Add a whitelist check for nacl-nonsfi mode

chrome/browser/nacl_host/nacl_browser_delegate_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/nacl_host/nacl_browser_delegate_impl.h"
 
 #include "base/path_service.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/component_updater/pnacl/pnacl_component_installer.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/nacl_host/nacl_infobar_delegate.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/renderer_host/pepper/chrome_browser_pepper_host_factory.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_paths_internal.h"
 #include "chrome/common/chrome_version_info.h"
 #include "chrome/common/logging_chrome.h"
+#include "chrome/common/pepper_permission_util.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/site_instance.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/browser/info_map.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/manifest_handlers/shared_module_info.h"
 #include "extensions/common/url_pattern.h"
 #include "ppapi/c/private/ppb_nacl_private.h"
 
 using extensions::SharedModuleInfo;
 
 namespace {
 
+const char* kAllowedNonSfiOrigins[] = {
+  "6EAED1924DB611B6EEF2A664BD077BE7EAD33B8F",  // see crbug.com/355141

[Mark Seaborn, 2014/05/03 01:37:59]

Is there a way I can check these IDs?

[elijahtaylor1, 2014/05/06 05:56:15]

Yes, sorry, I meant to update the linked bug with those IDs.  This is done now.

+  "4EB74897CB187C7633357C2FE832E0AD6A44883A"   // see crbug.com/355141
+};
+
 // Handles an extension's NaCl process transitioning in or out of idle state by
 // relaying the state to the extension's process manager.
 //
 // A NaCl instance, when active (making PPAPI calls or receiving callbacks),
 // sends keepalive IPCs to the browser process BrowserPpapiHost at a throttled
 // rate. The content::BrowserPpapiHost passes context information up to the
 // chrome level NaClProcessHost where we use the instance's context to find the
 // associated extension process manager.
 //
 // There is a 1:many relationship for extension:nacl-embeds, but only a
@@ skipping 52 matching lines @@
   content::BrowserThread::PostTask(content::BrowserThread::UI, FROM_HERE,
                                    base::Bind(&OnKeepaliveOnUIThread,
                                               instance_data,
                                               profile_data_directory));
 }
 
 }  // namespace
 
 NaClBrowserDelegateImpl::NaClBrowserDelegateImpl(
     extensions::InfoMap* extension_info_map)
-    : extension_info_map_(extension_info_map), inverse_debug_patterns_(false) {}
+    : extension_info_map_(extension_info_map), inverse_debug_patterns_(false) {
+  for (size_t i = 0; i < arraysize(kAllowedNonSfiOrigins); ++i) {
+    allowed_nonsfi_origins_.insert(kAllowedNonSfiOrigins[i]);
+  }
+}
 
 NaClBrowserDelegateImpl::~NaClBrowserDelegateImpl() {
 }
 
 void NaClBrowserDelegateImpl::ShowMissingArchInfobar(int render_process_id,
                                                      int render_view_id) {
   content::BrowserThread::PostTask(
       content::BrowserThread::UI, FROM_HERE,
       base::Bind(&NaClInfoBarDelegate::Create, render_process_id,
                  render_view_id));
@@ skipping 139 matching lines @@
     return false;
 
   *file_path = resource_file_path;
   return true;
 }
 
 content::BrowserPpapiHost::OnKeepaliveCallback
 NaClBrowserDelegateImpl::GetOnKeepaliveCallback() {
   return base::Bind(&OnKeepalive);
 }
+
+bool NaClBrowserDelegateImpl::IsNonSfiModeAllowed(const GURL& manifest_url) {
+  const extensions::ExtensionSet* extension_set =
+      &extension_info_map_->extensions();
+  return chrome::IsExtensionOrSharedModuleWhitelisted(
+      manifest_url, extension_set, allowed_nonsfi_origins_);
+}