This source file includes following definitions.
- can_send_midi_sysex_
- SecurityState
- GrantScheme
- RevokeScheme
- GrantPermissionsForFile
- GrantRequestOfSpecificFile
- RevokeAllPermissionsForFile
- GrantPermissionsForFileSystem
- HasPermissionsForFileSystem
- HasPermissionsForContentUri
- GrantBindings
- GrantReadRawCookies
- RevokeReadRawCookies
- GrantPermissionForMidiSysEx
- CanRequestURL
- HasPermissionsForFile
- CanLoadPage
- CanAccessCookiesForOrigin
- CanSendCookiesForOrigin
- LockToOrigin
- has_web_ui_bindings
- can_read_raw_cookies
- can_send_midi_sysex
- GetInstance
- GetInstance
- Add
- AddWorker
- Remove
- RegisterWebSafeScheme
- IsWebSafeScheme
- RegisterPseudoScheme
- IsPseudoScheme
- GrantRequestURL
- GrantRequestSpecificFileURL
- GrantReadFile
- GrantCreateReadWriteFile
- GrantCopyInto
- GrantDeleteFrom
- GrantPermissionsForFile
- RevokeAllPermissionsForFile
- GrantReadFileSystem
- GrantWriteFileSystem
- GrantCreateFileForFileSystem
- GrantCreateReadWriteFileSystem
- GrantCopyIntoFileSystem
- GrantDeleteFromFileSystem
- GrantSendMidiSysExMessage
- GrantScheme
- GrantWebUIBindings
- GrantReadRawCookies
- RevokeReadRawCookies
- CanLoadPage
- CanRequestURL
- CanReadFile
- CanCreateReadWriteFile
- CanReadFileSystem
- CanReadWriteFileSystem
- CanCopyIntoFileSystem
- CanDeleteFromFileSystem
- HasPermissionsForFile
- HasPermissionsForFileSystemFile
- CanReadFileSystemFile
- CanWriteFileSystemFile
- CanCreateFileSystemFile
- CanCreateReadWriteFileSystemFile
- CanCopyIntoFileSystemFile
- CanDeleteFileSystemFile
- HasWebUIBindings
- CanReadRawCookies
- AddChild
- ChildProcessHasPermissionsForFile
- CanAccessCookiesForOrigin
- CanSendCookiesForOrigin
- LockToOrigin
- GrantPermissionsForFileSystem
- HasPermissionsForFileSystem
- RegisterFileSystemPermissionPolicy
- CanSendMidiSysExMessage
#include "content/browser/child_process_security_policy_impl.h"
#include "base/command_line.h"
#include "base/files/file_path.h"
#include "base/logging.h"
#include "base/metrics/histogram.h"
#include "base/platform_file.h"
#include "base/stl_util.h"
#include "base/strings/string_util.h"
#include "content/browser/plugin_process_host.h"
#include "content/browser/site_instance_impl.h"
#include "content/public/browser/child_process_data.h"
#include "content/public/browser/content_browser_client.h"
#include "content/public/browser/render_process_host.h"
#include "content/public/common/bindings_policy.h"
#include "content/public/common/content_switches.h"
#include "content/public/common/url_constants.h"
#include "net/base/net_util.h"
#include "net/url_request/url_request.h"
#include "url/gurl.h"
#include "webkit/browser/fileapi/file_permission_policy.h"
#include "webkit/browser/fileapi/file_system_url.h"
#include "webkit/browser/fileapi/isolated_context.h"
#include "webkit/common/fileapi/file_system_util.h"
namespace content {
namespace {
enum ChildProcessSecurityPermissions {
READ_FILE_PERMISSION = 1 << 0,
WRITE_FILE_PERMISSION = 1 << 1,
CREATE_NEW_FILE_PERMISSION = 1 << 2,
CREATE_OVERWRITE_FILE_PERMISSION = 1 << 3,
DELETE_FILE_PERMISSION = 1 << 4,
COPY_INTO_FILE_PERMISSION = 1 << 5,
};
enum ChildProcessSecurityGrants {
READ_FILE_GRANT = READ_FILE_PERMISSION,
WRITE_FILE_GRANT = WRITE_FILE_PERMISSION,
CREATE_NEW_FILE_GRANT = CREATE_NEW_FILE_PERMISSION |
COPY_INTO_FILE_PERMISSION,
CREATE_READ_WRITE_FILE_GRANT = CREATE_NEW_FILE_PERMISSION |
CREATE_OVERWRITE_FILE_PERMISSION |
READ_FILE_PERMISSION |
WRITE_FILE_PERMISSION |
COPY_INTO_FILE_PERMISSION |
DELETE_FILE_PERMISSION,
COPY_INTO_FILE_GRANT = COPY_INTO_FILE_PERMISSION,
DELETE_FILE_GRANT = DELETE_FILE_PERMISSION,
};
}
class ChildProcessSecurityPolicyImpl::SecurityState {
public:
SecurityState()
: enabled_bindings_(0),
can_read_raw_cookies_(false),
can_send_midi_sysex_(false) { }
