Index: content/browser/worker_host/worker_process_host.cc |
diff --git a/content/browser/worker_host/worker_process_host.cc b/content/browser/worker_host/worker_process_host.cc |
index e665f11b77c75730e0b7d84ea31f9562bd2449a5..fcca63d75313a542f6e6041941f23b9d3642c1e4 100644 |
--- a/content/browser/worker_host/worker_process_host.cc |
+++ b/content/browser/worker_host/worker_process_host.cc |
@@ -94,10 +94,21 @@ void WorkerCrashCallback(int render_process_unique_id, int render_view_id) { |
host->GetDelegate()->WorkerCrashed(); |
} |
-WorkerProcessHost::WorkerProcessHost(ResourceContext* resource_context) |
- : resource_context_(resource_context) { |
+WorkerProcessHost::WorkerProcessHost( |
+ const std::string& partition_id, |
+ ResourceContext* resource_context, |
+ ChromeAppCacheService* appcache_service, |
+ fileapi::FileSystemContext* filesystem_context, |
+ webkit_database::DatabaseTracker* database_tracker, |
+ IndexedDBContextImpl* indexed_db_context) |
+ : partition_id_(partition_id), |
+ resource_context_(resource_context), |
+ appcache_service_(appcache_service), |
+ filesystem_context_(filesystem_context), |
+ database_tracker_(database_tracker), |
+ indexed_db_context_(indexed_db_context) { |
DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO)); |
- DCHECK(resource_context); |
+ DCHECK(resource_context_); |
process_.reset( |
new BrowserChildProcessHostImpl(content::PROCESS_TYPE_WORKER, this)); |
} |
@@ -200,8 +211,6 @@ bool WorkerProcessHost::Init(int render_process_id) { |
#endif |
cmd_line); |
- fileapi::FileSystemContext* file_system_context = |
- GetFileSystemContextForResourceContext(resource_context_); |
ChildProcessSecurityPolicyImpl::GetInstance()->AddWorker( |
process_->GetData().id, render_process_id); |
if (!CommandLine::ForCurrentProcess()->HasSwitch( |
@@ -213,7 +222,7 @@ bool WorkerProcessHost::Init(int render_process_id) { |
// This is for the filesystem sandbox. |
ChildProcessSecurityPolicyImpl::GetInstance()->GrantPermissionsForFile( |
process_->GetData().id, |
- file_system_context->sandbox_provider()->new_base_path(), |
+ filesystem_context_->sandbox_provider()->new_base_path(), |
base::PLATFORM_FILE_OPEN | |
base::PLATFORM_FILE_CREATE | |
base::PLATFORM_FILE_OPEN_ALWAYS | |
@@ -230,7 +239,7 @@ bool WorkerProcessHost::Init(int render_process_id) { |
// sandbox. |
ChildProcessSecurityPolicyImpl::GetInstance()->GrantPermissionsForFile( |
process_->GetData().id, |
- file_system_context->sandbox_provider()->old_base_path(), |
+ filesystem_context_->sandbox_provider()->old_base_path(), |
base::PLATFORM_FILE_READ | base::PLATFORM_FILE_WRITE | |
base::PLATFORM_FILE_WRITE_ATTRIBUTES | |
base::PLATFORM_FILE_ENUMERATE); |
@@ -238,7 +247,7 @@ bool WorkerProcessHost::Init(int render_process_id) { |
// we know we've taken care of it. |
ChildProcessSecurityPolicyImpl::GetInstance()->GrantPermissionsForFile( |
process_->GetData().id, |
- file_system_context->sandbox_provider()->renamed_old_base_path(), |
+ filesystem_context_->sandbox_provider()->renamed_old_base_path(), |
base::PLATFORM_FILE_CREATE | base::PLATFORM_FILE_CREATE_ALWAYS | |
base::PLATFORM_FILE_WRITE); |
} |
@@ -258,7 +267,8 @@ void WorkerProcessHost::CreateMessageFilters(int render_process_id) { |
process_->GetHost()->AddFilter(resource_message_filter); |
worker_message_filter_ = new WorkerMessageFilter( |
- render_process_id, resource_context_, |
+ render_process_id, partition_id_, resource_context_, appcache_service_, |
+ filesystem_context_, database_tracker_, indexed_db_context_, |
base::Bind(&WorkerServiceImpl::next_worker_route_id, |
base::Unretained(WorkerServiceImpl::GetInstance()))); |
process_->GetHost()->AddFilter(worker_message_filter_); |
@@ -269,14 +279,13 @@ void WorkerProcessHost::CreateMessageFilters(int render_process_id) { |
process_->GetHost()->AddFilter(new FileAPIMessageFilter( |
process_->GetData().id, |
request_context, |
- GetFileSystemContextForResourceContext(resource_context_), |
+ filesystem_context_, |
content::GetChromeBlobStorageContextForResourceContext( |
