| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/renderer/extensions/resource_request_policy.h" | 5 #include "chrome/renderer/extensions/resource_request_policy.h" |
| 6 | 6 |
| 7 #include "base/logging.h" | 7 #include "base/logging.h" |
| 8 #include "base/strings/stringprintf.h" | 8 #include "base/strings/stringprintf.h" |
| 9 #include "chrome/common/extensions/manifest_url_handler.h" | 9 #include "chrome/common/extensions/manifest_url_handler.h" |
| 10 #include "chrome/common/url_constants.h" | 10 #include "chrome/common/url_constants.h" |
| 11 #include "content/public/common/page_transition_types.h" | |
| 12 #include "extensions/common/constants.h" | 11 #include "extensions/common/constants.h" |
| 13 #include "extensions/common/extension.h" | 12 #include "extensions/common/extension.h" |
| 14 #include "extensions/common/extension_set.h" | 13 #include "extensions/common/extension_set.h" |
| 15 #include "extensions/common/manifest_handlers/icons_handler.h" | 14 #include "extensions/common/manifest_handlers/icons_handler.h" |
| 16 #include "extensions/common/manifest_handlers/web_accessible_resources_info.h" | 15 #include "extensions/common/manifest_handlers/web_accessible_resources_info.h" |
| 17 #include "third_party/WebKit/public/platform/WebString.h" | 16 #include "third_party/WebKit/public/platform/WebString.h" |
| 18 #include "third_party/WebKit/public/web/WebConsoleMessage.h" | 17 #include "third_party/WebKit/public/web/WebConsoleMessage.h" |
| 19 #include "third_party/WebKit/public/web/WebDocument.h" | 18 #include "third_party/WebKit/public/web/WebDocument.h" |
| 20 #include "third_party/WebKit/public/web/WebFrame.h" | 19 #include "third_party/WebKit/public/web/WebFrame.h" |
| 20 #include "ui/base/page_transition_types.h" |
| 21 #include "url/gurl.h" | 21 #include "url/gurl.h" |
| 22 | 22 |
| 23 namespace extensions { | 23 namespace extensions { |
| 24 | 24 |
| 25 // This method does a security check whether chrome-extension:// URLs can be | 25 // This method does a security check whether chrome-extension:// URLs can be |
| 26 // requested by the renderer. Since this is in an untrusted process, the browser | 26 // requested by the renderer. Since this is in an untrusted process, the browser |
| 27 // has a similar check to enforce the policy, in case this process is exploited. | 27 // has a similar check to enforce the policy, in case this process is exploited. |
| 28 // If you are changing this function, ensure equivalent checks are added to | 28 // If you are changing this function, ensure equivalent checks are added to |
| 29 // extension_protocols.cc's AllowExtensionResourceLoad. | 29 // extension_protocols.cc's AllowExtensionResourceLoad. |
| 30 | 30 |
| 31 // static | 31 // static |
| 32 bool ResourceRequestPolicy::CanRequestResource( | 32 bool ResourceRequestPolicy::CanRequestResource( |
| 33 const GURL& resource_url, | 33 const GURL& resource_url, |
| 34 blink::WebFrame* frame, | 34 blink::WebFrame* frame, |
| 35 content::PageTransition transition_type, | 35 ui::PageTransition transition_type, |
| 36 const ExtensionSet* loaded_extensions) { | 36 const ExtensionSet* loaded_extensions) { |
| 37 CHECK(resource_url.SchemeIs(extensions::kExtensionScheme)); | 37 CHECK(resource_url.SchemeIs(extensions::kExtensionScheme)); |
| 38 | 38 |
| 39 const Extension* extension = | 39 const Extension* extension = |
| 40 loaded_extensions->GetExtensionOrAppByURL(resource_url); | 40 loaded_extensions->GetExtensionOrAppByURL(resource_url); |
| 41 if (!extension) { | 41 if (!extension) { |
| 42 // Allow the load in the case of a non-existent extension. We'll just get a | 42 // Allow the load in the case of a non-existent extension. We'll just get a |
| 43 // 404 from the browser process. | 43 // 404 from the browser process. |
| 44 return true; | 44 return true; |
| 45 } | 45 } |
| (...skipping 25 matching lines...) Expand all Loading... |
| 71 bool is_empty_origin = frame_url.is_empty(); | 71 bool is_empty_origin = frame_url.is_empty(); |
| 72 // - extensions requesting their own resources (frame_url check is for | 72 // - extensions requesting their own resources (frame_url check is for |
| 73 // images, page_url check is for iframes) | 73 // images, page_url check is for iframes) |
| 74 bool is_own_resource = frame_url.GetOrigin() == extension->url() || | 74 bool is_own_resource = frame_url.GetOrigin() == extension->url() || |
| 75 page_url.GetOrigin() == extension->url(); | 75 page_url.GetOrigin() == extension->url(); |
| 76 // - devtools (chrome-extension:// URLs are loaded into frames of devtools | 76 // - devtools (chrome-extension:// URLs are loaded into frames of devtools |
| 77 // to support the devtools extension APIs) | 77 // to support the devtools extension APIs) |
| 78 bool is_dev_tools = page_url.SchemeIs(content::kChromeDevToolsScheme) && | 78 bool is_dev_tools = page_url.SchemeIs(content::kChromeDevToolsScheme) && |
| 79 !ManifestURL::GetDevToolsPage(extension).is_empty(); | 79 !ManifestURL::GetDevToolsPage(extension).is_empty(); |
| 80 bool transition_allowed = | 80 bool transition_allowed = |
| 81 !content::PageTransitionIsWebTriggerable(transition_type); | 81 !ui::PageTransitionIsWebTriggerable(transition_type); |
| 82 // - unreachable web page error page (to allow showing the icon of the | 82 // - unreachable web page error page (to allow showing the icon of the |
| 83 // unreachable app on this page) | 83 // unreachable app on this page) |
| 84 bool is_error_page = frame_url == GURL(content::kUnreachableWebDataURL); | 84 bool is_error_page = frame_url == GURL(content::kUnreachableWebDataURL); |
| 85 | 85 |
| 86 if (!is_empty_origin && !is_own_resource && | 86 if (!is_empty_origin && !is_own_resource && |
| 87 !is_dev_tools && !transition_allowed && !is_error_page) { | 87 !is_dev_tools && !transition_allowed && !is_error_page) { |
| 88 std::string message = base::StringPrintf( | 88 std::string message = base::StringPrintf( |
| 89 "Denying load of %s. Resources must be listed in the " | 89 "Denying load of %s. Resources must be listed in the " |
| 90 "web_accessible_resources manifest key in order to be loaded by " | 90 "web_accessible_resources manifest key in order to be loaded by " |
| 91 "pages outside the extension.", | 91 "pages outside the extension.", |
| (...skipping 27 matching lines...) Expand all Loading... |
| 119 return false; | 119 return false; |
| 120 } | 120 } |
| 121 | 121 |
| 122 return true; | 122 return true; |
| 123 } | 123 } |
| 124 | 124 |
| 125 ResourceRequestPolicy::ResourceRequestPolicy() { | 125 ResourceRequestPolicy::ResourceRequestPolicy() { |
| 126 } | 126 } |
| 127 | 127 |
| 128 } // namespace extensions | 128 } // namespace extensions |
| OLD | NEW |