderer can trick the browser into using | 1211 // Without this check, the renderer can trick the browser into using |
| 1212 // filenames it can't access in a future session restore. | 1212 // filenames it can't access in a future session restore. |
| 1213 if (!CanAccessFilesOfPageState(validated_params.page_state)) { | 1213 if (!CanAccessFilesOfPageState(validated_params.page_state)) { |
| 1214 bad_message::ReceivedBadMessage( | 1214 bad_message::ReceivedBadMessage( |
| 1215 GetProcess(), bad_message::RFH_CAN_ACCESS_FILES_OF_PAGE_STATE); | 1215 GetProcess(), bad_message::RFH_CAN_ACCESS_FILES_OF_PAGE_STATE); |
| 1216 return; | 1216 return; |
| (...skipping 2046 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 3263 NavigationEntryImpl* pending_entry = | 3263 NavigationEntryImpl* pending_entry = |
| 3264 NavigationEntryImpl::FromNavigationEntry( | 3264 NavigationEntryImpl::FromNavigationEntry( |
| 3265 frame_tree_node()->navigator()->GetController()->GetPendingEntry()); | 3265 frame_tree_node()->navigator()->GetController()->GetPendingEntry()); |
| 3266 if (pending_entry && pending_entry->GetUniqueID() == params.nav_entry_id) { | 3266 if (pending_entry && pending_entry->GetUniqueID() == params.nav_entry_id) { |
| 3267 pending_nav_entry_id = params.nav_entry_id; | 3267 pending_nav_entry_id = params.nav_entry_id; |
| 3268 is_renderer_initiated = pending_entry->is_renderer_initiated(); | 3268 is_renderer_initiated = pending_entry->is_renderer_initiated(); |
| 3269 } | 3269 } |
| 3270 | 3270 |
| 3271 return NavigationHandleImpl::Create( | 3271 return NavigationHandleImpl::Create( |
| 3272 params.url, frame_tree_node_, is_renderer_initiated, | 3272 params.url, frame_tree_node_, is_renderer_initiated, |
| 3273 params.was_within_same_page, params.is_srcdoc, base::TimeTicks::Now(), | 3273 params.was_within_same_page, base::TimeTicks::Now(), |
| 3274 pending_nav_entry_id, params.gesture, | 3274 pending_nav_entry_id, params.gesture, |
| 3275 false); // started_from_context_menu | 3275 false); // started_from_context_menu |
| 3276 } | 3276 } |
| 3277 | 3277 |
| 3278 // Determine if the current NavigationHandle can be used. | 3278 // Determine if the current NavigationHandle can be used. |
| 3279 if (navigation_handle_ && navigation_handle_->GetURL() == params.url) { | 3279 if (navigation_handle_ && navigation_handle_->GetURL() == params.url) { |
| 3280 return std::move(navigation_handle_); | 3280 return std::move(navigation_handle_); |
| 3281 } | 3281 } |
| 3282 | 3282 |
| 3283 // If the URL does not match what the NavigationHandle expects, treat the | 3283 // If the URL does not match what the NavigationHandle expects, treat the |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 3316 | 3316 |
| 3317 // Reset any existing NavigationHandle. | 3317 // Reset any existing NavigationHandle. |
| 3318 navigation_handle_.reset(); | 3318 navigation_handle_.reset(); |
| 3319 } | 3319 } |
| 3320 | 3320 |
| 3321 // There is no pending NavigationEntry in these cases, so pass 0 as the | 3321 // There is no pending NavigationEntry in these cases, so pass 0 as the |
| 3322 // pending_nav_entry_id. If the previous handle was a prematurely aborted | 3322 // pending_nav_entry_id. If the previous handle was a prematurely aborted |
| 3323 // navigation loaded via LoadDataWithBaseURL, propagate the entry id. | 3323 // navigation loaded via LoadDataWithBaseURL, propagate the entry id. |
| 3324 return NavigationHandleImpl::Create( | 3324 return NavigationHandleImpl::Create( |
| 3325 params.url, frame_tree_node_, is_renderer_initiated, | 3325 params.url, frame_tree_node_, is_renderer_initiated, |
| 3326 params.was_within_same_page, params.is_srcdoc, base::TimeTicks::Now(), | 3326 params.was_within_same_page, base::TimeTicks::Now(), |
| 3327 entry_id_for_data_nav, params.gesture, | 3327 entry_id_for_data_nav, params.gesture, |
| 3328 false); // started_from_context_menu | 3328 false); // started_from_context_menu |
| 3329 } | 3329 } |
| 3330 | 3330 |
| 3331 } // namespace content | 3331 } // namespace content |
| OLD | NEW |