Index: chrome/browser/search/local_ntp_source.cc |
diff --git a/chrome/browser/search/local_ntp_source.cc b/chrome/browser/search/local_ntp_source.cc |
index 4388e6a087d92e4c31ea3e1b8a9f11f371836eb7..e14c748db04e45b4697b3fdaa4844f29535a153f 100644 |
--- a/chrome/browser/search/local_ntp_source.cc |
+++ b/chrome/browser/search/local_ntp_source.cc |
@@ -8,19 +8,20 @@ |
#include <memory> |
+#include "base/base64.h" |
#include "base/command_line.h" |
#include "base/json/json_string_value_serializer.h" |
#include "base/logging.h" |
#include "base/memory/ptr_util.h" |
#include "base/memory/ref_counted_memory.h" |
-#include "base/metrics/field_trial.h" |
#include "base/strings/string_util.h" |
#include "base/strings/stringprintf.h" |
#include "base/values.h" |
#include "build/build_config.h" |
+#include "chrome/browser/search/google_search_provider_service.h" |
+#include "chrome/browser/search/google_search_provider_service_factory.h" |
#include "chrome/browser/search/instant_io_context.h" |
#include "chrome/browser/search/local_files_ntp_source.h" |
-#include "chrome/browser/search_engines/template_url_service_factory.h" |
#include "chrome/browser/themes/theme_properties.h" |
#include "chrome/browser/themes/theme_service.h" |
#include "chrome/browser/themes/theme_service_factory.h" |
@@ -29,8 +30,9 @@ |
#include "chrome/grit/browser_resources.h" |
#include "chrome/grit/generated_resources.h" |
#include "chrome/grit/theme_resources.h" |
-#include "components/search_engines/template_url_service.h" |
#include "components/strings/grit/components_strings.h" |
+#include "crypto/secure_hash.h" |
+#include "net/base/hash_value.h" |
#include "net/url_request/url_request.h" |
#include "third_party/skia/include/core/SkColor.h" |
#include "ui/base/l10n/l10n_util.h" |
@@ -46,13 +48,14 @@ const int kLocalResource = -1; |
const char kConfigDataFilename[] = "config.js"; |
const char kThemeCSSFilename[] = "theme.css"; |
+const char kMainHtmlFilename[] = "local-ntp.html"; |
const struct Resource{ |
const char* filename; |
int identifier; |
const char* mime_type; |
} kResources[] = { |
- {"local-ntp.html", IDR_LOCAL_NTP_HTML, "text/html"}, |
+ {kMainHtmlFilename, kLocalResource, "text/html"}, |
{"local-ntp.js", IDR_LOCAL_NTP_JS, "application/javascript"}, |
{kConfigDataFilename, kLocalResource, "application/javascript"}, |
{kThemeCSSFilename, kLocalResource, "text/css"}, |
@@ -67,23 +70,6 @@ std::string StripParameters(const std::string& path) { |
return path.substr(0, path.find("?")); |
} |
-bool DefaultSearchProviderIsGoogle(Profile* profile) { |
- if (!profile) |
- return false; |
- |
- TemplateURLService* template_url_service = |
- TemplateURLServiceFactory::GetForProfile(profile); |
- if (!template_url_service) |
- return false; |
- |
- const TemplateURL* default_provider = |
- template_url_service->GetDefaultSearchProvider(); |
- return default_provider && |
- (default_provider->GetEngineType( |
- template_url_service->search_terms_data()) == |
- SEARCH_ENGINE_GOOGLE); |
-} |
- |
// Adds a localized string keyed by resource id to the dictionary. |
void AddString(base::DictionaryValue* dictionary, |
const std::string& key, |
@@ -116,9 +102,8 @@ std::unique_ptr<base::DictionaryValue> GetTranslatedStrings(bool is_google) { |
} |
// Returns a JS dictionary of configuration data for the local NTP. |
-std::string GetConfigData(Profile* profile) { |
+std::string GetConfigData(bool is_google) { |
base::DictionaryValue config_data; |
- bool is_google = DefaultSearchProviderIsGoogle(profile); |
config_data.Set("translatedStrings", GetTranslatedStrings(is_google)); |
config_data.SetBoolean("isGooglePage", is_google); |
@@ -134,6 +119,22 @@ std::string GetConfigData(Profile* profile) { |
return config_data_js; |
} |
+std::string GetIntegritySha256Value(const std::string& data) { |
+ // Compute the sha256 hash. |
+ net::SHA256HashValue hash_value; |
+ std::unique_ptr<crypto::SecureHash> hash( |
+ crypto::SecureHash::Create(crypto::SecureHash::SHA256)); |
+ hash->Update(data.data(), data.size()); |
+ hash->Finish(&hash_value, sizeof(hash_value)); |
+ |
+ // Base64-encode it. |
