content/renderer/pepper/message_channel.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/renderer/pepper/message_channel.h"
   6
   7 #include <cstdlib>
   8 #include <string>
   9
  10 #include "base/bind.h"
  11 #include "base/logging.h"
  12 #include "base/message_loop/message_loop.h"
  13 #include "content/public/common/content_client.h"
  14 #include "content/public/renderer/content_renderer_client.h"
  15 #include "content/renderer/pepper/host_array_buffer_var.h"
  16 #include "content/renderer/pepper/npapi_glue.h"
  17 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
  18 #include "content/renderer/pepper/plugin_module.h"
  19 #include "content/renderer/pepper/v8_var_converter.h"
  20 #include "ppapi/shared_impl/ppapi_globals.h"
  21 #include "ppapi/shared_impl/scoped_pp_var.h"
  22 #include "ppapi/shared_impl/var.h"
  23 #include "ppapi/shared_impl/var_tracker.h"
  24 #include "third_party/WebKit/public/web/WebBindings.h"
  25 #include "third_party/WebKit/public/web/WebDocument.h"
  26 #include "third_party/WebKit/public/web/WebDOMMessageEvent.h"
  27 #include "third_party/WebKit/public/web/WebElement.h"
  28 #include "third_party/WebKit/public/web/WebLocalFrame.h"
  29 #include "third_party/WebKit/public/web/WebNode.h"
  30 #include "third_party/WebKit/public/web/WebPluginContainer.h"
  31 #include "third_party/WebKit/public/web/WebSerializedScriptValue.h"
  32 #include "v8/include/v8.h"
  33
  34 using ppapi::ArrayBufferVar;
  35 using ppapi::PpapiGlobals;
  36 using ppapi::ScopedPPVar;
  37 using ppapi::StringVar;
  38 using blink::WebBindings;
  39 using blink::WebElement;
  40 using blink::WebDOMEvent;
  41 using blink::WebDOMMessageEvent;
  42 using blink::WebPluginContainer;
  43 using blink::WebSerializedScriptValue;
  44
  45 namespace content {
  46
  47 namespace {
  48
  49 const char kPostMessage[] = "postMessage";
  50 const char kPostMessageAndAwaitResponse[] = "postMessageAndAwaitResponse";
  51 const char kV8ToVarConversionError[] =
  52     "Failed to convert a PostMessage "
  53     "argument from a JavaScript value to a PP_Var. It may have cycles or be of "
  54     "an unsupported type.";
  55 const char kVarToV8ConversionError[] =
  56     "Failed to convert a PostMessage "
  57     "argument from a PP_Var to a Javascript value. It may have cycles or be of "
  58     "an unsupported type.";
  59
  60 // Helper function to get the MessageChannel that is associated with an
  61 // NPObject*.
  62 MessageChannel* ToMessageChannel(NPObject* object) {
  63   return static_cast<MessageChannel::MessageChannelNPObject*>(object)
  64       ->message_channel.get();
  65 }
  66
  67 NPObject* ToPassThroughObject(NPObject* object) {
  68   MessageChannel* channel = ToMessageChannel(object);
  69   return channel ? channel->passthrough_object() : NULL;
  70 }
  71
  72 // Return true iff |identifier| is equal to |string|.
  73 bool IdentifierIs(NPIdentifier identifier, const char string[]) {
  74   return WebBindings::getStringIdentifier(string) == identifier;
  75 }
  76
  77 bool HasDevChannelPermission(NPObject* channel_object) {
  78   MessageChannel* channel = ToMessageChannel(channel_object);
  79   if (!channel)
  80     return false;
  81   return GetContentClient()->renderer()->IsPluginAllowedToUseDevChannelAPIs();
  82 }
  83
  84 //------------------------------------------------------------------------------
  85 // Implementations of NPClass functions.  These are here to:
  86 // - Implement postMessage behavior.
  87 // - Forward calls to the 'passthrough' object to allow backwards-compatibility
  88 //   with GetInstanceObject() objects.
  89 //------------------------------------------------------------------------------
  90 NPObject* MessageChannelAllocate(NPP npp, NPClass* the_class) {
  91   return new MessageChannel::MessageChannelNPObject;
  92 }
  93
  94 void MessageChannelDeallocate(NPObject* object) {
  95   MessageChannel::MessageChannelNPObject* instance =
  96       static_cast<MessageChannel::MessageChannelNPObject*>(object);
  97   delete instance;
  98 }
  99
 100 bool MessageChannelHasMethod(NPObject* np_obj, NPIdentifier name) {
 101   if (!np_obj)
 102     return false;
 103
 104   if (IdentifierIs(name, kPostMessage))
 105     return true;
 106   if (IdentifierIs(name, kPostMessageAndAwaitResponse) &&
 107       HasDevChannelPermission(np_obj)) {
 108     return true;
 109   }
 110   // Other method names we will pass to the passthrough object, if we have one.
