Changes access policy for embedded nodes

mojo/services/view_manager/view_manager_service_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/services/view_manager/view_manager_service_impl.h"
 
 #include "base/bind.h"
 #include "mojo/services/public/cpp/geometry/geometry_type_converters.h"
 #include "mojo/services/public/cpp/input_events/input_events_type_converters.h"
 #include "mojo/services/view_manager/node.h"
 #include "mojo/services/view_manager/root_node_manager.h"
 #include "mojo/services/view_manager/view.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/aura/window.h"
 #include "ui/gfx/codec/png_codec.h"
 
 namespace mojo {
 namespace view_manager {
 namespace service {
-namespace {
-
-// Places |node| in |nodes| and recurses through the children.
-void GetDescendants(const Node* node, std::vector<const Node*>* nodes) {
-  if (!node)
-    return;
-
-  nodes->push_back(node);
-
-  std::vector<const Node*> children(node->GetChildren());
-  for (size_t i = 0 ; i < children.size(); ++i)
-    GetDescendants(children[i], nodes);
-}
-
-}  // namespace
 
 ViewManagerServiceImpl::ViewManagerServiceImpl(
     RootNodeManager* root_node_manager,
     ConnectionSpecificId creator_id,
     const std::string& creator_url,
     const std::string& url,
     const NodeId& root_id)
     : root_node_manager_(root_node_manager),
       id_(root_node_manager_->GetAndAdvanceNextConnectionId()),
       url_(url),
@@ skipping 189 matching lines @@
 }
 
 bool ViewManagerServiceImpl::CanRemoveNodeFromParent(const Node* node) const {
   if (!node)
     return false;
 
   const Node* parent = node->GetParent();
   if (!parent)
     return false;
 
-  // Always allow the remove if there are no roots. Otherwise the remove is
-  // allowed if the parent is a descendant of the roots, or the node and its
-  // parent were created by this connection. We explicitly disallow removal of
-  // the node from its parent if the parent isn't visible to this connection
-  // (not in roots).
-  return (roots_.empty() ||
-          (IsNodeDescendantOfRoots(parent) ||
-           (node->id().connection_id == id_ &&
-            parent->id().connection_id == id_)));
+  if (roots_.empty())
+    return true;  // Root can do anything.
+
+  if (node->id().connection_id != id_)
+    return false;  // Can only unparent nodes we created.
+
+  if (roots_.count(NodeIdToTransportId(parent->id())) > 0)
+    return true;  // We can always remove from one of our roots.
+
+  // Don't allow removing from nodes from other connections that aren't in our
+  // root list.
+  if (parent->id().connection_id != id_)
+    return false;
+
+  // Allow the remove as long as we haven't embedded another node at |parent|.
+  ViewManagerServiceImpl* connection =
+      root_node_manager_->GetConnectionWithRoot(parent->id());
+  return !connection || connection == this;
 }
 
 bool ViewManagerServiceImpl::CanAddNode(const Node* parent,
                                         const Node* child) const {
   if (!parent || !child)
     return false;  // Both nodes must be valid.
 
   if (child->GetParent() == parent || child->Contains(parent))
     return false;  // Would result in an invalid hierarchy.
 
   if (roots_.empty())
     return true;  // No restriction if there are no roots.
 
+  if (child->id().connection_id != id_)
+    return false;  // Can't move children from different connections.
+
   if (!IsNodeDescendantOfRoots(parent) && parent->id().connection_id != id_)
     return false;  // |parent| is not visible to this connection.
 
-  // Allow the add if the child is already a descendant of the roots or was
-  // created by this connection.
-  return (IsNodeDescendantOfRoots(child) || child->id().connection_id == id_);
+  // Only allow the add if we haven't given one of the ancestors of |parent| to
+  // another node. That is, Embed() hasn't been invoked with one of our nodes.
+  return !IsNodeEmbeddedInAnotherConnection(parent);
 }
 
 bool ViewManagerServiceImpl::CanReorderNode(const Node* node,
                                             const Node* relative_node,
                                             OrderDirection direction) const {
   if (!node || !relative_node)
     return false;
 
   if (node->id().connection_id != id_)
     return false;
@@ skipping 35 matching lines @@
   const View* view = GetView(view_id);
   return (view && view_id.connection_id == id_) || view_id == ViewId();
 }
 
 bool ViewManagerServiceImpl::CanSetFocus(const Node* node) const {
   // TODO(beng): security.
   return true;
 }
 