+ base::StringPiece hash_value_str( |
+ reinterpret_cast<const char*>(hash_value.data), sizeof(hash_value)); |
+ std::string result; |
+ base::Base64Encode(hash_value_str, &result); |
+ return result; |
+} |
+ |
std::string GetThemeCSS(Profile* profile) { |
SkColor background_color = |
ThemeService::GetThemeProviderForProfile(profile) |
@@ -152,7 +153,18 @@ std::string GetLocalNtpPath() { |
} // namespace |
-LocalNtpSource::LocalNtpSource(Profile* profile) : profile_(profile) {} |
+LocalNtpSource::LocalNtpSource(Profile* profile) |
+ : profile_(profile), |
+ default_search_provider_observer_(this), |
+ default_search_provider_is_google_(false) { |
+ GoogleSearchProviderService* google_service = |
+ GoogleSearchProviderServiceFactory::GetForProfile(profile_); |
+ if (google_service) { |
+ default_search_provider_observer_.Add(google_service); |
+ default_search_provider_is_google_ = |
+ google_service->DefaultSearchProviderIsGoogle(); |
+ } |
+} |
LocalNtpSource::~LocalNtpSource() = default; |
@@ -166,7 +178,8 @@ void LocalNtpSource::StartDataRequest( |
const content::URLDataSource::GotDataCallback& callback) { |
std::string stripped_path = StripParameters(path); |
if (stripped_path == kConfigDataFilename) { |
- std::string config_data_js = GetConfigData(profile_); |
+ std::string config_data_js = |
+ GetConfigData(default_search_provider_is_google_); |
callback.Run(base::RefCountedString::TakeString(&config_data_js)); |
return; |
} |
@@ -188,6 +201,19 @@ void LocalNtpSource::StartDataRequest( |
} |
#endif // !defined(GOOGLE_CHROME_BUILD) |
+ if (stripped_path == kMainHtmlFilename) { |
+ std::string html = ResourceBundle::GetSharedInstance() |
+ .GetRawDataResource(IDR_LOCAL_NTP_HTML) |
+ .as_string(); |
+ std::string config_sha256 = |
+ "sha256-" + GetIntegritySha256Value( |
+ GetConfigData(default_search_provider_is_google_)); |
+ base::ReplaceFirstSubstringAfterOffset(&html, 0, "{{CONFIG_INTEGRITY}}", |
+ config_sha256); |
+ callback.Run(base::RefCountedString::TakeString(&html)); |
+ return; |
+ } |
+ |
float scale = 1.0f; |
std::string filename; |
webui::ParsePathAndScale( |
@@ -203,7 +229,7 @@ void LocalNtpSource::StartDataRequest( |
return; |
} |
} |
- callback.Run(NULL); |
+ callback.Run(nullptr); |
} |
std::string LocalNtpSource::GetMimeType( |
@@ -232,7 +258,7 @@ bool LocalNtpSource::ShouldServiceRequest( |
if (request->url().SchemeIs(chrome::kChromeSearchScheme)) { |
std::string filename; |
- webui::ParsePathAndScale(request->url(), &filename, NULL); |
+ webui::ParsePathAndScale(request->url(), &filename, nullptr); |
for (size_t i = 0; i < arraysize(kResources); ++i) { |
if (filename == kResources[i].filename) |
return true; |
@@ -241,8 +267,34 @@ bool LocalNtpSource::ShouldServiceRequest( |
return false; |
} |
+std::string LocalNtpSource::GetContentSecurityPolicyScriptSrc() const { |
+// Note: This method is called on the IO thread. |
+#if !defined(GOOGLE_CHROME_BUILD) |
+ base::CommandLine* command_line = base::CommandLine::ForCurrentProcess(); |
+ if (command_line->HasSwitch(switches::kLocalNtpReload)) { |
+ // While live-editing the local NTP files, turn off CSP. |
+ return "script-src *;"; |
+ } |
+#endif // !defined(GOOGLE_CHROME_BUILD) |
+ |
+ return "script-src 'strict-dynamic' " |
+ "'sha256-" + |
+ GetIntegritySha256Value( |
+ GetConfigData(default_search_provider_is_google_)) + |
+ "' " |
+ "'sha256-g38WaUaxnOIWY7E2LtLZ5ff9r5sn1dBj80jevt/kmx0=';"; |
+} |
+ |
std::string LocalNtpSource::GetContentSecurityPolicyChildSrc() const { |
// Allow embedding of most visited iframes. |
return base::StringPrintf("child-src %s;", |
chrome::kChromeSearchMostVisitedUrl); |
} |
+ |
+void LocalNtpSource::OnDefaultSearchProviderIsGoogleChanged(bool is_google) { |
+ default_search_provider_is_google_ = is_google; |
sfiera
2017/04/11 09:45:17
What thread is this method called from? If it's th
Marc Treib
2017/04/11 12:37:59
Threading in URLDataSource is kind of a mess :( T
sfiera
2017/04/11 14:07:35
Alright, thanks. This is ugly, but feels like the
|
+} |
+ |
+void LocalNtpSource::OnGoogleSearchProviderServiceShuttingDown() { |
+ default_search_provider_observer_.RemoveAll(); |
+} |