| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ | 5 #ifndef CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ |
| 6 #define CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ | 6 #define CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ |
| 7 | 7 |
| 8 #include <map> | 8 #include <map> |
| 9 #include <memory> | 9 #include <memory> |
| 10 #include <set> | 10 #include <set> |
| (...skipping 76 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 87 const std::string& filesystem_id) override; | 87 const std::string& filesystem_id) override; |
| 88 bool HasWebUIBindings(int child_id) override; | 88 bool HasWebUIBindings(int child_id) override; |
| 89 void GrantSendMidiSysExMessage(int child_id) override; | 89 void GrantSendMidiSysExMessage(int child_id) override; |
| 90 bool CanAccessDataForOrigin(int child_id, const GURL& url) override; | 90 bool CanAccessDataForOrigin(int child_id, const GURL& url) override; |
| 91 bool HasSpecificPermissionForOrigin(int child_id, | 91 bool HasSpecificPermissionForOrigin(int child_id, |
| 92 const url::Origin& origin) override; | 92 const url::Origin& origin) override; |
| 93 | 93 |
| 94 // Returns if |child_id| can read all of the |files|. | 94 // Returns if |child_id| can read all of the |files|. |
| 95 bool CanReadAllFiles(int child_id, const std::vector<base::FilePath>& files); | 95 bool CanReadAllFiles(int child_id, const std::vector<base::FilePath>& files); |
| 96 | 96 |
| 97 // Validate that |child_id| in |file_system_context| is allowed to access |
| 98 // data in the POST body specified by |body|. Can be called on any thread. |
| 99 bool CanReadRequestBody(int child_id, |
| 100 const storage::FileSystemContext* file_system_context, |
| 101 const scoped_refptr<ResourceRequestBodyImpl>& body); |
| 102 |
| 97 // Validate that the renderer process for |site_instance| is allowed to access | 103 // Validate that the renderer process for |site_instance| is allowed to access |
| 98 // data in the POST body specified by |body|. Has to be called on the UI | 104 // data in the POST body specified by |body|. Has to be called on the UI |
| 99 // thread. | 105 // thread. |
| 100 // TODO(lukasza): Remove code duplication - the method below should be reused | |
| 101 // by RenderFrameHostImpl::OnBeginNavigation and | |
| 102 // ResourceDispatcherHostImpl::ShouldServiceRequest. | |
| 103 bool CanReadRequestBody(SiteInstance* site_instance, | 106 bool CanReadRequestBody(SiteInstance* site_instance, |
| 104 const scoped_refptr<ResourceRequestBodyImpl>& body); | 107 const scoped_refptr<ResourceRequestBodyImpl>& body); |
| 105 | 108 |
| 106 // Pseudo schemes are treated differently than other schemes because they | 109 // Pseudo schemes are treated differently than other schemes because they |
| 107 // cannot be requested like normal URLs. There is no mechanism for revoking | 110 // cannot be requested like normal URLs. There is no mechanism for revoking |
| 108 // pseudo schemes. | 111 // pseudo schemes. |
| 109 void RegisterPseudoScheme(const std::string& scheme); | 112 void RegisterPseudoScheme(const std::string& scheme); |
| 110 | 113 |
| 111 // Returns true iff |scheme| has been registered as pseudo scheme. | 114 // Returns true iff |scheme| has been registered as pseudo scheme. |
| 112 bool IsPseudoScheme(const std::string& scheme); | 115 bool IsPseudoScheme(const std::string& scheme); |
| (...skipping 127 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 240 const storage::FileSystemURL& filesystem_url, | 243 const storage::FileSystemURL& filesystem_url, |
| 241 int permissions); | 244 int permissions); |
| 242 | 245 |
| 243 // Determines if certain permissions were granted for a file system. | 246 // Determines if certain permissions were granted for a file system. |
| 244 // |permissions| is an internally defined bit-set. | 247 // |permissions| is an internally defined bit-set. |
| 245 bool HasPermissionsForFileSystem( | 248 bool HasPermissionsForFileSystem( |
| 246 int child_id, | 249 int child_id, |
| 247 const std::string& filesystem_id, | 250 const std::string& filesystem_id, |
| 248 int permission); | 251 int permission); |
| 249 | 252 |
| 250 // Validate that |child_id| in |file_system_context| is allowed to access | |
| 251 // data in the POST body specified by |body|. Can be called on any thread. | |
| 252 bool CanReadRequestBody(int child_id, | |
| 253 const storage::FileSystemContext* file_system_context, | |
| 254 const scoped_refptr<ResourceRequestBodyImpl>& body); | |
| 255 | |
| 256 // You must acquire this lock before reading or writing any members of this | 253 // You must acquire this lock before reading or writing any members of this |
| 257 // class. You must not block while holding this lock. | 254 // class. You must not block while holding this lock. |
| 258 base::Lock lock_; | 255 base::Lock lock_; |
| 259 | 256 |
| 260 // These schemes are white-listed for all child processes in various contexts. | 257 // These schemes are white-listed for all child processes in various contexts. |
| 261 // These sets are protected by |lock_|. | 258 // These sets are protected by |lock_|. |
| 262 SchemeSet schemes_okay_to_commit_in_any_process_; | 259 SchemeSet schemes_okay_to_commit_in_any_process_; |
| 263 SchemeSet schemes_okay_to_request_in_any_process_; | 260 SchemeSet schemes_okay_to_request_in_any_process_; |
| 264 SchemeSet schemes_okay_to_appear_as_origin_headers_; | 261 SchemeSet schemes_okay_to_appear_as_origin_headers_; |
| 265 | 262 |
| (...skipping 13 matching lines...) Expand all Loading... |
| 279 WorkerToMainProcessMap worker_map_; | 276 WorkerToMainProcessMap worker_map_; |
| 280 | 277 |
| 281 FileSystemPermissionPolicyMap file_system_policy_map_; | 278 FileSystemPermissionPolicyMap file_system_policy_map_; |
| 282 | 279 |
| 283 DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicyImpl); | 280 DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicyImpl); |
| 284 }; | 281 }; |
| 285 | 282 |
| 286 } // namespace content | 283 } // namespace content |
| 287 | 284 |
| 288 #endif // CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ | 285 #endif // CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_ |
| OLD | NEW |