Disable DOM MutationEvents for platform apps

chrome/renderer/chrome_render_view_observer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_render_view_observer.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 480 matching lines @@
 
 bool ChromeRenderViewObserver::allowWriteToClipboard(WebFrame* frame,
                                                     bool default_value) {
   bool allowed = false;
   Send(new ChromeViewHostMsg_CanTriggerClipboardWrite(
       routing_id(), GURL(frame->document().securityOrigin().toString().utf8()),
       &allowed));
   return allowed;
 }
 
-bool ChromeRenderViewObserver::HasExtensionPermission(
-    const WebSecurityOrigin& origin, APIPermission::ID permission) const {
+const extensions::Extension* ChromeRenderViewObserver::GetExtension(
+    const WebSecurityOrigin& origin) const {
   if (!EqualsASCII(origin.protocol(), chrome::kExtensionScheme))
-    return false;
+    return NULL;
 
   const std::string extension_id = origin.host().utf8().data();
   if (!extension_dispatcher_->IsExtensionActive(extension_id))
-    return false;
+    return NULL;
 
-  const extensions::Extension* extension =
-      extension_dispatcher_->extensions()->GetByID(extension_id);
-  if (!extension)
-    return false;
-
-  return extension->HasAPIPermission(permission);
+  return extension_dispatcher_->extensions()->GetByID(extension_id);
 }
 
 bool ChromeRenderViewObserver::allowWebComponents(const WebDocument& document,
                                                   bool defaultValue) {
   if (defaultValue)
     return true;
 
   WebSecurityOrigin origin = document.securityOrigin();
   if (EqualsASCII(origin.protocol(), chrome::kChromeUIScheme))
     return true;
 
-  // The <browser> tag is implemented via Shadow DOM.
-  if (HasExtensionPermission(origin, APIPermission::kBrowserTag))
-    return true;
+  if (const extensions::Extension* extension = GetExtension(origin)) {
+    // The <browser> tag is implemented via Shadow DOM.
+    if (extension->HasAPIPermission(APIPermission::kBrowserTag))
+      return true;
 
-  if (HasExtensionPermission(origin, APIPermission::kExperimental))
-    return true;
+    if (extension->HasAPIPermission(APIPermission::kExperimental))
+      return true;
+  }
 
   return false;
 }
 
+bool ChromeRenderViewObserver::allowMutationEvents(
+    const WebDocument& document,
+    bool default_value) {
+  WebSecurityOrigin origin = document.securityOrigin();
+  if (!EqualsASCII(origin.protocol(), chrome::kExtensionScheme))

[Mihai Parparita -not on Chrome, 2012/08/22 20:04:05]

I don't think you need this check, GetExtension already looks at the scheme, and
returns NULL if it's not the extension scheme, thus putting you on the
default_value path below.

[adamk, 2012/08/22 21:39:53]

Thanks, this was left over from a previous version.  Simplified.

+    return default_value;
+
+  if (const extensions::Extension* extension = GetExtension(origin)) {
+    if (extension->is_platform_app())
+      return false;
+  }
+
+  return default_value;
+}
+
 bool ChromeRenderViewObserver::allowHTMLNotifications(
     const WebDocument& document) {
   WebSecurityOrigin origin = document.securityOrigin();
-  return HasExtensionPermission(origin, APIPermission::kNotification);
+  const extensions::Extension* extension = GetExtension(origin);
+  return extension && extension->HasAPIPermission(APIPermission::kNotification);
 }
 
 static void SendInsecureContentSignal(int signal) {
   UMA_HISTOGRAM_ENUMERATION("SSL.InsecureContent", signal,
                             INSECURE_CONTENT_NUM_EVENTS);
 }
 
 bool ChromeRenderViewObserver::allowDisplayingInsecureContent(
     WebKit::WebFrame* frame,
     bool allowed_per_settings,
@@ skipping 556 matching lines @@
         reinterpret_cast<const unsigned char*>(&data[0]);
 
     return decoder.Decode(src_data, data.size());
   }
   return SkBitmap();
 }
 
 bool ChromeRenderViewObserver::IsStrictSecurityHost(const std::string& host) {
   return (strict_security_hosts_.find(host) != strict_security_hosts_.end());
 }