Change the permission check for Pepper socket API to support both the public and private APIs.

chrome/browser/chrome_content_browser_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chrome_content_browser_client.h"
 
 #include <set>
 #include <utility>
 #include <vector>
 
@@ skipping 77 matching lines @@
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_process_type.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/background_info.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_process_policy.h"
 #include "chrome/common/extensions/extension_set.h"
 #include "chrome/common/extensions/manifest_handlers/app_isolation_info.h"
 #include "chrome/common/extensions/manifest_handlers/shared_module_info.h"
+#include "chrome/common/extensions/permissions/permissions_data.h"
 #include "chrome/common/extensions/permissions/socket_permission.h"
 #include "chrome/common/logging_chrome.h"
 #include "chrome/common/pepper_permission_util.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/url_constants.h"
 #include "chromeos/chromeos_constants.h"
 #include "components/user_prefs/pref_registry_syncable.h"
 #include "content/public/browser/browser_child_process_host.h"
 #include "content/public/browser/browser_main_parts.h"
@@ skipping 2054 matching lines @@
   if (!extension)
     return false;
 
   return extension->HasAPIPermission(APIPermission::kWebView) ||
          extension->HasAPIPermission(APIPermission::kAdView);
 }
 
 bool ChromeContentBrowserClient::AllowPepperSocketAPI(
     content::BrowserContext* browser_context,
     const GURL& url,
+    bool private_api,
     const content::SocketPermissionRequest& params) {
 #if defined(ENABLE_PLUGINS)
   Profile* profile = Profile::FromBrowserContext(browser_context);
   const ExtensionSet* extension_set = NULL;
   if (profile) {
     extension_set = extensions::ExtensionSystem::Get(profile)->
         extension_service()->extensions();
   }
-  return IsExtensionOrSharedModuleWhitelisted(url,
-                                              extension_set,
-                                              allowed_socket_origins_,
-                                              switches::kAllowNaClSocketAPI);
+
+  if (private_api) {
+    // Access to private socket APIs is controlled by the whitelist.
+    if (IsExtensionOrSharedModuleWhitelisted(url, extension_set,
+                                             allowed_socket_origins_)) {
+      return true;
+    }
+  } else {
+    // Access to public socket APIs is controlled by extension permissions.
+    if (url.is_valid() && url.SchemeIs(extensions::kExtensionScheme) &&
+        extension_set) {
+      const Extension* extension = extension_set->GetByID(url.host());
+      if (extension) {
+        extensions::SocketPermission::CheckParam check_params(
+            params.type, params.host, params.port);
+        if (extensions::PermissionsData::CheckAPIPermissionWithParam(
+                extension, extensions::APIPermission::kSocket, &check_params)) {
+          return true;
+        }
+      }
+    }
+  }
+
+  // Allow both public and private APIs if the command line says so.
+  return IsHostAllowedByCommandLine(url, extension_set,
+                                    switches::kAllowNaClSocketAPI);
 #else
   return false;
 #endif
 }
 
 base::FilePath ChromeContentBrowserClient::GetHyphenDictionaryDirectory() {
   base::FilePath directory;
   PathService::Get(chrome::DIR_APP_DICTIONARIES, &directory);
   return directory.Append(FILE_PATH_LITERAL("Hyphen"));
 }
@@ skipping 123 matching lines @@
 #if defined(USE_NSS)
 crypto::CryptoModuleBlockingPasswordDelegate*
     ChromeContentBrowserClient::GetCryptoPasswordDelegate(
         const GURL& url) {
   return chrome::NewCryptoModuleBlockingDialogDelegate(
       chrome::kCryptoModulePasswordKeygen, url.host());
 }
 #endif
 
 }  // namespace chrome