 bool ViewManagerServiceImpl::CanGetNodeTree(const Node* node) const {
-  return node &&
-      (IsNodeDescendantOfRoots(node) || node->id().connection_id == id_);
+  if (!node)
+    return false;
+
+  if (roots_.empty())
+    return true;
+
+  if (node->id().connection_id == id_)
+    return true;
+
+  return roots_.count(NodeIdToTransportId(node->id())) > 0;
 }
 
 bool ViewManagerServiceImpl::CanEmbed(Id transport_node_id) const {
   const Node* node = GetNode(NodeIdFromTransportId(transport_node_id));
   return node && node->id().connection_id == id_;
 }
 
 bool ViewManagerServiceImpl::CanSetNodeVisibility(const Node* node,
                                                   bool visibile) const {
   return node &&
       (node->id().connection_id == id_ ||
        roots_.find(NodeIdToTransportId(node->id())) != roots_.end()) &&
       node->IsVisible() != visibile;
 }
 
+bool ViewManagerServiceImpl::CanDescendIntoNodeForNodeTree(
+    const Node* node) const {
+  if (roots_.empty())
+    return true;
+
+  ViewManagerServiceImpl* connection =
+      root_node_manager_->GetConnectionWithRoot(node->id());
+  return !connection || connection == this;
+}
+
 bool ViewManagerServiceImpl::DeleteNodeImpl(ViewManagerServiceImpl* source,
                                             const NodeId& node_id) {
   DCHECK_EQ(node_id.connection_id, id_);
   Node* node = GetNode(node_id);
   if (!node)
     return false;
   RootNodeManager::ScopedChange change(source, root_node_manager_, true);
   delete node;
   return true;
 }
@@ skipping 43 matching lines @@
     if (local_nodes)
       local_nodes->push_back(GetNode(node->id()));
     return;
   }
   known_nodes_.erase(NodeIdToTransportId(node->id()));
   std::vector<const Node*> children = node->GetChildren();
   for (size_t i = 0; i < children.size(); ++i)
     RemoveFromKnown(children[i], local_nodes);
 }
 
+bool ViewManagerServiceImpl::IsNodeEmbeddedInAnotherConnection(
+    const Node* node) const {
+  while (node) {
+    const ViewManagerServiceImpl* connection =
+        root_node_manager_->GetConnectionWithRoot(node->id());
+    if (connection)
+      return connection != this;
+    node = node->GetParent();
+  }
+  return false;
+}
+
 void ViewManagerServiceImpl::AddRoot(const NodeId& node_id) {
   const Id transport_node_id(NodeIdToTransportId(node_id));
   CHECK(roots_.count(transport_node_id) == 0);
 
   std::vector<const Node*> to_send;
   CHECK_EQ(creator_id_, node_id.connection_id);
   roots_.insert(transport_node_id);
   Node* node = GetNode(node_id);
   CHECK(node);
   if (known_nodes_.count(transport_node_id) == 0) {
@@ skipping 24 matching lines @@
   root_node_manager_->OnConnectionMessagedClient(id_);
 
   // This connection no longer knows about the node. Unparent any nodes that
   // were parented to nodes in the root.
   std::vector<Node*> local_nodes;
   RemoveFromKnown(GetNode(node_id), &local_nodes);
   for (size_t i = 0; i < local_nodes.size(); ++i)
     local_nodes[i]->GetParent()->Remove(local_nodes[i]);
 }
 
+void ViewManagerServiceImpl::RemoveChildrenAsPartOfEmbed(
+    const NodeId& node_id) {
+  // Let the root do what it wants.
+  if (roots_.empty())
+    return;
+
+  Node* node = GetNode(node_id);
+  CHECK(node);
+  CHECK(node->id().connection_id == node_id.connection_id);
+  std::vector<Node*> children = node->GetChildren();
+  for (size_t i = 0; i < children.size(); ++i)
+    node->Remove(children[i]);
+}
+
 bool ViewManagerServiceImpl::IsNodeDescendantOfRoots(const Node* node) const {
   if (roots_.empty())
     return true;
   if (!node)
     return false;
-  const Id invalid_node_id =
-      NodeIdToTransportId(InvalidNodeId());
+  const Id invalid_node_id = NodeIdToTransportId(InvalidNodeId());
   for (NodeIdSet::const_iterator i = roots_.begin(); i != roots_.end(); ++i) {
     if (*i == invalid_node_id)
       continue;
     const Node* root = GetNode(NodeIdFromTransportId(*i));
     DCHECK(root);
     if (root->Contains(node))
       return true;
   }
   return false;
 }
@@ skipping 58 matching lines @@
     inode->parent_id = NodeIdToTransportId(parent ? parent->id() : NodeId());
     inode->node_id = NodeIdToTransportId(node->id());
     inode->view_id =
         ViewIdToTransportId(node->view() ? node->view()->id() : ViewId());
     inode->bounds = Rect::From(node->bounds());
     array[i] = inode.Pass();
   }
   return array.Pass();
 }
 