~SecurityState() {
scheme_policy_.clear();
fileapi::IsolatedContext* isolated_context =
fileapi::IsolatedContext::GetInstance();
for (FileSystemMap::iterator iter = filesystem_permissions_.begin();
iter != filesystem_permissions_.end();
++iter) {
isolated_context->RemoveReference(iter->first);
}
UMA_HISTOGRAM_COUNTS("ChildProcessSecurityPolicy.PerChildFilePermissions",
file_permissions_.size());
}
void GrantScheme(const std::string& scheme) {
scheme_policy_[scheme] = true;
}
void RevokeScheme(const std::string& scheme) {
scheme_policy_[scheme] = false;
}
void GrantPermissionsForFile(const base::FilePath& file, int permissions) {
base::FilePath stripped = file.StripTrailingSeparators();
file_permissions_[stripped] |= permissions;
UMA_HISTOGRAM_COUNTS("ChildProcessSecurityPolicy.FilePermissionPathLength",
stripped.value().size());
}
void GrantRequestOfSpecificFile(const base::FilePath &file) {
request_file_set_.insert(file.StripTrailingSeparators());
}
void RevokeAllPermissionsForFile(const base::FilePath& file) {
base::FilePath stripped = file.StripTrailingSeparators();
file_permissions_.erase(stripped);
request_file_set_.erase(stripped);
}
void GrantPermissionsForFileSystem(const std::string& filesystem_id,
int permissions) {
if (!ContainsKey(filesystem_permissions_, filesystem_id))
fileapi::IsolatedContext::GetInstance()->AddReference(filesystem_id);
filesystem_permissions_[filesystem_id] |= permissions;
}
bool HasPermissionsForFileSystem(const std::string& filesystem_id,
int permissions) {
FileSystemMap::const_iterator it =
filesystem_permissions_.find(filesystem_id);
if (it == filesystem_permissions_.end())
return false;
return (it->second & permissions) == permissions;
}
#if defined(OS_ANDROID)
bool HasPermissionsForContentUri(const base::FilePath& file,
int permissions) {
DCHECK(!file.empty());
DCHECK(file.IsContentUri());
if (!permissions)
return false;
base::FilePath file_path = file.StripTrailingSeparators();
FileMap::const_iterator it = file_permissions_.find(file_path);
if (it != file_permissions_.end())
return (it->second & permissions) == permissions;
return false;
}
#endif
void GrantBindings(int bindings) {
enabled_bindings_ |= bindings;
}
void GrantReadRawCookies() {
can_read_raw_cookies_ = true;
}
void RevokeReadRawCookies() {
can_read_raw_cookies_ = false;
}
void GrantPermissionForMidiSysEx() {
can_send_midi_sysex_ = true;
}
bool CanRequestURL(const GURL& url) {
SchemeMap::const_iterator judgment(scheme_policy_.find(url.scheme()));
if (judgment != scheme_policy_.end())
return judgment->second;
if (url.SchemeIs(kFileScheme)) {
base::FilePath path;
if (net::FileURLToFilePath(url, &path))
return ContainsKey(request_file_set_, path);
}
return false;
}
bool HasPermissionsForFile(const base::FilePath& file, int permissions) {
#if defined(OS_ANDROID)
if (file.IsContentUri())
return HasPermissionsForContentUri(file, permissions);
#endif
if (!permissions || file.empty() || !file.IsAbsolute())
return false;
base::FilePath current_path = file.StripTrailingSeparators();
base::FilePath last_path;
int skip = 0;
while (current_path != last_path) {
base::FilePath base_name = current_path.BaseName();
if (base_name.value() == base::FilePath::kParentDirectory) {
++skip;
} else if (skip > 0) {
if (base_name.value() != base::FilePath::kCurrentDirectory)
--skip;
} else {
FileMap::const_iterator it = file_permissions_.find(current_path);
if (it != file_permissions_.end())
return (it->second & permissions) == permissions;
}
last_path = current_path;
current_path = current_path.DirName();
}
return false;
}
bool CanLoadPage(const GURL& gurl) {
if (origin_lock_.is_empty())
return true;
GURL site_gurl = SiteInstanceImpl::GetSiteForURL(NULL, gurl);
return origin_lock_ == site_gurl;
}
