OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/browser/renderer_host/render_view_host_impl.h" | 5 #include "content/browser/renderer_host/render_view_host_impl.h" |
6 | 6 |
7 #include <set> | 7 #include <set> |
8 #include <string> | 8 #include <string> |
9 #include <utility> | 9 #include <utility> |
10 #include <vector> | 10 #include <vector> |
(...skipping 39 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
50 #include "content/public/browser/notification_details.h" | 50 #include "content/public/browser/notification_details.h" |
51 #include "content/public/browser/notification_service.h" | 51 #include "content/public/browser/notification_service.h" |
52 #include "content/public/browser/notification_types.h" | 52 #include "content/public/browser/notification_types.h" |
53 #include "content/public/browser/power_save_blocker.h" | 53 #include "content/public/browser/power_save_blocker.h" |
54 #include "content/public/browser/render_view_host_observer.h" | 54 #include "content/public/browser/render_view_host_observer.h" |
55 #include "content/public/browser/user_metrics.h" | 55 #include "content/public/browser/user_metrics.h" |
56 #include "content/public/common/bindings_policy.h" | 56 #include "content/public/common/bindings_policy.h" |
57 #include "content/public/common/content_constants.h" | 57 #include "content/public/common/content_constants.h" |
58 #include "content/public/common/content_switches.h" | 58 #include "content/public/common/content_switches.h" |
59 #include "content/public/common/context_menu_params.h" | 59 #include "content/public/common/context_menu_params.h" |
| 60 #include "content/public/common/drop_data.h" |
60 #include "content/public/common/result_codes.h" | 61 #include "content/public/common/result_codes.h" |
61 #include "content/public/common/url_constants.h" | 62 #include "content/public/common/url_constants.h" |
62 #include "content/public/common/url_utils.h" | 63 #include "content/public/common/url_utils.h" |
63 #include "net/base/net_util.h" | 64 #include "net/base/net_util.h" |
64 #include "net/url_request/url_request_context_getter.h" | 65 #include "net/url_request/url_request_context_getter.h" |
65 #include "third_party/skia/include/core/SkBitmap.h" | 66 #include "third_party/skia/include/core/SkBitmap.h" |
66 #include "ui/gfx/image/image_skia.h" | 67 #include "ui/gfx/image/image_skia.h" |
67 #include "ui/gfx/native_widget_types.h" | 68 #include "ui/gfx/native_widget_types.h" |
68 #include "ui/shell_dialogs/selected_file_info.h" | 69 #include "ui/shell_dialogs/selected_file_info.h" |
69 #include "ui/snapshot/snapshot.h" | 70 #include "ui/snapshot/snapshot.h" |
70 #include "webkit/browser/fileapi/isolated_context.h" | 71 #include "webkit/browser/fileapi/isolated_context.h" |
71 #include "webkit/common/webdropdata.h" | |
72 | 72 |
73 #if defined(OS_MACOSX) | 73 #if defined(OS_MACOSX) |
74 #include "content/browser/renderer_host/popup_menu_helper_mac.h" | 74 #include "content/browser/renderer_host/popup_menu_helper_mac.h" |
75 #elif defined(OS_ANDROID) | 75 #elif defined(OS_ANDROID) |
76 #include "media/base/android/media_player_manager.h" | 76 #include "media/base/android/media_player_manager.h" |
77 #endif | 77 #endif |
78 | 78 |
79 using base::TimeDelta; | 79 using base::TimeDelta; |
80 using WebKit::WebConsoleMessage; | 80 using WebKit::WebConsoleMessage; |
81 using WebKit::WebDragOperation; | 81 using WebKit::WebDragOperation; |
(...skipping 482 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
564 Send(new InputMsg_ActivateNearestFindResult(GetRoutingID(), | 564 Send(new InputMsg_ActivateNearestFindResult(GetRoutingID(), |
565 request_id, x, y)); | 565 request_id, x, y)); |
566 } | 566 } |
567 | 567 |
568 void RenderViewHostImpl::RequestFindMatchRects(int current_version) { | 568 void RenderViewHostImpl::RequestFindMatchRects(int current_version) { |
569 Send(new ViewMsg_FindMatchRects(GetRoutingID(), current_version)); | 569 Send(new ViewMsg_FindMatchRects(GetRoutingID(), current_version)); |
570 } | 570 } |
571 #endif | 571 #endif |
572 | 572 |
573 void RenderViewHostImpl::DragTargetDragEnter( | 573 void RenderViewHostImpl::DragTargetDragEnter( |
