Launches a privileged utility process.

chrome/utility/chrome_content_utility_client.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_UTILITY_CHROME_CONTENT_UTILITY_CLIENT_H_
 #define CHROME_UTILITY_CHROME_CONTENT_UTILITY_CLIENT_H_
 
 #include "base/compiler_specific.h"
 #include "base/memory/scoped_vector.h"
 #include "base/platform_file.h"
@@ skipping 22 matching lines @@
 class ChromeContentUtilityClient : public content::ContentUtilityClient {
  public:
   ChromeContentUtilityClient();
   virtual ~ChromeContentUtilityClient();
 
   virtual void UtilityThreadStarted() OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
   static void PreSandboxStartup();
 
+  // Adds a message handler to the utility client.  This will take ownership of
+  // the handler.
+  void AddHandler(UtilityMessageHandler* handler);

[jam, 2014/01/30 21:41:03]

hmm, these two methods are only added for a unittest. given how simple the
functionality is that we're testing, are you sure we need to test this?

[Drew Haven, 2014/01/31 20:00:12]

Since this has security implications, I feel like we'd like to have tests.  For
the other test with the UAC I'll remove it, but I'd like to leave this one. 
Perhaps I should change the functions to make the names more test-oriented or
reduce the access (e.g. protected).

[jam, 2014/02/01 01:09:10]

I understand the need to test. Perhaps there are other ways.

It seems that ChromeContentUtilityClientTest.MessageWhitelistAccept can be added
later when we actually have a whitelisted IPC. Then the test can use an existing
IPC used for production.

ChromeContentUtilityClientTest.MessageWhitelistReject doesn't need to add a
handler? i.e. it can check the return code of OnMessageReceived

ChromeContentUtilityClientTest.NoWhitelistUnelevated is checking that current
behavior of utility process works. It seems you can check the return code of
OnMessageReceived here as well. Also note that this is already tested through
other unittests which use the utility process code.

[Drew Haven, 2014/02/04 21:25:54]

Okay, that generally sounds good.  Once we start adding new IPCs that should
only be run when elevated then we can test that they are properly whitelisted in
their tests and we don't really need these generic tests and extra methods.

I'll pull out all these tests.  In my next CL when I actually use this feature,
I'll test there.

+
+  // Adds a message type to the whitelist.
+  void AddWhitelistMessageType(int message_type);
+
  private:
   // IPC message handlers.
   void OnUnpackExtension(const base::FilePath& extension_path,
                          const std::string& extension_id,
                          int location, int creation_flags);
   void OnUnpackWebResource(const std::string& resource_data);
   void OnParseUpdateManifest(const std::string& xml);
   void OnDecodeImage(const std::vector<unsigned char>& encoded_data);
   void OnDecodeImageBase64(const std::string& encoded_data);
   void OnRenderPDFPagesToMetafile(
@@ skipping 46 matching lines @@
       const picasa::AlbumTableFilesForTransit& album_table_files);
 
   void OnIndexPicasaAlbumsContents(
       const picasa::AlbumUIDSet& album_uids,
       const std::vector<picasa::FolderINIContents>& folders_inis);
 #endif  // defined(OS_WIN) || defined(OS_MACOSX)
 
   typedef ScopedVector<UtilityMessageHandler> Handlers;
   Handlers handlers_;
 
+  // Flag to enable whitelisting.
+  bool filter_messages_;
+  // A list of message_ids to filter.
+  std::set<int> message_id_whitelist_;
+
   DISALLOW_COPY_AND_ASSIGN(ChromeContentUtilityClient);
 };
 
 }  // namespace chrome
 
 #endif  // CHROME_UTILITY_CHROME_CONTENT_UTILITY_CLIENT_H_