bool CanAccessCookiesForOrigin(const GURL& gurl) {
if (origin_lock_.is_empty())
return true;
GURL site_gurl = SiteInstanceImpl::GetSiteForURL(NULL, gurl);
return origin_lock_ == site_gurl;
}
bool CanSendCookiesForOrigin(const GURL& gurl) {
const CommandLine& command_line = *CommandLine::ForCurrentProcess();
if (!command_line.HasSwitch(switches::kEnableStrictSiteIsolation))
return true;
if (origin_lock_.is_empty())
return true;
GURL site_gurl = SiteInstanceImpl::GetSiteForURL(NULL, gurl);
return origin_lock_ == site_gurl;
}
void LockToOrigin(const GURL& gurl) {
origin_lock_ = gurl;
}
bool has_web_ui_bindings() const {
return enabled_bindings_ & BINDINGS_POLICY_WEB_UI;
}
bool can_read_raw_cookies() const {
return can_read_raw_cookies_;
}
bool can_send_midi_sysex() const {
return can_send_midi_sysex_;
}
private:
typedef std::map<std::string, bool> SchemeMap;
typedef int FilePermissionFlags;
typedef std::map<base::FilePath, FilePermissionFlags> FileMap;
typedef std::map<std::string, FilePermissionFlags> FileSystemMap;
typedef std::set<base::FilePath> FileSet;
SchemeMap scheme_policy_;
FileMap file_permissions_;
FileSet request_file_set_;
int enabled_bindings_;
bool can_read_raw_cookies_;
bool can_send_midi_sysex_;
GURL origin_lock_;
FileSystemMap filesystem_permissions_;
DISALLOW_COPY_AND_ASSIGN(SecurityState);
};
ChildProcessSecurityPolicyImpl::ChildProcessSecurityPolicyImpl() {
RegisterWebSafeScheme(kHttpScheme);
RegisterWebSafeScheme(kHttpsScheme);
RegisterWebSafeScheme(kFtpScheme);
RegisterWebSafeScheme(kDataScheme);
RegisterWebSafeScheme("feed");
RegisterWebSafeScheme(kBlobScheme);
RegisterWebSafeScheme(kFileSystemScheme);
RegisterPseudoScheme(kAboutScheme);
RegisterPseudoScheme(kJavaScriptScheme);
RegisterPseudoScheme(kViewSourceScheme);
}
ChildProcessSecurityPolicyImpl::~ChildProcessSecurityPolicyImpl() {
web_safe_schemes_.clear();
pseudo_schemes_.clear();
STLDeleteContainerPairSecondPointers(security_state_.begin(),
security_state_.end());
security_state_.clear();
}
ChildProcessSecurityPolicy* ChildProcessSecurityPolicy::GetInstance() {
return ChildProcessSecurityPolicyImpl::GetInstance();
}
ChildProcessSecurityPolicyImpl* ChildProcessSecurityPolicyImpl::GetInstance() {
return Singleton<ChildProcessSecurityPolicyImpl>::get();
}
void ChildProcessSecurityPolicyImpl::Add(int child_id) {
base::AutoLock lock(lock_);
AddChild(child_id);
}
void ChildProcessSecurityPolicyImpl::AddWorker(int child_id,
int main_render_process_id) {
base::AutoLock lock(lock_);
AddChild(child_id);
worker_map_[child_id] = main_render_process_id;
}
void ChildProcessSecurityPolicyImpl::Remove(int child_id) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator it = security_state_.find(child_id);
if (it == security_state_.end())
return;
delete it->second;
security_state_.erase(it);
worker_map_.erase(child_id);
}
void ChildProcessSecurityPolicyImpl::RegisterWebSafeScheme(
const std::string& scheme) {
base::AutoLock lock(lock_);
DCHECK_EQ(0U, web_safe_schemes_.count(scheme)) << "Add schemes at most once.";
DCHECK_EQ(0U, pseudo_schemes_.count(scheme))
<< "Web-safe implies not pseudo.";
web_safe_schemes_.insert(scheme);
}
bool ChildProcessSecurityPolicyImpl::IsWebSafeScheme(
const std::string& scheme) {
base::AutoLock lock(lock_);
return ContainsKey(web_safe_schemes_, scheme);
}
void ChildProcessSecurityPolicyImpl::RegisterPseudoScheme(
const std::string& scheme) {
base::AutoLock lock(lock_);
DCHECK_EQ(0U, pseudo_schemes_.count(scheme)) << "Add schemes at most once.";
DCHECK_EQ(0U, web_safe_schemes_.count(scheme))
<< "Pseudo implies not web-safe.";
pseudo_schemes_.insert(scheme);
}
bool ChildProcessSecurityPolicyImpl::IsPseudoScheme(
const std::string& scheme) {
base::AutoLock lock(lock_);
return ContainsKey(pseudo_schemes_, scheme);
}
