Fix chrome upload with content uri

content/browser/child_process_security_policy_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/child_process_security_policy_impl.h"
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ skipping 117 matching lines @@
 
   bool HasPermissionsForFileSystem(const std::string& filesystem_id,
                                    int permissions) {
     FileSystemMap::const_iterator it =
         filesystem_permissions_.find(filesystem_id);
     if (it == filesystem_permissions_.end())
       return false;
     return (it->second & permissions) == permissions;
   }
 
+#if defined(OS_ANDROID)
+  // Grant certain permissions to a file.
+  void GrantPermissionsForContentUrl(const GURL& content_url,
+                                     int permissions) {
+    content_url_permissions_[content_url] |= permissions;
+  }
+
+  bool HasPermissionsForContentUrl(const GURL& content_url,
+                                   int permissions) {
+    if (content_url_permissions_.find(content_url) ==
+        content_url_permissions_.end()) {
+      return false;
+    }
+    return (content_url_permissions_[content_url] & permissions) ==
+        permissions;
+  }
+#endif
+
   void GrantBindings(int bindings) {
     enabled_bindings_ |= bindings;
   }
 
   void GrantReadRawCookies() {
     can_read_raw_cookies_ = true;
   }
 
   void RevokeReadRawCookies() {
     can_read_raw_cookies_ = false;
@@ skipping 103 matching lines @@
     return can_send_midi_sysex_;
   }
 
  private:
   typedef std::map<std::string, bool> SchemeMap;
 
   typedef int FilePermissionFlags;  // bit-set of PlatformFileFlags
   typedef std::map<base::FilePath, FilePermissionFlags> FileMap;
   typedef std::map<std::string, FilePermissionFlags> FileSystemMap;
   typedef std::set<base::FilePath> FileSet;
+#if defined(OS_ANDROID)
+  typedef std::map<GURL, FilePermissionFlags> ContentUrlMap;
+#endif
 
   // Maps URL schemes to whether permission has been granted or revoked:
   //   |true| means the scheme has been granted.
   //   |false| means the scheme has been revoked.
   // If a scheme is not present in the map, then it has never been granted
   // or revoked.
   SchemeMap scheme_policy_;
 
   // The set of files the child process is permited to upload to the web.
   FileMap file_permissions_;
 
   // The set of files the child process is permitted to load.
   FileSet request_file_set_;
 
   int enabled_bindings_;
 
   bool can_read_raw_cookies_;
 
   bool can_send_midi_sysex_;
 
   GURL origin_lock_;
 
   // The set of isolated filesystems the child process is permitted to access.
   FileSystemMap filesystem_permissions_;
 
+#if defined(OS_ANDROID)
+  // The set of content urls the child process is permited to upload to the web.
+  ContentUrlMap content_url_permissions_;
+#endif
+
   DISALLOW_COPY_AND_ASSIGN(SecurityState);
 };
 
 ChildProcessSecurityPolicyImpl::ChildProcessSecurityPolicyImpl() {
   // We know about these schemes and believe them to be safe.
   RegisterWebSafeScheme(kHttpScheme);
   RegisterWebSafeScheme(kHttpsScheme);
   RegisterWebSafeScheme(chrome::kFtpScheme);
   RegisterWebSafeScheme(chrome::kDataScheme);
   RegisterWebSafeScheme("feed");
@@ skipping 340 matching lines @@
   return HasPermissionsForFileSystem(child_id, filesystem_id,
                                      COPY_INTO_FILE_GRANT);
 }
 
 bool ChildProcessSecurityPolicyImpl::CanDeleteFromFileSystem(
     int child_id, const std::string& filesystem_id) {
   return HasPermissionsForFileSystem(child_id, filesystem_id,
                                      DELETE_FILE_GRANT);
 }
 
+#if defined(OS_ANDROID)
+void ChildProcessSecurityPolicyImpl::GrantReadContentUrl(
+    int child_id, const GURL& content_url) {
+  GrantPermissionsForContentUrl(child_id, content_url, READ_FILE_GRANT);
+}
+
+bool ChildProcessSecurityPolicyImpl::CanReadContentUrl(
+    int child_id, const GURL& content_url) {
+  if (!content_url.SchemeIsContent())
+    return false;
+  base::AutoLock lock(lock_);
+  bool result = ChildProcessHasPermissionsForContentUrl(
+      child_id, content_url, READ_FILE_GRANT);
+  if (!result) {
+    WorkerToMainProcessMap::iterator iter = worker_map_.find(child_id);
+    if (iter != worker_map_.end() && iter->second != 0) {
+      result = ChildProcessHasPermissionsForContentUrl(iter->second,
+                                                       content_url,
+                                                       READ_FILE_GRANT);
+    }
+  }
+  return result;
+}
+
+void ChildProcessSecurityPolicyImpl::GrantPermissionsForContentUrl(
+    int child_id, const GURL& content_url, int permissions) {
+  base::AutoLock lock(lock_);
+
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  if (state == security_state_.end())
+    return;
+  state->second->GrantPermissionsForContentUrl(content_url, READ_FILE_GRANT);
+}
+
+bool ChildProcessSecurityPolicyImpl::ChildProcessHasPermissionsForContentUrl(
+    int child_id, const GURL& content_url, int permissions) {
+  SecurityStateMap::iterator state = security_state_.find(child_id);
+  if (state == security_state_.end())
+    return false;
+  return state->second->HasPermissionsForContentUrl(content_url, permissions);
+}
+#endif
+
 bool ChildProcessSecurityPolicyImpl::HasPermissionsForFile(
     int child_id, const base::FilePath& file, int permissions) {
   base::AutoLock lock(lock_);
   bool result = ChildProcessHasPermissionsForFile(child_id, file, permissions);
   if (!result) {
     // If this is a worker thread that has no access to a given file,
     // let's check that its renderer process has access to that file instead.
     WorkerToMainProcessMap::iterator iter = worker_map_.find(child_id);
     if (iter != worker_map_.end() && iter->second != 0) {
       result = ChildProcessHasPermissionsForFile(iter->second,
@@ skipping 193 matching lines @@
   base::AutoLock lock(lock_);
 
   SecurityStateMap::iterator state = security_state_.find(child_id);
   if (state == security_state_.end())
     return false;
 
   return state->second->can_send_midi_sysex();
 }
 
 }  // namespace content