Allow extension APIs to be called from WebUI.

extensions/browser/event_router.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/event_router.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/message_loop/message_loop.h"
 #include "base/stl_util.h"
 #include "base/values.h"
 #include "chrome/browser/chrome_notification_types.h"
+#include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_process_host.h"
 #include "extensions/browser/api_activity_monitor.h"
 #include "extensions/browser/extension_host.h"
 #include "extensions/browser/extension_prefs.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/browser/extension_util.h"
 #include "extensions/browser/extensions_browser_client.h"
 #include "extensions/browser/lazy_background_task_queue.h"
@@ skipping 480 matching lines @@
             incognito_context, extension, event)) {
       already_dispatched->insert(
           std::make_pair(incognito_context, extension_id));
     }
   }
 }
 
 void EventRouter::DispatchEventToProcess(const std::string& extension_id,
                                          content::RenderProcessHost* process,
                                          const linked_ptr<Event>& event) {
+  BrowserContext* listener_context = process->GetBrowserContext();
+  ProcessMap* process_map = ProcessMap::Get(listener_context);
+
   const Extension* extension =
       ExtensionRegistry::Get(browser_context_)->enabled_extensions().GetByID(
           extension_id);
+  // NOTE: |extension| being NULL does not necessarily imply that this event
+  // shouldn't be dispatched. Events can be dispatched to WebUI as well.
 
-  // The extension could have been removed, but we do not unregister it until
-  // the extension process is unloaded.
-  if (!extension)
-    return;
-
-  BrowserContext* listener_context = process->GetBrowserContext();
-  ProcessMap* process_map = ProcessMap::Get(listener_context);
-  // If the event is privileged, only send to extension processes. Otherwise,
-  // it's OK to send to normal renderers (e.g., for content scripts).
-  if (!process_map->Contains(extension->id(), process->GetID()) &&
-      !ExtensionAPI::GetSharedInstance()->IsAvailableInUntrustedContext(
-          event->event_name, extension)) {
+  if (!extension && !extension_id.empty()) {
+    // Trying to dispatch an event to an extension that doesn't exist. The
+    // extension could have been removed, but we do not unregister it until the
+    // extension process is unloaded.
     return;
   }
 
-  // If the event is restricted to a URL, only dispatch if the extension has
-  // permission for it (or if the event originated from itself).
-  if (!event->event_url.is_empty() &&
-      event->event_url.host() != extension->id() &&
-      !extension->permissions_data()
-           ->active_permissions()
-           ->HasEffectiveAccessToURL(event->event_url)) {
+  if (extension) {
+    // Dispatching event to an extension.
+    // If the event is privileged, only send to extension processes. Otherwise,
+    // it's OK to send to normal renderers (e.g., for content scripts).
+    if (!process_map->Contains(extension->id(), process->GetID()) &&
+        !ExtensionAPI::GetSharedInstance()->IsAvailableInUntrustedContext(
+            event->event_name, extension)) {
+      return;
+    }
+
+    // If the event is restricted to a URL, only dispatch if the extension has
+    // permission for it (or if the event originated from itself).
+    if (!event->event_url.is_empty() &&
+        event->event_url.host() != extension->id() &&
+        !extension->permissions_data()
+             ->active_permissions()
+             ->HasEffectiveAccessToURL(event->event_url)) {
+      return;
+    }
+
+    if (!CanDispatchEventToBrowserContext(listener_context, extension, event)) {
+      return;
+    }
+  } else if (content::ChildProcessSecurityPolicy::GetInstance()
+                 ->HasWebUIBindings(process->GetID())) {
+    // Dispatching event to WebUI.
+    if (!ExtensionAPI::GetSharedInstance()->IsAvailableToWebUI(

[Charlie Reis, 2014/07/22 21:10:24]

Good, I'm glad we have a whitelist of available APIs.

+            event->event_name)) {
+      return;
+    }
+  } else {
+    // Dispatching event to a webpage - however, all such events (e.g.
+    // messaging) don't go through EventRouter so this should be impossible.

[Charlie Reis, 2014/07/22 21:10:24]

"should be impossible:" Should this be a NOTREACHED (debug-only) or CHECK (all
builds) so that we notice if it's happening?

[not at google - send to devlin, 2014/07/22 23:42:32]

NOTREACHED sgtm.

     return;
   }
 
-  if (!CanDispatchEventToBrowserContext(listener_context, extension, event))
-    return;
-
   if (!event->will_dispatch_callback.is_null()) {
-    event->will_dispatch_callback.Run(listener_context, extension,
-                                      event->event_args.get());
+    event->will_dispatch_callback.Run(
+        listener_context, extension, event->event_args.get());
   }
 
-  DispatchExtensionMessage(process, listener_context, extension->id(),
-                           event->event_name, event->event_args.get(),
-                           event->user_gesture, event->filter_info);
-  IncrementInFlightEvents(listener_context, extension);
+  DispatchExtensionMessage(process,
+                           listener_context,
+                           extension_id,
+                           event->event_name,
+                           event->event_args.get(),
+                           event->user_gesture,
+                           event->filter_info);
+
+  if (extension)
+    IncrementInFlightEvents(listener_context, extension);
 }
 
 bool EventRouter::CanDispatchEventToBrowserContext(
     BrowserContext* context,
     const Extension* extension,
     const linked_ptr<Event>& event) {
   // Is this event from a different browser context than the renderer (ie, an
   // incognito tab event sent to a normal process, or vice versa).
   bool cross_incognito = event->restrict_to_browser_context &&
                          context != event->restrict_to_browser_context;
@@ skipping 205 matching lines @@
 }
 
 EventListenerInfo::EventListenerInfo(const std::string& event_name,
                                      const std::string& extension_id,
                                      content::BrowserContext* browser_context)
     : event_name(event_name),
       extension_id(extension_id),
       browser_context(browser_context) {}
 
 }  // namespace extensions