+void ViewManagerServiceImpl::GetNodeTreeImpl(
+    const Node* node,
+    std::vector<const Node*>* nodes) const {
+  DCHECK(node);
+
+  if (!CanGetNodeTree(node))
+    return;
+
+  nodes->push_back(node);
+
+  if (!CanDescendIntoNodeForNodeTree(node))
+    return;
+
+  std::vector<const Node*> children(node->GetChildren());
+  for (size_t i = 0 ; i < children.size(); ++i)
+    GetNodeTreeImpl(children[i], nodes);
+}
+
 void ViewManagerServiceImpl::CreateNode(
     Id transport_node_id,
     const Callback<void(ErrorCode)>& callback) {
   const NodeId node_id(NodeIdFromTransportId(transport_node_id));
   ErrorCode error_code = ERROR_CODE_NONE;
   if (node_id.connection_id != id_) {
     error_code = ERROR_CODE_ILLEGAL_ARGUMENT;
   } else if (node_map_.find(node_id.node_id) != node_map_.end()) {
     error_code = ERROR_CODE_VALUE_IN_USE;
   } else {
@@ skipping 59 matching lines @@
   }
   callback.Run(success);
 }
 
 void ViewManagerServiceImpl::GetNodeTree(
     Id node_id,
     const Callback<void(Array<NodeDataPtr>)>& callback) {
   Node* node = GetNode(NodeIdFromTransportId(node_id));
   std::vector<const Node*> nodes;
   if (CanGetNodeTree(node)) {
-    GetDescendants(node, &nodes);
+    GetNodeTreeImpl(node, &nodes);
+#if !defined(NDEBUG)
     for (size_t i = 0; i < nodes.size(); ++i)
-      known_nodes_.insert(NodeIdToTransportId(nodes[i]->id()));
+      DCHECK_GT(known_nodes_.count(NodeIdToTransportId(nodes[i]->id())), 0u);
+#endif
   }
   callback.Run(NodesToNodeDatas(nodes));
 }
 
 void ViewManagerServiceImpl::CreateView(
     Id transport_view_id,
     const Callback<void(bool)>& callback) {
   const ViewId view_id(ViewIdFromTransportId(transport_view_id));
   if (view_id.connection_id != id_ || view_map_.count(view_id.view_id)) {
     callback.Run(false);
@@ skipping 108 matching lines @@
     // Only allow a node to be the root for one connection.
     const NodeId node_id(NodeIdFromTransportId(transport_node_id));
     ViewManagerServiceImpl* connection_by_url =
         root_node_manager_->GetConnectionByCreator(id_, url.To<std::string>());
     ViewManagerServiceImpl* connection_with_node_as_root =
         root_node_manager_->GetConnectionWithRoot(node_id);
     if ((connection_by_url != connection_with_node_as_root ||
          (!connection_by_url && !connection_with_node_as_root)) &&
         (!connection_by_url || !connection_by_url->HasRoot(node_id))) {
       RootNodeManager::ScopedChange change(this, root_node_manager_, true);
+      RemoveChildrenAsPartOfEmbed(node_id);
       // Never message the originating connection.
       root_node_manager_->OnConnectionMessagedClient(id_);
       if (connection_with_node_as_root)
         connection_with_node_as_root->RemoveRoot(node_id);
       if (connection_by_url)
         connection_by_url->AddRoot(node_id);
       else
         root_node_manager_->Embed(id_, url, transport_node_id);
     } else {
       success = false;
@@ skipping 33 matching lines @@
 
   client()->OnViewManagerConnectionEstablished(
       id_,
       creator_url_,
       NodesToNodeDatas(to_send));
 }
 
 }  // namespace service
 }  // namespace view_manager
 }  // namespace mojo