Tracking push events for lucid sleep

extensions/browser/extension_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/extension_host.h"
 
 #include <list>
 
 #include "base/bind.h"
 #include "base/logging.h"
@@ skipping 11 matching lines @@
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/browser/web_contents.h"
 #include "extensions/browser/event_router.h"
 #include "extensions/browser/extension_error.h"
 #include "extensions/browser/extension_host_delegate.h"
+#include "extensions/browser/extension_host_observer.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/browser/extensions_browser_client.h"
 #include "extensions/browser/notification_types.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/browser/runtime_data.h"
 #include "extensions/browser/view_type_utils.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_messages.h"
 #include "extensions/common/extension_urls.h"
 #include "extensions/common/feature_switch.h"
@@ skipping 110 matching lines @@
 ExtensionHost::~ExtensionHost() {
   if (extension_host_type_ == VIEW_TYPE_EXTENSION_BACKGROUND_PAGE &&
       extension_ && BackgroundInfo::HasLazyBackgroundPage(extension_)) {
     UMA_HISTOGRAM_LONG_TIMES("Extensions.EventPageActiveTime",
                              since_created_.Elapsed());
   }
   content::NotificationService::current()->Notify(
       extensions::NOTIFICATION_EXTENSION_HOST_DESTROYED,
       content::Source<BrowserContext>(browser_context_),
       content::Details<ExtensionHost>(this));
+  FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                    OnExtensionHostDestroyed(this));
   ProcessCreationQueue::GetInstance()->Remove(this);
 }
 
 content::RenderProcessHost* ExtensionHost::render_process_host() const {
   return render_view_host()->GetProcess();
 }
 
 RenderViewHost* ExtensionHost::render_view_host() const {
   // TODO(mpcomplete): This can be NULL. How do we handle that?
   return render_view_host_;
@@ skipping 26 matching lines @@
                extension_)) ||
           group_name == "ThrottleAll") {
         host_contents_->WasHidden();
       }
     }
     // Connect orphaned dev-tools instances.
     delegate_->OnRenderViewCreatedForBackgroundPage(this);
   }
 }
 
+void ExtensionHost::AddObserver(ExtensionHostObserver* observer) {
+  observer_list_.AddObserver(observer);
+}
+
+void ExtensionHost::RemoveObserver(ExtensionHostObserver* observer) {
+  observer_list_.RemoveObserver(observer);
+}
+
+void ExtensionHost::OnMessageDispatched(const std::string& event_name,
+                                        int message_id) {
+  unacked_messages_.insert(message_id);

[not at google - send to devlin, 2015/02/26 23:24:32]

This method is called on the IO thread, but below unacked_messages_ is accessed
on the UI thread (I believe that WebContentsObserver dispatches its IPC on the
UI thread).

[Chirantan Ekbote, 2015/02/26 23:38:57]

This method is called by NotifyEventDispatched in event_router.cc.  The first
thing that function does is make sure it is running on the UI thread.

[not at google - send to devlin, 2015/02/26 23:52:33]

Ah, you're right. NotifyEventDispatched tricked me.

In that case, in crazy-land (but perhaps this power-on case is crazy land) this
is racy: it's possible for the message to be sent and acked all on the IO
thread, meaning this code may never get hit, and hence the message ID not being
found.

[Chirantan Ekbote, 2015/02/27 00:15:00]

I don't understand this.  Both this function and ExtensionHost::OnEventAck have
to be called on the UI thread because the ExtensionHost object lives on the UI
thread.  How can the message be sent and acked all on the IO thread?

[not at google - send to devlin, 2015/02/27 01:00:50]

Yep you're right, sorry.

+  FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                    OnExtensionMessageDispatched(this, event_name, message_id));
+}
+
+void ExtensionHost::OnNetworkRequestStarted(uint64 request_id) {
+  FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                    OnNetworkRequestStarted(this, request_id));
+}
+
+void ExtensionHost::OnNetworkRequestDone(uint64 request_id) {
+  FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                    OnNetworkRequestDone(this, request_id));
+}
+
 const GURL& ExtensionHost::GetURL() const {
   return host_contents()->GetURL();
 }
 
 void ExtensionHost::LoadInitialURL() {
   host_contents_->GetController().LoadURL(
       initial_url_, content::Referrer(), ui::PAGE_TRANSITION_LINK,
       std::string());
 }
 
@@ skipping 128 matching lines @@
                         OnDecrementLazyKeepaliveCount)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
 void ExtensionHost::OnRequest(const ExtensionHostMsg_Request_Params& params) {
   extension_function_dispatcher_.Dispatch(params, render_view_host());
 }
 
-void ExtensionHost::OnEventAck() {
+void ExtensionHost::OnEventAck(int message_id) {
   EventRouter* router = EventRouter::Get(browser_context_);
   if (router)
     router->OnEventAck(browser_context_, extension_id());
+
+  // A compromised renderer could start sending out arbitrary message ids, which
+  // may affect other renderers by causing downstream methods to think that
+  // messages for other extensions have been acked.  Make sure that the message
+  // id sent by the renderer is one that this ExtensionHost expects to receive.
+  // This way if a renderer _is_ compromised, it can really only affect itself.
+  if (unacked_messages_.erase(message_id) > 0) {
+    FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+                      OnExtensionMessageAcked(this, message_id));
+  }

[jln (very slow on Chromium), 2015/01/28 01:18:27]

We should kill the renderer in the else {} clause here.

Could you please call BadMessageReceived()?
(content/public/browser/browser_message_filter.h)

[Chirantan Ekbote, 2015/01/28 22:11:52]

Done.

 }
 
 void ExtensionHost::OnIncrementLazyKeepaliveCount() {
   ProcessManager::Get(browser_context_)
       ->IncrementLazyKeepaliveCount(extension());
 }
 
 void ExtensionHost::OnDecrementLazyKeepaliveCount() {
   ProcessManager::Get(browser_context_)
       ->DecrementLazyKeepaliveCount(extension());
@@ skipping 73 matching lines @@
   return delegate_->CheckMediaAccessPermission(
       web_contents, security_origin, type, extension());
 }
 
 bool ExtensionHost::IsNeverVisible(content::WebContents* web_contents) {
   ViewType view_type = extensions::GetViewType(web_contents);
   return view_type == extensions::VIEW_TYPE_EXTENSION_BACKGROUND_PAGE;
 }
 
 }  // namespace extensions