Restrict extensionview to chrome-extension://

extensions/browser/guest_view/extension_view/extension_view_guest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/guest_view/extension_view/extension_view_guest.h"
 
 #include "base/metrics/user_metrics.h"
+#include "components/crx_file/id_util.h"
+#include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/result_codes.h"
 #include "extensions/browser/api/extensions_api_client.h"
 #include "extensions/browser/guest_view/extension_view/extension_view_constants.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension_messages.h"
 #include "extensions/strings/grit/extensions_strings.h"
+#include "net/base/net_errors.h"
 
 using content::WebContents;
 using namespace extensions::core_api;
 
 namespace extensions {
 
 // static
 const char ExtensionViewGuest::Type[] = "extensionview";
 
 ExtensionViewGuest::ExtensionViewGuest(
     content::WebContents* owner_web_contents)
     : GuestView<ExtensionViewGuest>(owner_web_contents),
       extension_view_guest_delegate_(
           extensions::ExtensionsAPIClient::Get()
               ->CreateExtensionViewGuestDelegate(this)) {
 }
 
 ExtensionViewGuest::~ExtensionViewGuest() {
 }
 
 // static
 extensions::GuestViewBase* ExtensionViewGuest::Create(
     content::WebContents* owner_web_contents) {
   return new ExtensionViewGuest(owner_web_contents);
 }
 
 void ExtensionViewGuest::NavigateGuest(const std::string& src,
                                        bool force_navigation) {
-  if (src.empty())
+  GURL url = ResolveURL(src);
+
+  // Do not allow navigating a guest to schemes other than known safe schemes.
+  bool scheme_is_blocked =
+      (!content::ChildProcessSecurityPolicy::GetInstance()->IsWebSafeScheme(

[Fady Samuel, 2015/02/17 18:48:29]

Wow, this works? chrome-extension:// is not a WebSafeScheme I think?

[apacible, 2015/02/17 20:07:30]

Yeah, it does! I know chrome:// isn't a WebSafeScheme, and checked that
something like chrome://settings gets blocked. Since we really just want
chrome-extension://extensionid/pagetonavigateto.html URLs, it may make more
sense to check for that.. something like
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/bro...
? 

+           url.scheme()) &&
+       !url.SchemeIs(url::kAboutScheme)) ||
+      url.SchemeIs(url::kJavaScriptScheme);
+  if (scheme_is_blocked || !url.is_valid()) {
+    NavigateGuest(url::kAboutBlankURL, true /* force_navigation */);
+    return;
+  }
+
+  if (!force_navigation && (view_page_ == url))
     return;
 
-  GURL url(src);
-  if (!url.is_valid() && !force_navigation && (url == view_page_))
-    return;
-
-  web_contents()->GetRenderProcessHost()->FilterURL(false, &url);
-  web_contents()->GetController().LoadURL(url, content::Referrer(),
+  GURL validated_url(url);

[apacible, 2015/02/17 18:31:26]

WebViewGuest creates a validated_url here, but is there any difference between
using this and just passing in the earlier url? Is it just for readability?

[Fady Samuel, 2015/02/17 18:48:29]

That's probably some old code that didn't get refactored well somewhere along
the way.

[apacible, 2015/02/17 20:07:30]

Acknowledged.

+  web_contents()->GetRenderProcessHost()->FilterURL(false, &validated_url);
+  web_contents()->GetController().LoadURL(validated_url, content::Referrer(),
                                           ui::PAGE_TRANSITION_AUTO_TOPLEVEL,
                                           std::string());
 
-  view_page_ = url;
+  view_page_ = validated_url;
 }
 
 // GuestViewBase implementation.
 bool ExtensionViewGuest::CanRunInDetachedState() const {
   return true;
 }
 
 void ExtensionViewGuest::CreateWebContents(
     const base::DictionaryValue& create_params,
     const WebContentsCreatedCallback& callback) {
-  std::string str;
-  if (!create_params.GetString(extensionview::kAttributeSrc, &str)) {
+  // Gets the extension ID.
+  create_params.GetString(extensionview::kAttributeExtension, &extension_id_);
+
+  if (!crx_file::id_util::IdIsValid(extension_id_)) {
     callback.Run(nullptr);
     return;
   }
 
-  GURL source(str);
-  if (!source.is_valid()) {
+  // Gets the extension URL.
+  extension_url_ =
+      extensions::Extension::GetBaseURLFromExtensionId(extension_id_);
+
+  if (!extension_url_.is_valid()) {
+    callback.Run(nullptr);
+    return;
+  }
+
+  // Get the src to build URL to render.
+  std::string src;
+  if (!create_params.GetString(extensionview::kAttributeSrc, &src)) {
     callback.Run(nullptr);
     return;
   }
 
   content::SiteInstance* view_site_instance =
-      content::SiteInstance::CreateForURL(browser_context(), source);
+      content::SiteInstance::CreateForURL(browser_context(),
+                                          extension_url_);
 
   WebContents::CreateParams params(browser_context(), view_site_instance);
   params.guest_delegate = this;
   callback.Run(WebContents::Create(params));
 }
 
 void ExtensionViewGuest::DidInitialize(
     const base::DictionaryValue& create_params) {
   extension_function_dispatcher_.reset(
       new extensions::ExtensionFunctionDispatcher(browser_context(), this));
@@ skipping 32 matching lines @@
   extension_function_dispatcher_->Dispatch(params,
                                            web_contents()->GetRenderViewHost());
 }
 
 void ExtensionViewGuest::ApplyAttributes(const base::DictionaryValue& params) {
   std::string src;
   params.GetString(extensionview::kAttributeSrc, &src);
   NavigateGuest(src, false /* force_navigation */);
 }
 
+GURL ExtensionViewGuest::ResolveURL(const std::string& src) {
+  if (src.empty())
+    return GURL();
+
+  GURL default_url(base::StringPrintf("%s://%s/%s",

[Fady Samuel, 2015/02/17 18:48:29]

This doesn't seem necessary to me.

return extension_url_.Resolve(src);

should do the trick I think.

Now that I think about it, you can probably do this inline in NavigateGuest.

[apacible, 2015/02/17 20:07:30]

Done, added inline.

+                                      kExtensionScheme,
+                                      extension_id_.c_str(),
+                                      src.c_str()));
+
+  return default_url.Resolve(src);
+}
+
 }  // namespace extensions