Add origins to the Background Fetch Mojo calls.

Add origins to the Background Fetch Mojo calls.

Modulo the Request mojofication (CL 2762303002), this concludes the Mojo
interfaces necessary for Background Fetch.

BUG=692535, 692534
Review-Url: https://codereview.chromium.org/2775923002
Cr-Commit-Position: refs/heads/master@{#459600}
Committed: https://chromium.googlesource.com/chromium/src/+/ad305c85c6689084129632ec990fb17e16311afe

[Peter Beverloo, 2017-03-24 19:43:50]

peter@chromium.org changed reviewers:
+ tsepez@chromium.org

[Peter Beverloo, 2017-03-24 19:43:51]

+tsepez

[Peter Beverloo, 2017-03-24 19:43:54]

The CQ bit was checked by peter@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-24 19:44:22]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Tom Sepez, 2017-03-24 20:17:07]

refresh my memory: which process is specifying the origin information, and why
can we trust it ?  Thanks.

[Peter Beverloo, 2017-03-24 20:41:11]

On 2017/03/24 20:17:07, Tom Sepez wrote:
> refresh my memory: which process is specifying the origin information, and why
> can we trust it ?  Thanks.

It's the security origin used by the renderer for pretty much all security
checks, but since it lives in the renderer it can always be compromised.
Unfortunately, the same goes for |service_worker_registration_id|.

However, the latter is just a number. The likelihood for an attacker to guess a
valid service_worker_registration_id (which conveniently start at 1 and
increment) is much higher than their ability to guess a valid
{service_worker_registration_id, origin} pair.

Existing code relies on the pair and assumes it's fine. If you'd like I can add
a verification step in the ServiceImpl to validate that the pair refers to an
actual Service Worker, but it would unfortunately lead to a bunch more data
copies because that process is asynchronous.

[commit-bot: I haz the power, 2017-03-24 21:15:47]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-24 21:15:48]

Dry run: This issue passed the CQ dry run.

[Tom Sepez, 2017-03-24 21:19:51]

lgtm

[Peter Beverloo, 2017-03-24 23:35:21]

The CQ bit was checked by peter@chromium.org

[commit-bot: I haz the power, 2017-03-24 23:35:57]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-24 23:42:13]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1490398521897900, "parent_rev":
"12a19e335d08d57c1517991c904c2390841cb105", "commit_rev":
"ad305c85c6689084129632ec990fb17e16311afe"}

[commit-bot: I haz the power, 2017-03-24 23:43:06]

Description was changed from

==========
Add origins to the Background Fetch Mojo calls.

Modulo the Request mojofication (CL 2762303002), this concludes the Mojo
interfaces necessary for Background Fetch.

BUG=692535, 692534
==========

to

==========
Add origins to the Background Fetch Mojo calls.

Modulo the Request mojofication (CL 2762303002), this concludes the Mojo
interfaces necessary for Background Fetch.

BUG=692535, 692534

Review-Url: https://codereview.chromium.org/2775923002
Cr-Commit-Position: refs/heads/master@{#459600}
Committed:
https://chromium.googlesource.com/chromium/src/+/ad305c85c6689084129632ec990f...
==========

[commit-bot: I haz the power, 2017-03-24 23:43:15]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/chromium/src/+/ad305c85c6689084129632ec990f...

[dcheng, 2017-03-24 23:57:00]

On 2017/03/24 23:43:15, commit-bot: I haz the power wrote:
> Committed patchset #1 (id:1) as
>
https://chromium.googlesource.com/chromium/src/+/ad305c85c6689084129632ec990f...

drive-by: after service worker is completely mojofied, will it be possible to
more strongly bind the origin to the interface itself? i.e. can we connect to
the interface via the service worker interface (which on the browser side,
presumably already knows what origin it's associated with), and then have the
browser-side impl created with the correct origin, so we don't have to plumb
this through?

[Peter Beverloo, 2017-03-25 00:03:57]

peter@chromium.org changed reviewers:
+ shimazu@chromium.org

[Peter Beverloo, 2017-03-25 00:03:58]

+shimazu who will be able to comment better than I can