void ChildProcessSecurityPolicyImpl::GrantRequestURL(
int child_id, const GURL& url) {
if (!url.is_valid())
return;
if (IsWebSafeScheme(url.scheme()))
return;
if (IsPseudoScheme(url.scheme())) {
if (url.SchemeIs(kViewSourceScheme)) {
GrantRequestURL(child_id, GURL(url.GetContent()));
}
return;
}
{
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
state->second->GrantScheme(url.scheme());
}
}
void ChildProcessSecurityPolicyImpl::GrantRequestSpecificFileURL(
int child_id,
const GURL& url) {
if (!url.SchemeIs(kFileScheme))
return;
{
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
base::FilePath path;
if (net::FileURLToFilePath(url, &path))
state->second->GrantRequestOfSpecificFile(path);
}
}
void ChildProcessSecurityPolicyImpl::GrantReadFile(int child_id,
const base::FilePath& file) {
GrantPermissionsForFile(child_id, file, READ_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantCreateReadWriteFile(
int child_id, const base::FilePath& file) {
GrantPermissionsForFile(child_id, file, CREATE_READ_WRITE_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantCopyInto(int child_id,
const base::FilePath& dir) {
GrantPermissionsForFile(child_id, dir, COPY_INTO_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantDeleteFrom(
int child_id, const base::FilePath& dir) {
GrantPermissionsForFile(child_id, dir, DELETE_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantPermissionsForFile(
int child_id, const base::FilePath& file, int permissions) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
state->second->GrantPermissionsForFile(file, permissions);
}
void ChildProcessSecurityPolicyImpl::RevokeAllPermissionsForFile(
int child_id, const base::FilePath& file) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
state->second->RevokeAllPermissionsForFile(file);
}
void ChildProcessSecurityPolicyImpl::GrantReadFileSystem(
int child_id, const std::string& filesystem_id) {
GrantPermissionsForFileSystem(child_id, filesystem_id, READ_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantWriteFileSystem(
int child_id, const std::string& filesystem_id) {
GrantPermissionsForFileSystem(child_id, filesystem_id, WRITE_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantCreateFileForFileSystem(
int child_id, const std::string& filesystem_id) {
GrantPermissionsForFileSystem(child_id, filesystem_id, CREATE_NEW_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantCreateReadWriteFileSystem(
int child_id, const std::string& filesystem_id) {
GrantPermissionsForFileSystem(
child_id, filesystem_id, CREATE_READ_WRITE_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantCopyIntoFileSystem(
int child_id, const std::string& filesystem_id) {
GrantPermissionsForFileSystem(child_id, filesystem_id, COPY_INTO_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantDeleteFromFileSystem(
int child_id, const std::string& filesystem_id) {
GrantPermissionsForFileSystem(child_id, filesystem_id, DELETE_FILE_GRANT);
}
void ChildProcessSecurityPolicyImpl::GrantSendMidiSysExMessage(int child_id) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
state->second->GrantPermissionForMidiSysEx();
}
void ChildProcessSecurityPolicyImpl::GrantScheme(int child_id,
const std::string& scheme) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
state->second->GrantScheme(scheme);
}
void ChildProcessSecurityPolicyImpl::GrantWebUIBindings(int child_id) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
state->second->GrantBindings(BINDINGS_POLICY_WEB_UI);
state->second->GrantScheme(kChromeUIScheme);
state->second->GrantScheme(kFileScheme);
}
void ChildProcessSecurityPolicyImpl::GrantReadRawCookies(int child_id) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
state->second->GrantReadRawCookies();
}
