Implement <webview>.addContentScript/removeContentScript API [1]

extensions/browser/api/guest_view/web_view/web_view_internal_api.cc

Index: extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
diff --git a/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc b/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
index 74c89c6346f931030692756356d28be189b178e3..8bf943474105cbcf2d4a9bf6b27bdba06fded8ec 100644
--- a/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
+++ b/extensions/browser/api/guest_view/web_view/web_view_internal_api.cc
@@ -4,6 +4,7 @@
 
 #include "extensions/browser/api/guest_view/web_view/web_view_internal_api.h"
 
+#include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/public/browser/browser_context.h"
@@ -13,17 +14,25 @@
 #include "content/public/common/stop_find_action.h"
 #include "content/public/common/url_fetcher.h"
 #include "extensions/browser/guest_view/web_view/web_view_constants.h"
+#include "extensions/browser/guest_view/web_view/web_view_content_script_manager.h"
 #include "extensions/common/api/web_view_internal.h"
 #include "extensions/common/error_utils.h"
+#include "extensions/common/manifest_constants.h"
+#include "extensions/common/user_script.h"
 #include "net/base/load_flags.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_fetcher_delegate.h"
 #include "third_party/WebKit/public/web/WebFindOptions.h"
 
 using content::WebContents;
+using extensions::ExtensionResource;
+using extensions::core_api::web_view_internal::ContentScriptDetails;
 using extensions::core_api::web_view_internal::SetPermission::Params;
 using extensions::core_api::extension_types::InjectDetails;
+using extensions::UserScript;
 using ui_zoom::ZoomController;
+// error messages for content scripts:
+namespace errors = extensions::manifest_errors;
 namespace web_view_internal = extensions::core_api::web_view_internal;
 
 namespace {
@@ -37,6 +46,7 @@ const char kLocalStorageKey[] = "localStorage";
 const char kWebSQLKey[] = "webSQL";
 const char kSinceKey[] = "since";
 const char kLoadFileError[] = "Failed to load file: \"*\". ";
+const char kViewInstanceIdError[] = "view_instance_id is missing.";
 
 uint32 MaskForKey(const char* key) {
   if (strcmp(key, kAppCacheKey) == 0)
@@ -56,6 +66,168 @@ uint32 MaskForKey(const char* key) {
   return 0;
 }
 
+HostID GenerateHostIDFromEmbedder(const extensions::Extension* extension,
+                                  const content::WebContents* web_contents) {
+  if (extension)
+    return HostID(HostID::EXTENSIONS, extension->id());
+
+  if (web_contents && web_contents->GetWebUI()) {
+    const GURL& url = web_contents->GetSiteInstance()->GetSiteURL();
+    return HostID(HostID::WEBUI, url.spec());
+  }
+  NOTREACHED();
+  return HostID();
+}
+
+bool ParseContentScript(const ContentScriptDetails& script_value,

[Devlin, 2015/04/13 19:21:46]

Add function comments

[Xi Han, 2015/04/14 19:05:50]

Done.

+                        const extensions::Extension* extension,
+                        const GURL& owner_base_url,
+                        UserScript* script,
+                        std::string* error) {
+  // matches (required):
+  const std::vector<std::string>& matches = script_value.matches;
+  if (matches.size() == 0) {

[Devlin, 2015/04/13 19:21:47]

nit: no brackets around single-line ifs

[Xi Han, 2015/04/14 19:05:50]

Done.

+    return false;
+  }
+
+  for (const std::string& match : matches) {
+    URLPattern pattern(UserScript::ValidUserScriptSchemes(
+        true /* canExecuteScriptEverywhere */));

[Devlin, 2015/04/13 19:21:47]

Why do we allow these to execute everywhere?

[Xi Han, 2015/04/14 19:05:51]

I checked the implementation in ContentScriptsHandler for extensions, and it
looks up whether the extension is in the white list for scripts. Since we don't
specify any white list for <webview>, can we assume here should be true? 

