Limiting the "Cookies and site data" form to "web safe" schemes.

chrome/browser/browsing_data_database_helper.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/browsing_data_database_helper.h"
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/file_util.h"
 #include "base/message_loop.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/browser/profiles/profile.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/child_process_security_policy.h"
 #include "net/base/completion_callback.h"
 #include "net/base/net_errors.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"

[jochen (gone - plz use gerrit), 2012/04/03 09:41:21]

nit. W > p

[Mike West, 2012/04/03 14:45:51]

Not according to vim! :)

Fixed.

 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebCString.h"
-#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebString.h"
 
 using content::BrowserContext;
 using content::BrowserThread;
 using WebKit::WebSecurityOrigin;
 
 BrowsingDataDatabaseHelper::DatabaseInfo::DatabaseInfo()
     : size(0) {
 }
 
@@ skipping 56 matching lines @@
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       base::Bind(&BrowsingDataDatabaseHelper::DeleteDatabaseOnFileThread, this,
                  origin, name));
 }
 
 void BrowsingDataDatabaseHelper::FetchDatabaseInfoOnFileThread() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::FILE));
   std::vector<webkit_database::OriginInfo> origins_info;
   if (tracker_.get() && tracker_->GetAllOriginsInfo(&origins_info)) {
+    content::ChildProcessSecurityPolicy* policy =
+        content::ChildProcessSecurityPolicy::GetInstance();
     for (std::vector<webkit_database::OriginInfo>::const_iterator ori =
          origins_info.begin(); ori != origins_info.end(); ++ori) {
-      const std::string origin_identifier(UTF16ToUTF8(ori->GetOrigin()));
-      if (StartsWithASCII(origin_identifier,
-                          std::string(chrome::kExtensionScheme),
-                          true)) {
-        // Extension state is not considered browsing data.
+      const GURL origin(UTF16ToUTF8(ori->GetOrigin()));
+      if (policy->IsWebSafeScheme(origin.scheme())) {

[jochen (gone - plz use gerrit), 2012/04/03 09:41:21]

forgot ! ?

[Mike West, 2012/04/03 14:45:51]

Done.

+        // Non-websafe state is not considered browsing data.
         continue;
       }
       WebSecurityOrigin web_security_origin =
           WebSecurityOrigin::createFromDatabaseIdentifier(
               ori->GetOrigin());
       std::vector<string16> databases;
       ori->GetAllDatabaseNames(&databases);
       for (std::vector<string16>::const_iterator db = databases.begin();
            db != databases.end(); ++db) {
         FilePath file_path = tracker_->GetFullDBFilePath(ori->GetOrigin(), *db);
         base::PlatformFileInfo file_info;
         if (file_util::GetFileInfo(file_path, &file_info)) {
           database_info_.push_back(DatabaseInfo(
                 web_security_origin.host().utf8(),
                 UTF16ToUTF8(*db),
-                origin_identifier,
+                UTF16ToUTF8(ori->GetOrigin()),
                 UTF16ToUTF8(ori->GetDatabaseDescription(*db)),
                 web_security_origin.toString().utf8(),
                 file_info.size,
                 file_info.last_modified));
         }
       }
     }
   }
 
   BrowserThread::PostTask(
@@ skipping 52 matching lines @@
   clone->pending_database_info_ = pending_database_info_;
   clone->database_info_ = database_info_;
   return clone;
 }
 
 void CannedBrowsingDataDatabaseHelper::AddDatabase(
     const GURL& origin,
     const std::string& name,
     const std::string& description) {
   base::AutoLock auto_lock(lock_);
-  pending_database_info_.push_back(PendingDatabaseInfo(
-        origin, name, description));
+  content::ChildProcessSecurityPolicy* policy =
+      content::ChildProcessSecurityPolicy::GetInstance();
+  if (policy->IsWebSafeScheme(origin.scheme())) {
+    pending_database_info_.push_back(PendingDatabaseInfo(
+          origin, name, description));
+  }
 }
 
 void CannedBrowsingDataDatabaseHelper::Reset() {
   base::AutoLock auto_lock(lock_);
   database_info_.clear();
   pending_database_info_.clear();
 }
 
 bool CannedBrowsingDataDatabaseHelper::empty() const {
   base::AutoLock auto_lock(lock_);
@@ skipping 47 matching lines @@
         web_security_origin.toString().utf8(),
         0,
         base::Time()));
   }
   pending_database_info_.clear();
 
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
       base::Bind(&CannedBrowsingDataDatabaseHelper::NotifyInUIThread, this));
 }