Pipe the devTools FrameId from blink into the browser for headless

content/browser/devtools/devtools_agent_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/devtools/devtools_agent_host_impl.h"
 
 #include <map>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/json/json_writer.h"
 #include "base/lazy_instance.h"
 #include "base/message_loop/message_loop.h"
 #include "base/observer_list.h"
 #include "content/browser/devtools/devtools_manager.h"
 #include "content/browser/devtools/devtools_session.h"
 #include "content/browser/devtools/forwarding_agent_host.h"
 #include "content/browser/devtools/protocol/page.h"
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 #include "content/browser/devtools/service_worker_devtools_agent_host.h"
 #include "content/browser/devtools/service_worker_devtools_manager.h"
 #include "content/browser/devtools/shared_worker_devtools_agent_host.h"
 #include "content/browser/devtools/shared_worker_devtools_manager.h"
+#include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/loader/netlog_observer.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 
 namespace content {
 
 namespace {
 typedef std::map<std::string, DevToolsAgentHostImpl*> Instances;
 base::LazyInstance<Instances>::Leaky g_instances = LAZY_INSTANCE_INITIALIZER;
 
@@ skipping 17 matching lines @@
   return "1.2";
 }
 
 // static
 bool DevToolsAgentHost::IsSupportedProtocolVersion(const std::string& version) {
   // TODO(dgozman): generate this.
   return version == "1.0" || version == "1.1" || version == "1.2";
 }
 
 // static
+std::string DevToolsAgentHost::GetDevToolsFrameIdForFrameTreeNodeId(
+    int frame_tree_node_id) {

[Charlie Reis, 2017/04/24 20:26:42]

We've been talking about how to make APIs like this safer, since it's too easy
at the moment to introduce security bugs this way.  The FTN ID doesn't change
even when a cross-process navigation has taken place (e.g., between
chrome://settings and evil.com), so you might be getting a string here that was
sent up from a compromised renderer process when expecting one for a highly
privileged page.

One way to make it safer is to require the caller to pass in a process ID any
time they pass in a FrameTreeNode ID, so we can check that it agrees with the
current_frame_host's process inside this call.

[alex clarke (OOO till 29th), 2017/04/25 15:01:03]

Done.

[Charlie Reis, 2017/04/26 19:52:55]

Thanks!

+  FrameTreeNode* frame_tree_node =
+      FrameTreeNode::GloballyFindByID(frame_tree_node_id);
+  if (!frame_tree_node)
+    return "";
+  return frame_tree_node->current_frame_host()->devtools_frame_id();
+}
+
+// static
 DevToolsAgentHost::List DevToolsAgentHost::GetOrCreateAll() {
   List result;
   SharedWorkerDevToolsAgentHost::List shared_list;
   SharedWorkerDevToolsManager::GetInstance()->AddAllAgentHosts(&shared_list);
   for (const auto& host : shared_list)
     result.push_back(host);
 
   ServiceWorkerDevToolsAgentHost::List service_list;
   ServiceWorkerDevToolsManager::GetInstance()->AddAllAgentHosts(&service_list);
   for (const auto& host : service_list)
@@ skipping 318 matching lines @@
     if (message_buffer_.size() != message_buffer_size_)
       return false;
     callback_.Run(chunk.session_id, message_buffer_);
     message_buffer_ = std::string();
     message_buffer_size_ = 0;
   }
   return true;
 }
 
 }  // namespace content