Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(518)

Unified Diff: extensions/browser/extension_host.cc

Issue 823703004: Tracking push events for lucid sleep (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Kill renderer if it sends a bad message id Created 5 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: extensions/browser/extension_host.cc
diff --git a/extensions/browser/extension_host.cc b/extensions/browser/extension_host.cc
index e4bc35e0b64edbd8c6723e991b56a9b30c198797..3125701f64e72ed86b1e8342ef28d908b9d5caf5 100644
--- a/extensions/browser/extension_host.cc
+++ b/extensions/browser/extension_host.cc
@@ -29,6 +29,7 @@
#include "extensions/browser/event_router.h"
#include "extensions/browser/extension_error.h"
#include "extensions/browser/extension_host_delegate.h"
+#include "extensions/browser/extension_host_observer.h"
#include "extensions/browser/extension_system.h"
#include "extensions/browser/extensions_browser_client.h"
#include "extensions/browser/notification_types.h"
@@ -159,6 +160,8 @@ ExtensionHost::~ExtensionHost() {
extensions::NOTIFICATION_EXTENSION_HOST_DESTROYED,
content::Source<BrowserContext>(browser_context_),
content::Details<ExtensionHost>(this));
+ FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+ OnExtensionHostDestroyed(this));
ProcessCreationQueue::GetInstance()->Remove(this);
}
@@ -205,6 +208,31 @@ void ExtensionHost::CreateRenderViewNow() {
}
}
+void ExtensionHost::AddObserver(ExtensionHostObserver* observer) {
+ observer_list_.AddObserver(observer);
+}
+
+void ExtensionHost::RemoveObserver(ExtensionHostObserver* observer) {
+ observer_list_.RemoveObserver(observer);
+}
+
+void ExtensionHost::OnMessageDispatched(const std::string& event_name,
+ int message_id) {
+ unacked_messages_.insert(message_id);
+ FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+ OnExtensionMessageDispatched(this, event_name, message_id));
+}
+
+void ExtensionHost::OnNetworkRequestStarted(uint64 request_id) {
+ FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+ OnNetworkRequestStarted(this, request_id));
+}
+
+void ExtensionHost::OnNetworkRequestDone(uint64 request_id) {
+ FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+ OnNetworkRequestDone(this, request_id));
+}
+
const GURL& ExtensionHost::GetURL() const {
return host_contents()->GetURL();
}
@@ -353,10 +381,25 @@ void ExtensionHost::OnRequest(const ExtensionHostMsg_Request_Params& params) {
extension_function_dispatcher_.Dispatch(params, render_view_host());
}
-void ExtensionHost::OnEventAck() {
+void ExtensionHost::OnEventAck(int message_id) {
EventRouter* router = EventRouter::Get(browser_context_);
if (router)
router->OnEventAck(browser_context_, extension_id());
not at google - send to devlin 2015/02/27 01:00:50 Actually - it seems like this event ID tracking sh
+
+ // A compromised renderer could start sending out arbitrary message ids, which
+ // may affect other renderers by causing downstream methods to think that
+ // messages for other extensions have been acked. Make sure that the message
+ // id sent by the renderer is one that this ExtensionHost expects to receive.
+ // This way if a renderer _is_ compromised, it can really only affect itself.
+ if (unacked_messages_.erase(message_id) > 0) {
+ FOR_EACH_OBSERVER(ExtensionHostObserver, observer_list_,
+ OnExtensionMessageAcked(this, message_id));
+ } else {
+ // We have received an unexpected message id from the renderer. It might be
+ // compromised or it might have some other issue. Kill it just to be safe.
+ DCHECK(render_process_host());
+ render_process_host()->ReceivedBadMessage();
not at google - send to devlin 2015/02/26 23:32:36 Also as I mentioned in the bug, please UMA this.
Chirantan Ekbote 2015/02/26 23:38:57 Acknowledged.
+ }
}
void ExtensionHost::OnIncrementLazyKeepaliveCount() {

Powered by Google App Engine
This is Rietveld 408576698