574 const WebDropData& drop_data, | 574 const DropData& drop_data, |
575 const gfx::Point& client_pt, | 575 const gfx::Point& client_pt, |
576 const gfx::Point& screen_pt, | 576 const gfx::Point& screen_pt, |
577 WebDragOperationsMask operations_allowed, | 577 WebDragOperationsMask operations_allowed, |
578 int key_modifiers) { | 578 int key_modifiers) { |
579 const int renderer_id = GetProcess()->GetID(); | 579 const int renderer_id = GetProcess()->GetID(); |
580 ChildProcessSecurityPolicyImpl* policy = | 580 ChildProcessSecurityPolicyImpl* policy = |
581 ChildProcessSecurityPolicyImpl::GetInstance(); | 581 ChildProcessSecurityPolicyImpl::GetInstance(); |
582 | 582 |
583 // The URL could have been cobbled together from any highlighted text string, | 583 // The URL could have been cobbled together from any highlighted text string, |
584 // and can't be interpreted as a capability. | 584 // and can't be interpreted as a capability. |
585 WebDropData filtered_data(drop_data); | 585 DropData filtered_data(drop_data); |
586 FilterURL(policy, GetProcess(), true, &filtered_data.url); | 586 FilterURL(policy, GetProcess(), true, &filtered_data.url); |
587 | 587 |
588 // The filenames vector, on the other hand, does represent a capability to | 588 // The filenames vector, on the other hand, does represent a capability to |
589 // access the given files. | 589 // access the given files. |
590 fileapi::IsolatedContext::FileInfoSet files; | 590 fileapi::IsolatedContext::FileInfoSet files; |
591 for (std::vector<WebDropData::FileInfo>::iterator iter( | 591 for (std::vector<DropData::FileInfo>::iterator iter( |
592 filtered_data.filenames.begin()); | 592 filtered_data.filenames.begin()); |
593 iter != filtered_data.filenames.end(); ++iter) { | 593 iter != filtered_data.filenames.end(); ++iter) { |
594 // A dragged file may wind up as the value of an input element, or it | 594 // A dragged file may wind up as the value of an input element, or it |
595 // may be used as the target of a navigation instead. We don't know | 595 // may be used as the target of a navigation instead. We don't know |
596 // which will happen at this point, so generously grant both access | 596 // which will happen at this point, so generously grant both access |
597 // and request permissions to the specific file to cover both cases. | 597 // and request permissions to the specific file to cover both cases. |
598 // We do not give it the permission to request all file:// URLs. | 598 // We do not give it the permission to request all file:// URLs. |
599 base::FilePath path = | 599 base::FilePath path = |
600 base::FilePath::FromUTF8Unsafe(UTF16ToUTF8(iter->path)); | 600 base::FilePath::FromUTF8Unsafe(UTF16ToUTF8(iter->path)); |
601 | 601 |
(...skipping 835 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1437 bool is_reload, | 1437 bool is_reload, |
1438 IPC::Message* reply_msg) { | 1438 IPC::Message* reply_msg) { |
1439 // While a JS before unload dialog is showing, tabs in the same process | 1439 // While a JS before unload dialog is showing, tabs in the same process |
1440 // shouldn't process input events. | 1440 // shouldn't process input events. |
1441 GetProcess()->SetIgnoreInputEvents(true); | 1441 GetProcess()->SetIgnoreInputEvents(true); |
1442 StopHangMonitorTimeout(); | 1442 StopHangMonitorTimeout(); |
1443 delegate_->RunBeforeUnloadConfirm(this, message, is_reload, reply_msg); | 1443 delegate_->RunBeforeUnloadConfirm(this, message, is_reload, reply_msg); |
1444 } | 1444 } |
1445 | 1445 |
1446 void RenderViewHostImpl::OnStartDragging( | 1446 void RenderViewHostImpl::OnStartDragging( |
1447 const WebDropData& drop_data, | 1447 const DropData& drop_data, |
1448 WebDragOperationsMask drag_operations_mask, | 1448 WebDragOperationsMask drag_operations_mask, |
1449 const SkBitmap& bitmap, | 1449 const SkBitmap& bitmap, |
1450 const gfx::Vector2d& bitmap_offset_in_dip, | 1450 const gfx::Vector2d& bitmap_offset_in_dip, |
1451 const DragEventSourceInfo& event_info) { | 1451 const DragEventSourceInfo& event_info) { |
1452 RenderViewHostDelegateView* view = delegate_->GetDelegateView(); | 1452 RenderViewHostDelegateView* view = delegate_->GetDelegateView(); |
1453 if (!view) | 1453 if (!view) |