resource_context_))); |
process_->GetHost()->AddFilter(new FileUtilitiesMessageFilter( |
process_->GetData().id)); |
process_->GetHost()->AddFilter(new MimeRegistryMessageFilter()); |
- process_->GetHost()->AddFilter(new DatabaseMessageFilter( |
- content::GetDatabaseTrackerForResourceContext(resource_context_))); |
+ process_->GetHost()->AddFilter(new DatabaseMessageFilter(database_tracker_)); |
SocketStreamDispatcherHost* socket_stream_dispatcher_host = |
new SocketStreamDispatcherHost(render_process_id, |
@@ -285,8 +294,7 @@ void WorkerProcessHost::CreateMessageFilters(int render_process_id) { |
process_->GetHost()->AddFilter( |
new content::WorkerDevToolsMessageFilter(process_->GetData().id)); |
process_->GetHost()->AddFilter(new IndexedDBDispatcherHost( |
- process_->GetData().id, |
- content::GetIndexedDBContextForResourceContext(resource_context_))); |
+ process_->GetData().id, indexed_db_context_)); |
} |
void WorkerProcessHost::CreateWorker(const WorkerInstance& instance) { |
@@ -578,7 +586,12 @@ WorkerProcessHost::WorkerInstance::WorkerInstance( |
int worker_route_id, |
int parent_process_id, |
int64 main_resource_appcache_id, |
- content::ResourceContext* resource_context) |
+ const std::string& partition_id, |
+ content::ResourceContext* resource_context, |
+ ChromeAppCacheService* appcache_service, |
+ fileapi::FileSystemContext* filesystem_context, |
+ webkit_database::DatabaseTracker* database_tracker, |
+ IndexedDBContextImpl* indexed_db_context) |
: url_(url), |
closed_(false), |
name_(name), |
@@ -586,7 +599,12 @@ WorkerProcessHost::WorkerInstance::WorkerInstance( |
parent_process_id_(parent_process_id), |
main_resource_appcache_id_(main_resource_appcache_id), |
worker_document_set_(new WorkerDocumentSet()), |
- resource_context_(resource_context) { |
+ partition_id_(partition_id), |
+ resource_context_(resource_context), |
+ appcache_service_(appcache_service), |
+ filesystem_context_(filesystem_context), |
+ database_tracker_(database_tracker), |
+ indexed_db_context_(indexed_db_context) { |
DCHECK(resource_context_); |
} |
@@ -594,7 +612,12 @@ WorkerProcessHost::WorkerInstance::WorkerInstance( |
const GURL& url, |
bool shared, |
const string16& name, |
- content::ResourceContext* resource_context) |
+ const std::string& partition_id, |
+ content::ResourceContext* resource_context, |
+ ChromeAppCacheService* appcache_service, |
+ fileapi::FileSystemContext* filesystem_context, |
+ webkit_database::DatabaseTracker* database_tracker, |
+ IndexedDBContextImpl* indexed_db_context) |
: url_(url), |
closed_(false), |
name_(name), |
@@ -602,7 +625,12 @@ WorkerProcessHost::WorkerInstance::WorkerInstance( |
parent_process_id_(0), |
main_resource_appcache_id_(0), |
worker_document_set_(new WorkerDocumentSet()), |
- resource_context_(resource_context) { |
+ partition_id_(partition_id), |
+ resource_context_(resource_context), |
+ appcache_service_(appcache_service), |
+ filesystem_context_(filesystem_context), |
+ database_tracker_(database_tracker), |
+ indexed_db_context_(indexed_db_context) { |
DCHECK(resource_context_); |
} |
@@ -617,6 +645,7 @@ WorkerProcessHost::WorkerInstance::~WorkerInstance() { |
bool WorkerProcessHost::WorkerInstance::Matches( |
const GURL& match_url, |
const string16& match_name, |
+ const std::string& partition_id, |
content::ResourceContext* resource_context) const { |
// Only match open shared workers. |
if (closed_) |
@@ -627,6 +656,13 @@ bool WorkerProcessHost::WorkerInstance::Matches( |
if (resource_context_ != resource_context) |
return false; |
+ // We must be in the same storage partition otherwise sharing will violate |
+ // isolation. All of the FileSystemContext, AppCacheService, etc., objects |
+ // that are normally contained in StoragePartition come from one partition so |
+ // this check is equivalent to examing each of those pointers for equality. |
+ if (partition_id_ != partition_id) |
+ return false; |
+ |
if (url_.GetOrigin() != match_url.GetOrigin()) |
return false; |