void ChildProcessSecurityPolicyImpl::RevokeReadRawCookies(int child_id) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
state->second->RevokeReadRawCookies();
}
bool ChildProcessSecurityPolicyImpl::CanLoadPage(
int child_id,
const GURL& url,
ResourceType::Type resource_type) {
if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kSitePerProcess) &&
ResourceType::IsFrame(resource_type)) {
return true;
}
return true;
}
bool ChildProcessSecurityPolicyImpl::CanRequestURL(
int child_id, const GURL& url) {
if (!url.is_valid())
return false;
if (IsWebSafeScheme(url.scheme()))
return true;
if (IsPseudoScheme(url.scheme())) {
if (url.SchemeIs(kViewSourceScheme)) {
GURL child_url(url.GetContent());
if (child_url.SchemeIs(kViewSourceScheme) &&
url.SchemeIs(kViewSourceScheme))
return false;
return CanRequestURL(child_id, child_url);
}
if (LowerCaseEqualsASCII(url.spec(), kAboutBlankURL))
return true;
return false;
}
if (!GetContentClient()->browser()->IsHandledURL(url) &&
!net::URLRequest::IsHandledURL(url)) {
return true;
}
{
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return false;
return state->second->CanRequestURL(url);
}
}
bool ChildProcessSecurityPolicyImpl::CanReadFile(int child_id,
const base::FilePath& file) {
return HasPermissionsForFile(child_id, file, READ_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanCreateReadWriteFile(
int child_id,
const base::FilePath& file) {
return HasPermissionsForFile(child_id, file, CREATE_READ_WRITE_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanReadFileSystem(
int child_id, const std::string& filesystem_id) {
return HasPermissionsForFileSystem(child_id, filesystem_id, READ_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanReadWriteFileSystem(
int child_id, const std::string& filesystem_id) {
return HasPermissionsForFileSystem(child_id, filesystem_id,
READ_FILE_GRANT | WRITE_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanCopyIntoFileSystem(
int child_id, const std::string& filesystem_id) {
return HasPermissionsForFileSystem(child_id, filesystem_id,
COPY_INTO_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanDeleteFromFileSystem(
int child_id, const std::string& filesystem_id) {
return HasPermissionsForFileSystem(child_id, filesystem_id,
DELETE_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::HasPermissionsForFile(
int child_id, const base::FilePath& file, int permissions) {
base::AutoLock lock(lock_);
bool result = ChildProcessHasPermissionsForFile(child_id, file, permissions);
if (!result) {
WorkerToMainProcessMap::iterator iter = worker_map_.find(child_id);
if (iter != worker_map_.end() && iter->second != 0) {
result = ChildProcessHasPermissionsForFile(iter->second,
file,
permissions);
}
}
return result;
}
bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystemFile(
int child_id, const fileapi::FileSystemURL& url, int permissions) {
if (!url.is_valid())
return false;
if (url.path().ReferencesParent())
return false;
if (fileapi::VirtualPath::IsRootPath(url.path()) &&
(permissions & ~READ_FILE_GRANT)) {
return false;
}
if (url.mount_type() == fileapi::kFileSystemTypeIsolated) {
return HasPermissionsForFileSystem(
child_id, url.mount_filesystem_id(), permissions);
}
FileSystemPermissionPolicyMap::iterator found =
file_system_policy_map_.find(url.type());
if (found == file_system_policy_map_.end())
return false;
if ((found->second & fileapi::FILE_PERMISSION_READ_ONLY) &&
permissions & ~READ_FILE_GRANT) {
return false;
}
if (found->second & fileapi::FILE_PERMISSION_USE_FILE_PERMISSION)
return HasPermissionsForFile(child_id, url.path(), permissions);
if (found->second & fileapi::FILE_PERMISSION_SANDBOX)
return true;
return false;
}
bool ChildProcessSecurityPolicyImpl::CanReadFileSystemFile(
int child_id,
const fileapi::FileSystemURL& url) {