1454 return; | 1454 return; |
1455 | 1455 |
1456 WebDropData filtered_data(drop_data); | 1456 DropData filtered_data(drop_data); |
1457 RenderProcessHost* process = GetProcess(); | 1457 RenderProcessHost* process = GetProcess(); |
1458 ChildProcessSecurityPolicyImpl* policy = | 1458 ChildProcessSecurityPolicyImpl* policy = |
1459 ChildProcessSecurityPolicyImpl::GetInstance(); | 1459 ChildProcessSecurityPolicyImpl::GetInstance(); |
1460 | 1460 |
1461 // Allow drag of Javascript URLs to enable bookmarklet drag to bookmark bar. | 1461 // Allow drag of Javascript URLs to enable bookmarklet drag to bookmark bar. |
1462 if (!filtered_data.url.SchemeIs(chrome::kJavaScriptScheme)) | 1462 if (!filtered_data.url.SchemeIs(chrome::kJavaScriptScheme)) |
1463 FilterURL(policy, process, true, &filtered_data.url); | 1463 FilterURL(policy, process, true, &filtered_data.url); |
1464 FilterURL(policy, process, false, &filtered_data.html_base_url); | 1464 FilterURL(policy, process, false, &filtered_data.html_base_url); |
1465 // Filter out any paths that the renderer didn't have access to. This prevents | 1465 // Filter out any paths that the renderer didn't have access to. This prevents |
1466 // the following attack on a malicious renderer: | 1466 // the following attack on a malicious renderer: |
1467 // 1. StartDragging IPC sent with renderer-specified filesystem paths that it | 1467 // 1. StartDragging IPC sent with renderer-specified filesystem paths that it |
1468 // doesn't have read permissions for. | 1468 // doesn't have read permissions for. |
1469 // 2. We initiate a native DnD operation. | 1469 // 2. We initiate a native DnD operation. |
1470 // 3. DnD operation immediately ends since mouse is not held down. DnD events | 1470 // 3. DnD operation immediately ends since mouse is not held down. DnD events |
1471 // still fire though, which causes read permissions to be granted to the | 1471 // still fire though, which causes read permissions to be granted to the |
1472 // renderer for any file paths in the drop. | 1472 // renderer for any file paths in the drop. |
1473 filtered_data.filenames.clear(); | 1473 filtered_data.filenames.clear(); |
1474 for (std::vector<WebDropData::FileInfo>::const_iterator it = | 1474 for (std::vector<DropData::FileInfo>::const_iterator it = |
1475 drop_data.filenames.begin(); | 1475 drop_data.filenames.begin(); |
1476 it != drop_data.filenames.end(); ++it) { | 1476 it != drop_data.filenames.end(); ++it) { |
1477 base::FilePath path(base::FilePath::FromUTF8Unsafe(UTF16ToUTF8(it->path))); | 1477 base::FilePath path(base::FilePath::FromUTF8Unsafe(UTF16ToUTF8(it->path))); |
1478 if (policy->CanReadFile(GetProcess()->GetID(), path)) | 1478 if (policy->CanReadFile(GetProcess()->GetID(), path)) |
1479 filtered_data.filenames.push_back(*it); | 1479 filtered_data.filenames.push_back(*it); |
1480 } | 1480 } |
1481 ui::ScaleFactor scale_factor = GetScaleFactorForView(GetView()); | 1481 ui::ScaleFactor scale_factor = GetScaleFactorForView(GetView()); |
1482 gfx::ImageSkia image(gfx::ImageSkiaRep(bitmap, scale_factor)); | 1482 gfx::ImageSkia image(gfx::ImageSkiaRep(bitmap, scale_factor)); |
1483 view->StartDragging(filtered_data, drag_operations_mask, image, | 1483 view->StartDragging(filtered_data, drag_operations_mask, image, |
1484 bitmap_offset_in_dip, event_info); | 1484 bitmap_offset_in_dip, event_info); |
(...skipping 584 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
2069 const std::vector<base::FilePath>& file_paths = state.GetReferencedFiles(); | 2069 const std::vector<base::FilePath>& file_paths = state.GetReferencedFiles(); |
2070 for (std::vector<base::FilePath>::const_iterator file = file_paths.begin(); | 2070 for (std::vector<base::FilePath>::const_iterator file = file_paths.begin(); |
2071 file != file_paths.end(); ++file) { | 2071 file != file_paths.end(); ++file) { |
2072 if (!policy->CanReadFile(GetProcess()->GetID(), *file)) | 2072 if (!policy->CanReadFile(GetProcess()->GetID(), *file)) |
2073 return false; | 2073 return false; |
2074 } | 2074 } |
2075 return true; | 2075 return true; |
2076 } | 2076 } |
2077 | 2077 |
2078 } // namespace content | 2078 } // namespace content |
OLD | NEW |