Enable messaging over a navigator.connect initiated channel.

content/browser/navigator_connect/navigator_connect_dispatcher_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/navigator_connect/navigator_connect_dispatcher_host.h"
 
 #include "content/browser/message_port_service.h"
+#include "content/browser/navigator_connect/navigator_connect_context.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/common/navigator_connect_messages.h"
 #include "content/common/navigator_connect_types.h"
 
 namespace content {
 
 NavigatorConnectDispatcherHost::NavigatorConnectDispatcherHost(
-    const scoped_refptr<ServiceWorkerContextWrapper>& service_worker_context)
+    const scoped_refptr<ServiceWorkerContextWrapper>& service_worker_context,
+    const scoped_refptr<NavigatorConnectContext>& navigator_connect_context)
     : BrowserMessageFilter(NavigatorConnectMsgStart),
-      service_worker_context_(service_worker_context) {
+      service_worker_context_(service_worker_context),
+      navigator_connect_context_(navigator_connect_context) {
 }
 
 NavigatorConnectDispatcherHost::~NavigatorConnectDispatcherHost() {
 }
 
 bool NavigatorConnectDispatcherHost::OnMessageReceived(
     const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(NavigatorConnectDispatcherHost, message)
     IPC_MESSAGE_HANDLER(NavigatorConnectHostMsg_Connect, OnConnect)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
 void NavigatorConnectDispatcherHost::OnConnect(
     int thread_id,
     int request_id,
     const CrossOriginServiceWorkerClient& client) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   // Hold messages for port while setting up connection.
   MessagePortService::GetInstance()->HoldMessages(client.message_port_id);

[scheib, 2014/12/18 00:24:10]

What sanitizing / protection from a rogue Renderer process should be done on
these parameters, specifically client.message_port_id? I think of this when
seeing NavigatorConnectContext::RegisterConnection taking the message_port_id to
replace a Connection. If a Renderer is compromised, could it redirect messages
to its self that were intended for another renderer? This is the first
processing of the IPC here, so if we can validate that no harm is underway here
it would be best. Else, perhaps harden up downstream usage. Or both.

[Marijn Kruisselbrink, 2014/12/19 00:09:21]

There are much easier ways a compromised renderer could redirect messages to
itself. A renderer could simply call MessagePortHostMsg_PostMessage to post a
message to a port it controls with any arbitrary message_port_id it wants to be
transferred to itself, so this certainly doesn't open up any holes that don't
already exist.

 
   // Find the right service worker to service this connection.
   service_worker_context_->context()->storage()->FindRegistrationForDocument(
       client.target_url,
       base::Bind(&NavigatorConnectDispatcherHost::GotServiceWorkerRegistration,
                  this, thread_id, request_id, client));
 }
 
 void NavigatorConnectDispatcherHost::GotServiceWorkerRegistration(
     int thread_id,
@@ skipping 28 matching lines @@
     const CrossOriginServiceWorkerClient& client,
     const scoped_refptr<ServiceWorkerRegistration>& registration,
     ServiceWorkerStatusCode status,
     bool accept_connection) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   if (status != SERVICE_WORKER_OK || !accept_connection) {
     // Close port since connection failed.
     MessagePortService::GetInstance()->ClosePort(client.message_port_id);
     Send(new NavigatorConnectMsg_ConnectResult(thread_id, request_id, false));
-  } else {
-    // TODO(mek): Update MessagePortService to make communication between client
-    // and service possible.
-    Send(new NavigatorConnectMsg_ConnectResult(thread_id, request_id, true));
+    return;
   }
+
+  // Register connection and post back result.
+  navigator_connect_context_->RegisterConnection(client, registration);
+  Send(new NavigatorConnectMsg_ConnectResult(thread_id, request_id, true));
 }
 
 }  // namespace content