| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/renderer/extensions/resource_request_policy.h" | 5 #include "chrome/renderer/extensions/resource_request_policy.h" |
| 6 | 6 |
| 7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
| 8 #include "base/logging.h" | 8 #include "base/logging.h" |
| 9 #include "base/strings/stringprintf.h" | 9 #include "base/strings/stringprintf.h" |
| 10 #include "chrome/common/chrome_switches.h" | 10 #include "chrome/common/chrome_switches.h" |
| (...skipping 15 matching lines...) Expand all Loading... |
| 26 | 26 |
| 27 // This method does a security check whether chrome-extension:// URLs can be | 27 // This method does a security check whether chrome-extension:// URLs can be |
| 28 // requested by the renderer. Since this is in an untrusted process, the browser | 28 // requested by the renderer. Since this is in an untrusted process, the browser |
| 29 // has a similar check to enforce the policy, in case this process is exploited. | 29 // has a similar check to enforce the policy, in case this process is exploited. |
| 30 // If you are changing this function, ensure equivalent checks are added to | 30 // If you are changing this function, ensure equivalent checks are added to |
| 31 // extension_protocols.cc's AllowExtensionResourceLoad. | 31 // extension_protocols.cc's AllowExtensionResourceLoad. |
| 32 | 32 |
| 33 // static | 33 // static |
| 34 bool ResourceRequestPolicy::CanRequestResource( | 34 bool ResourceRequestPolicy::CanRequestResource( |
| 35 const GURL& resource_url, | 35 const GURL& resource_url, |
| 36 WebKit::WebFrame* frame, | 36 blink::WebFrame* frame, |
| 37 content::PageTransition transition_type, | 37 content::PageTransition transition_type, |
| 38 const ExtensionSet* loaded_extensions) { | 38 const ExtensionSet* loaded_extensions) { |
| 39 CHECK(resource_url.SchemeIs(extensions::kExtensionScheme)); | 39 CHECK(resource_url.SchemeIs(extensions::kExtensionScheme)); |
| 40 | 40 |
| 41 const Extension* extension = | 41 const Extension* extension = |
| 42 loaded_extensions->GetExtensionOrAppByURL(resource_url); | 42 loaded_extensions->GetExtensionOrAppByURL(resource_url); |
| 43 if (!extension) { | 43 if (!extension) { |
| 44 // Allow the load in the case of a non-existent extension. We'll just get a | 44 // Allow the load in the case of a non-existent extension. We'll just get a |
| 45 // 404 from the browser process. | 45 // 404 from the browser process. |
| 46 return true; | 46 return true; |
| (...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 88 bool is_error_page = frame_url == GURL(content::kUnreachableWebDataURL); | 88 bool is_error_page = frame_url == GURL(content::kUnreachableWebDataURL); |
| 89 | 89 |
| 90 if (!is_empty_origin && !is_own_resource && | 90 if (!is_empty_origin && !is_own_resource && |
| 91 !is_dev_tools && !transition_allowed && !is_error_page) { | 91 !is_dev_tools && !transition_allowed && !is_error_page) { |
| 92 std::string message = base::StringPrintf( | 92 std::string message = base::StringPrintf( |
| 93 "Denying load of %s. Resources must be listed in the " | 93 "Denying load of %s. Resources must be listed in the " |
| 94 "web_accessible_resources manifest key in order to be loaded by " | 94 "web_accessible_resources manifest key in order to be loaded by " |
| 95 "pages outside the extension.", | 95 "pages outside the extension.", |
| 96 resource_url.spec().c_str()); | 96 resource_url.spec().c_str()); |
| 97 frame->addMessageToConsole( | 97 frame->addMessageToConsole( |
| 98 WebKit::WebConsoleMessage(WebKit::WebConsoleMessage::LevelError, | 98 blink::WebConsoleMessage(blink::WebConsoleMessage::LevelError, |
| 99 WebKit::WebString::fromUTF8(message))); | 99 blink::WebString::fromUTF8(message))); |
| 100 return false; | 100 return false; |
| 101 } | 101 } |
| 102 } | 102 } |
| 103 | 103 |
| 104 return true; | 104 return true; |
| 105 } | 105 } |
| 106 | 106 |
| 107 // static | 107 // static |
| 108 bool ResourceRequestPolicy::CanRequestExtensionResourceScheme( | 108 bool ResourceRequestPolicy::CanRequestExtensionResourceScheme( |
| 109 const GURL& resource_url, | 109 const GURL& resource_url, |
| 110 WebKit::WebFrame* frame) { | 110 blink::WebFrame* frame) { |
| 111 CHECK(resource_url.SchemeIs(chrome::kExtensionResourceScheme)); | 111 CHECK(resource_url.SchemeIs(chrome::kExtensionResourceScheme)); |
| 112 | 112 |
| 113 GURL frame_url = frame->document().url(); | 113 GURL frame_url = frame->document().url(); |
| 114 if (!frame_url.is_empty() && | 114 if (!frame_url.is_empty() && |
| 115 !frame_url.SchemeIs(extensions::kExtensionScheme)) { | 115 !frame_url.SchemeIs(extensions::kExtensionScheme)) { |
| 116 std::string message = base::StringPrintf( | 116 std::string message = base::StringPrintf( |
| 117 "Denying load of %s. chrome-extension-resources:// can only be " | 117 "Denying load of %s. chrome-extension-resources:// can only be " |
| 118 "loaded from extensions.", | 118 "loaded from extensions.", |
| 119 resource_url.spec().c_str()); | 119 resource_url.spec().c_str()); |
| 120 frame->addMessageToConsole( | 120 frame->addMessageToConsole( |
| 121 WebKit::WebConsoleMessage(WebKit::WebConsoleMessage::LevelError, | 121 blink::WebConsoleMessage(blink::WebConsoleMessage::LevelError, |
| 122 WebKit::WebString::fromUTF8(message))); | 122 blink::WebString::fromUTF8(message))); |
| 123 return false; | 123 return false; |
| 124 } | 124 } |
| 125 | 125 |
| 126 return true; | 126 return true; |
| 127 } | 127 } |
| 128 | 128 |
| 129 ResourceRequestPolicy::ResourceRequestPolicy() { | 129 ResourceRequestPolicy::ResourceRequestPolicy() { |
| 130 } | 130 } |
| 131 | 131 |
| 132 } // namespace extensions | 132 } // namespace extensions |
| OLD | NEW |