[Devlin, 2015/04/14 23:04:57]

No, quite the opposite.  If we have no scripting white list for webview, it
should *never* be true.  That being said, I think this should actually be
something along the lines of (pseudocode):
bool allowed_everywhere = false;
if (is_extension and ExtensionAllowedEverywhere or IsTrustedWebUI)
  allowed_everywhere = true

because we, essentially, do have a whitelist for this.

[Xi Han, 2015/04/15 19:43:55]

I see. Can we assume that we can trust webUI? 

[xiyuan, 2015/04/15 19:56:10]

Not sure about the webivew in app case. But for webview in webui, we probably
can use |false| since it should be sufficient for sign-in webui to inject only
into http/https.

[Xi Han, 2015/04/15 20:13:49]

If that is the case, we can just use |false| for webview of webUI now:)

+    if (pattern.Parse(match) != URLPattern::PARSE_SUCCESS) {
+      *error = errors::kInvalidMatches;
+      return false;
+    }
+    script->add_url_pattern(pattern);
+  }
+
+  // exclude_matches:
+  if (script_value.exclude_matches) {
+    const std::vector<std::string>& exclude_matches =
+        *(script_value.exclude_matches.get());
+    for (const std::string& exclude_match : exclude_matches) {
+      URLPattern pattern(UserScript::ValidUserScriptSchemes(
+          true /* canExecuteScriptEverywhere */));
+
+      if (pattern.Parse(exclude_match) != URLPattern::PARSE_SUCCESS) {
+        *error = errors::kInvalidExcludeMatches;
+        return false;
+      }
+      script->add_exclude_url_pattern(pattern);
+    }
+  }
+  // run_at:
+  if (script_value.run_at) {
+    UserScript::RunLocation run_at = UserScript::UNDEFINED;
+    switch (script_value.run_at) {
+      case extensions::core_api::extension_types::RUN_AT_NONE:
+      case extensions::core_api::extension_types::RUN_AT_DOCUMENT_IDLE:
+        run_at = UserScript::DOCUMENT_IDLE;
+        break;
+      case extensions::core_api::extension_types::RUN_AT_DOCUMENT_START:
+        run_at = UserScript::DOCUMENT_START;
+        break;
+      case extensions::core_api::extension_types::RUN_AT_DOCUMENT_END:
+        run_at = UserScript::DOCUMENT_END;
+        break;
+    }
+    script->set_run_location(run_at);
+  }
+
+  // match_about_blank:
+  if (script_value.match_about_blank)
+    script->set_match_about_blank(*script_value.match_about_blank);
+
+  // css:
+  if (script_value.css) {
+    const std::vector<std::string>& css_files = *(script_value.css.get());

[Devlin, 2015/04/13 19:21:47]

nit: inline css_files

[Xi Han, 2015/04/14 19:05:51]

Done.

+    for (const std::string& relative : css_files) {
+      GURL url = owner_base_url.Resolve(relative);
+      if (extension) {
+        ExtensionResource resource = extension->GetResource(relative);
+        script->css_scripts().push_back(UserScript::File(
+            resource.extension_root(), resource.relative_path(), url));
+      } else {
+        script->css_scripts().push_back(extensions::UserScript::File(
+            base::FilePath(), base::FilePath(), url));
+      }
+    }
+  }
+
+  // js:
+  if (script_value.js) {
+    const std::vector<std::string>& js_files = *(script_value.js.get());

[Devlin, 2015/04/13 19:21:47]

inline

[Xi Han, 2015/04/14 19:05:51]

Done.

+    for (const std::string& relative : js_files) {
+      GURL url = owner_base_url.Resolve(relative);
+      if (extension) {
+        ExtensionResource resource = extension->GetResource(relative);
+        script->js_scripts().push_back(UserScript::File(
+            resource.extension_root(), resource.relative_path(), url));
+      } else {
+        script->js_scripts().push_back(extensions::UserScript::File(
+            base::FilePath(), base::FilePath(), url));
+      }
+    }
+  }
+
+  // all_frames:
+  if (script_value.all_frames) {

[Devlin, 2015/04/13 19:21:46]

nit: brackets

[Xi Han, 2015/04/14 19:05:51]

Done.

