Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "content/browser/frame_host/render_frame_host_impl.h" | 5 #include "content/browser/frame_host/render_frame_host_impl.h" |
| 6 | 6 |
| 7 #include <algorithm> | 7 #include <algorithm> |
| 8 #include <utility> | 8 #include <utility> |
| 9 | 9 |
| 10 #include "base/bind.h" | 10 #include "base/bind.h" |
| (...skipping 3570 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 3581 const ResourceRequestBodyImpl& body) { | 3581 const ResourceRequestBodyImpl& body) { |
| 3582 GrantFileAccess(GetProcess()->GetID(), body.GetReferencedFiles()); | 3582 GrantFileAccess(GetProcess()->GetID(), body.GetReferencedFiles()); |
| 3583 } | 3583 } |
| 3584 | 3584 |
| 3585 void RenderFrameHostImpl::UpdatePermissionsForNavigation( | 3585 void RenderFrameHostImpl::UpdatePermissionsForNavigation( |
| 3586 const CommonNavigationParams& common_params, | 3586 const CommonNavigationParams& common_params, |
| 3587 const RequestNavigationParams& request_params) { | 3587 const RequestNavigationParams& request_params) { |
| 3588 // Browser plugin guests are not allowed to navigate outside web-safe schemes, | 3588 // Browser plugin guests are not allowed to navigate outside web-safe schemes, |
| 3589 // so do not grant them the ability to request additional URLs. | 3589 // so do not grant them the ability to request additional URLs. |
| 3590 if (!GetProcess()->IsForGuestsOnly()) { | 3590 if (!GetProcess()->IsForGuestsOnly()) { |
| 3591 for (const GURL& url : request_params.redirects) { | |
| 3592 ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL( | |
| 3593 GetProcess()->GetID(), url); | |
|
nasko
2017/05/23 04:39:34
It seems a bit more prudent to grant access to the
| |
| 3594 } | |
| 3591 ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL( | 3595 ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL( |
| 3592 GetProcess()->GetID(), common_params.url); | 3596 GetProcess()->GetID(), common_params.url); |
| 3593 if (common_params.url.SchemeIs(url::kDataScheme) && | 3597 if (common_params.url.SchemeIs(url::kDataScheme) && |
| 3594 !common_params.base_url_for_data_url.is_empty()) { | 3598 !common_params.base_url_for_data_url.is_empty()) { |
| 3595 // When there's a base URL specified for the data URL, we also need to | 3599 // When there's a base URL specified for the data URL, we also need to |
| 3596 // grant access to the base URL. This allows file: and other unexpected | 3600 // grant access to the base URL. This allows file: and other unexpected |
| 3597 // schemes to be accepted at commit time and during CORS checks (e.g., for | 3601 // schemes to be accepted at commit time and during CORS checks (e.g., for |
| 3598 // font requests). | 3602 // font requests). |
| 3599 ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL( | 3603 ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL( |
| 3600 GetProcess()->GetID(), common_params.base_url_for_data_url); | 3604 GetProcess()->GetID(), common_params.base_url_for_data_url); |
| (...skipping 382 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 3983 } | 3987 } |
| 3984 | 3988 |
| 3985 void RenderFrameHostImpl::ForwardGetInterfaceToRenderFrame( | 3989 void RenderFrameHostImpl::ForwardGetInterfaceToRenderFrame( |
| 3986 const std::string& interface_name, | 3990 const std::string& interface_name, |
| 3987 mojo::ScopedMessagePipeHandle pipe) { | 3991 mojo::ScopedMessagePipeHandle pipe) { |
| 3988 GetRemoteInterfaces()->GetInterface(interface_name, std::move(pipe)); | 3992 GetRemoteInterfaces()->GetInterface(interface_name, std::move(pipe)); |
| 3989 } | 3993 } |
| 3990 #endif | 3994 #endif |
| 3991 | 3995 |
| 3992 } // namespace content | 3996 } // namespace content |
| OLD | NEW |