return HasPermissionsForFileSystemFile(child_id, url, READ_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanWriteFileSystemFile(
int child_id,
const fileapi::FileSystemURL& url) {
return HasPermissionsForFileSystemFile(child_id, url, WRITE_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanCreateFileSystemFile(
int child_id,
const fileapi::FileSystemURL& url) {
return HasPermissionsForFileSystemFile(child_id, url, CREATE_NEW_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanCreateReadWriteFileSystemFile(
int child_id,
const fileapi::FileSystemURL& url) {
return HasPermissionsForFileSystemFile(child_id, url,
CREATE_READ_WRITE_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanCopyIntoFileSystemFile(
int child_id,
const fileapi::FileSystemURL& url) {
return HasPermissionsForFileSystemFile(child_id, url, COPY_INTO_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::CanDeleteFileSystemFile(
int child_id,
const fileapi::FileSystemURL& url) {
return HasPermissionsForFileSystemFile(child_id, url, DELETE_FILE_GRANT);
}
bool ChildProcessSecurityPolicyImpl::HasWebUIBindings(int child_id) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return false;
return state->second->has_web_ui_bindings();
}
bool ChildProcessSecurityPolicyImpl::CanReadRawCookies(int child_id) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return false;
return state->second->can_read_raw_cookies();
}
void ChildProcessSecurityPolicyImpl::AddChild(int child_id) {
if (security_state_.count(child_id) != 0) {
NOTREACHED() << "Add child process at most once.";
return;
}
security_state_[child_id] = new SecurityState();
}
bool ChildProcessSecurityPolicyImpl::ChildProcessHasPermissionsForFile(
int child_id, const base::FilePath& file, int permissions) {
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return false;
return state->second->HasPermissionsForFile(file, permissions);
}
bool ChildProcessSecurityPolicyImpl::CanAccessCookiesForOrigin(
int child_id, const GURL& gurl) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return false;
return state->second->CanAccessCookiesForOrigin(gurl);
}
bool ChildProcessSecurityPolicyImpl::CanSendCookiesForOrigin(int child_id,
const GURL& gurl) {
for (PluginProcessHostIterator iter; !iter.Done(); ++iter) {
if (iter.GetData().id == child_id) {
if (iter.GetData().process_type == PROCESS_TYPE_PLUGIN) {
return true;
}
break;
}
}
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return false;
return state->second->CanSendCookiesForOrigin(gurl);
}
void ChildProcessSecurityPolicyImpl::LockToOrigin(int child_id,
const GURL& gurl) {
DCHECK(SiteInstanceImpl::GetSiteForURL(NULL, gurl) == gurl);
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
DCHECK(state != security_state_.end());
state->second->LockToOrigin(gurl);
}
void ChildProcessSecurityPolicyImpl::GrantPermissionsForFileSystem(
int child_id,
const std::string& filesystem_id,
int permission) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return;
state->second->GrantPermissionsForFileSystem(filesystem_id, permission);
}
bool ChildProcessSecurityPolicyImpl::HasPermissionsForFileSystem(
int child_id,
const std::string& filesystem_id,
int permission) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return false;
return state->second->HasPermissionsForFileSystem(filesystem_id, permission);
}
void ChildProcessSecurityPolicyImpl::RegisterFileSystemPermissionPolicy(
fileapi::FileSystemType type,
int policy) {
base::AutoLock lock(lock_);
file_system_policy_map_[type] = policy;
}
bool ChildProcessSecurityPolicyImpl::CanSendMidiSysExMessage(int child_id) {
base::AutoLock lock(lock_);
SecurityStateMap::iterator state = security_state_.find(child_id);
if (state == security_state_.end())
return false;
return state->second->can_send_midi_sysex();
}
}