+    script->set_match_all_frames(*(script_value.all_frames));
+  }
+
+  // include_globs:
+  if (script_value.include_globs) {
+    const std::vector<std::string>& include_globs =

[Devlin, 2015/04/13 19:21:46]

inline

[Xi Han, 2015/04/14 19:05:50]

Done.

+        *(script_value.include_globs.get());
+    for (const std::string& glob : include_globs)
+      script->add_glob(glob);
+  }
+
+  // exclude_globs:
+  if (script_value.exclude_globs) {
+    const std::vector<std::string>& exclude_globs =

[Devlin, 2015/04/13 19:21:47]

inline

[Xi Han, 2015/04/14 19:05:50]

Done.

+        *(script_value.exclude_globs.get());
+    for (const std::string& glob : exclude_globs)
+      script->add_exclude_glob(glob);
+  }
+
+  return true;
+}
+
+bool ParseContentScripts(
+    std::vector<linked_ptr<ContentScriptDetails>> content_script_list,
+    const extensions::Extension* extension,
+    const GURL& owner_base_url,
+    std::map<std::string, UserScript>* result,
+    std::string* error) {
+  if (content_script_list.size() == 0)

[Devlin, 2015/04/13 19:21:47]

nit: Prefer if (content_script_list.empty())

[Xi Han, 2015/04/14 19:05:50]

Done.

+    return false;
+  for (size_t i = 0; i < content_script_list.size(); ++i) {

[Devlin, 2015/04/13 19:21:47]

Why not range-based for loop?

[Xi Han, 2015/04/14 19:05:50]

Done.

+    const ContentScriptDetails& script_value = *content_script_list[i];
+    const std::string& name = script_value.name;
+    UserScript script;
+    if (!ParseContentScript(script_value, extension, owner_base_url, &script,
+                            error))
+      return false;
+    else

[Devlin, 2015/04/13 19:21:47]

nit: no need for the else

[Xi Han, 2015/04/14 19:05:51]

Done.

+      result->insert(std::pair<std::string, UserScript>(name, script));
+  }
+  return true;
+}
+
+// Initialize the user script.
+void InitUserScript(UserScript* script,
+                    std::string name,
+                    bool is_incognito_enabled,
+                    HostID host_id) {
+  if (!script)

[Devlin, 2015/04/13 19:21:47]

Why would we pass in a null script?

[Xi Han, 2015/04/14 19:05:50]

That is a good point. Removed the check.

+    return;
+  script->set_id(UserScript::GenerateUserScriptID());
+  script->set_name(name);

[Devlin, 2015/04/13 19:21:46]

Why not set the name in the Parsing process?

[Xi Han, 2015/04/14 19:05:51]

Done.

+  script->set_incognito_enabled(is_incognito_enabled);
+  script->set_host_id(host_id);
+  script->set_consumer_instance_type(UserScript::WEBVIEW);
+}
+
 }  // namespace
 
 namespace extensions {
@@ -256,6 +428,83 @@ bool WebViewInternalInsertCSSFunction::ShouldInsertCSS() const {
   return true;
 }
 
+WebViewInternalAddContentScriptsFunction::
+    WebViewInternalAddContentScriptsFunction() {
+}
+
+WebViewInternalAddContentScriptsFunction::
+    ~WebViewInternalAddContentScriptsFunction() {
+}
+
+ExecuteCodeFunction::ResponseAction
+WebViewInternalAddContentScriptsFunction::Run() {
+  scoped_ptr<web_view_internal::AddContentScripts::Params> params(
+      web_view_internal::AddContentScripts::Params::Create(*args_));
+  EXTENSION_FUNCTION_VALIDATE(params.get());
+
+  int view_instance_id = 0;
+  if (!args_->GetInteger(0, &view_instance_id) || !view_instance_id)

[Devlin, 2015/04/13 19:21:47]

Why aren't you using the params?

