OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ | 5 #ifndef CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ |
6 #define CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ | 6 #define CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ |
7 | 7 |
8 #include <map> | 8 #include <map> |
9 #include <memory> | 9 #include <memory> |
10 #include <set> | 10 #include <set> |
(...skipping 76 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
87 const std::string& filesystem_id) override; | 87 const std::string& filesystem_id) override; |
88 bool HasWebUIBindings(int child_id) override; | 88 bool HasWebUIBindings(int child_id) override; |
89 void GrantSendMidiSysExMessage(int child_id) override; | 89 void GrantSendMidiSysExMessage(int child_id) override; |
90 bool CanAccessDataForOrigin(int child_id, const GURL& url) override; | 90 bool CanAccessDataForOrigin(int child_id, const GURL& url) override; |
91 bool HasSpecificPermissionForOrigin(int child_id, | 91 bool HasSpecificPermissionForOrigin(int child_id, |
92 const url::Origin& origin) override; | 92 const url::Origin& origin) override; |
93 | 93 |
94 // Returns if |child_id| can read all of the |files|. | 94 // Returns if |child_id| can read all of the |files|. |
95 bool CanReadAllFiles(int child_id, const std::vector<base::FilePath>& files); | 95 bool CanReadAllFiles(int child_id, const std::vector<base::FilePath>& files); |
96 | 96 |
| 97 // Validate that |child_id| in |file_system_context| is allowed to access |
| 98 // data in the POST body specified by |body|. Can be called on any thread. |
| 99 bool CanReadRequestBody(int child_id, |
| 100 const storage::FileSystemContext* file_system_context, |
| 101 const scoped_refptr<ResourceRequestBodyImpl>& body); |
| 102 |
97 // Validate that the renderer process for |site_instance| is allowed to access | 103 // Validate that the renderer process for |site_instance| is allowed to access |
98 // data in the POST body specified by |body|. Has to be called on the UI | 104 // data in the POST body specified by |body|. Has to be called on the UI |
99 // thread. | 105 // thread. |
100 // TODO(lukasza): Remove code duplication - the method below should be reused | |
101 // by RenderFrameHostImpl::OnBeginNavigation and | |
102 // ResourceDispatcherHostImpl::ShouldServiceRequest. | |
103 bool CanReadRequestBody(SiteInstance* site_instance, | 106 bool CanReadRequestBody(SiteInstance* site_instance, |
104 const scoped_refptr<ResourceRequestBodyImpl>& body); | 107 const scoped_refptr<ResourceRequestBodyImpl>& body); |
105 | 108 |
106 // Pseudo schemes are treated differently than other schemes because they | 109 // Pseudo schemes are treated differently than other schemes because they |
107 // cannot be requested like normal URLs. There is no mechanism for revoking | 110 // cannot be requested like normal URLs. There is no mechanism for revoking |
108 // pseudo schemes. | 111 // pseudo schemes. |
109 void RegisterPseudoScheme(const std::string& scheme); | 112 void RegisterPseudoScheme(const std::string& scheme); |
110 | 113 |
111 // Returns true iff |scheme| has been registered as pseudo scheme. | 114 // Returns true iff |scheme| has been registered as pseudo scheme. |
112 bool IsPseudoScheme(const std::string& scheme); | 115 bool IsPseudoScheme(const std::string& scheme); |
(...skipping 127 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
240 const storage::FileSystemURL& filesystem_url, | 243 const storage::FileSystemURL& filesystem_url, |
241 int permissions); | 244 int permissions); |
242 | 245 |
243 // Determines if certain permissions were granted for a file system. | 246 // Determines if certain permissions were granted for a file system. |
244 // |permissions| is an internally defined bit-set. | 247 // |permissions| is an internally defined bit-set. |
245 bool HasPermissionsForFileSystem( | 248 bool HasPermissionsForFileSystem( |
246 int child_id, | 249 int child_id, |
247 const std::string& filesystem_id, | 250 const std::string& filesystem_id, |
248 int permission); | 251 int permission); |
249 | 252 |
250 // Validate that |child_id| in |file_system_context| is allowed to access | |
251 // data in the POST body specified by |body|. Can be called on any thread. | |
252 bool CanReadRequestBody(int child_id, | |
253 const storage::FileSystemContext* file_system_context, | |
254 const scoped_refptr<ResourceRequestBodyImpl>& body); | |
255 | |
256 // You must acquire this lock before reading or writing any members of this | 253 // You must acquire this lock before reading or writing any members of this |
257 // class. You must not block while holding this lock. | 254 // class. You must not block while holding this lock. |
258 base::Lock lock_; | 255 base::Lock lock_; |
259 | 256 |
260 // These schemes are white-listed for all child processes in various contexts. | 257 // These schemes are white-listed for all child processes in various contexts. |
261 // These sets are protected by |lock_|. | 258 // These sets are protected by |lock_|. |
262 SchemeSet schemes_okay_to_commit_in_any_process_; | 259 SchemeSet schemes_okay_to_commit_in_any_process_; |
263 SchemeSet schemes_okay_to_request_in_any_process_; | 260 SchemeSet schemes_okay_to_request_in_any_process_; |
264 SchemeSet schemes_okay_to_appear_as_origin_headers_; | 261 SchemeSet schemes_okay_to_appear_as_origin_headers_; |
265 | 262 |
(...skipping 13 matching lines...) Expand all Loading... |
279 WorkerToMainProcessMap worker_map_; | 276 WorkerToMainProcessMap worker_map_; |
280 | 277 |
281 FileSystemPermissionPolicyMap file_system_policy_map_; | 278 FileSystemPermissionPolicyMap file_system_policy_map_; |
282 | 279 |
283 DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicyImpl); | 280 DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicyImpl); |
284 }; | 281 }; |
285 | 282 |
286 } // namespace content | 283 } // namespace content |
287 | 284 |
288 #endif // CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ | 285 #endif // CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ |
OLD | NEW |