[Xi Han, 2015/04/14 19:05:50]

We could, updated.

+    return RespondNow(Error(kViewInstanceIdError));
+
+  GURL owner_base_url(
+      render_view_host()->GetSiteInstance()->GetSiteURL().GetWithEmptyPath());
+  std::map<std::string, UserScript> result;
+  if (!ParseContentScripts(params->content_script_list, extension(),
+                           owner_base_url, &result, &error_))
+    return RespondNow(Error(error_));
+
+  WebViewContentScriptManager* manager =
+      WebViewContentScriptManager::Get(browser_context());
+
+  HostID host_id =
+      GenerateHostIDFromEmbedder(extension(), GetSenderWebContents());

[Devlin, 2015/04/13 19:21:47]

cache GetSenderWebContents for use on line 466

[Xi Han, 2015/04/14 19:05:51]

Done.

+  const bool is_incognito_enabled = browser_context()->IsOffTheRecord();
+
+  for (auto& iter : result)
+    InitUserScript(&iter.second, iter.first, is_incognito_enabled, host_id);

[Devlin, 2015/04/13 19:21:47]

InitUserScript is small enough that let's just inline it here.

[Xi Han, 2015/04/14 19:05:50]

Done.

+
+  manager->AddContentScripts(GetSenderWebContents(), view_instance_id, host_id,
+                             result);
+
+  return RespondNow(NoArguments());
+}
+
+WebViewInternalRemoveContentScriptsFunction::
+    WebViewInternalRemoveContentScriptsFunction() {
+}
+
+WebViewInternalRemoveContentScriptsFunction::
+    ~WebViewInternalRemoveContentScriptsFunction() {
+}
+
+ExecuteCodeFunction::ResponseAction
+WebViewInternalRemoveContentScriptsFunction::Run() {
+  scoped_ptr<web_view_internal::RemoveContentScripts::Params> params(
+      web_view_internal::RemoveContentScripts::Params::Create(*args_));
+  EXTENSION_FUNCTION_VALIDATE(params.get());
+
+  int view_instance_id = 0;
+  if (!args_->GetInteger(0, &view_instance_id) || !view_instance_id) {

[Devlin, 2015/04/13 19:21:47]

Same as above, why not use |params|?

[Xi Han, 2015/04/14 19:05:51]

Done.

+    error_ = kViewInstanceIdError;
+    return RespondNow(Error(error_));

[Devlin, 2015/04/13 19:21:47]

RespondNow(Error()) sets the error.  So you don't need line 488.

[Xi Han, 2015/04/14 19:05:50]

Good catch, removed.

+  }
+
+  WebViewContentScriptManager* manager =
+      WebViewContentScriptManager::Get(browser_context());
+  DCHECK(manager);
+
+  HostID host_id =
+      GenerateHostIDFromEmbedder(extension(), GetSenderWebContents());
+  if (!params->script_name_list) {
+    manager->RemoveContentScripts(GetSenderWebContents(), view_instance_id,

[Devlin, 2015/04/13 19:21:47]

nit:
std::vector<std::string> script_name_list;
if (params->script_name_list)
  script_name_list.swap(*params->script_name_list);
manager->RemoveContentScripts(GetSenderWebContents(), view_instance_id,
                              host_id, script_name_list);

[Xi Han, 2015/04/14 19:05:51]

Thanks!

+                                  host_id, std::vector<std::string>());
+  } else {
+    manager->RemoveContentScripts(GetSenderWebContents(), view_instance_id,
+                                  host_id, *(params->script_name_list));
+  }
+  return RespondNow(NoArguments());
+}
+
 WebViewInternalSetNameFunction::WebViewInternalSetNameFunction() {
 }