 111   NPObject* passthrough = ToPassThroughObject(np_obj);
 112   if (passthrough)
 113     return WebBindings::hasMethod(NULL, passthrough, name);
 114   return false;
 115 }
 116
 117 bool MessageChannelInvoke(NPObject* np_obj,
 118                           NPIdentifier name,
 119                           const NPVariant* args,
 120                           uint32 arg_count,
 121                           NPVariant* result) {
 122   if (!np_obj)
 123     return false;
 124
 125   MessageChannel* message_channel = ToMessageChannel(np_obj);
 126   if (!message_channel)
 127     return false;
 128
 129   // Check to see if we should handle this function ourselves.
 130   if (IdentifierIs(name, kPostMessage) && (arg_count == 1)) {
 131     message_channel->PostMessageToNative(&args[0]);
 132     return true;
 133   } else if (IdentifierIs(name, kPostMessageAndAwaitResponse) &&
 134              (arg_count == 1) &&
 135              HasDevChannelPermission(np_obj)) {
 136     message_channel->PostBlockingMessageToNative(&args[0], result);
 137     return true;
 138   }
 139
 140   // Other method calls we will pass to the passthrough object, if we have one.
 141   NPObject* passthrough = ToPassThroughObject(np_obj);
 142   if (passthrough) {
 143     return WebBindings::invoke(
 144         NULL, passthrough, name, args, arg_count, result);
 145   }
 146   return false;
 147 }
 148
 149 bool MessageChannelInvokeDefault(NPObject* np_obj,
 150                                  const NPVariant* args,
 151                                  uint32 arg_count,
 152                                  NPVariant* result) {
 153   if (!np_obj)
 154     return false;
 155
 156   // Invoke on the passthrough object, if we have one.
 157   NPObject* passthrough = ToPassThroughObject(np_obj);
 158   if (passthrough) {
 159     return WebBindings::invokeDefault(
 160         NULL, passthrough, args, arg_count, result);
 161   }
 162   return false;
 163 }
 164
 165 bool MessageChannelHasProperty(NPObject* np_obj, NPIdentifier name) {
 166   if (!np_obj)
 167     return false;
 168
 169   MessageChannel* message_channel = ToMessageChannel(np_obj);
 170   if (message_channel) {
 171     if (message_channel->GetReadOnlyProperty(name, NULL))
 172       return true;
 173   }
 174
 175   // Invoke on the passthrough object, if we have one.
 176   NPObject* passthrough = ToPassThroughObject(np_obj);
 177   if (passthrough)
 178     return WebBindings::hasProperty(NULL, passthrough, name);
 179   return false;
 180 }
 181
 182 bool MessageChannelGetProperty(NPObject* np_obj,
 183                                NPIdentifier name,
 184                                NPVariant* result) {
 185   if (!np_obj)
 186     return false;
 187
 188   // Don't allow getting the postMessage functions.
 189   if (IdentifierIs(name, kPostMessage))
 190     return false;
 191   if (IdentifierIs(name, kPostMessageAndAwaitResponse) &&
 192       HasDevChannelPermission(np_obj)) {
 193      return false;
 194   }
 195   MessageChannel* message_channel = ToMessageChannel(np_obj);
 196   if (message_channel) {
 197     if (message_channel->GetReadOnlyProperty(name, result))
 198       return true;
 199   }
 200
 201   // Invoke on the passthrough object, if we have one.
 202   NPObject* passthrough = ToPassThroughObject(np_obj);
 203   if (passthrough)
 204     return WebBindings::getProperty(NULL, passthrough, name, result);
 205   return false;
 206 }
 207
 208 bool MessageChannelSetProperty(NPObject* np_obj,
 209                                NPIdentifier name,
 210                                const NPVariant* variant) {
 211   if (!np_obj)
 212     return false;
 213
 214   // Don't allow setting the postMessage functions.
 215   if (IdentifierIs(name, kPostMessage))
 216     return false;
 217   if (IdentifierIs(name, kPostMessageAndAwaitResponse) &&
 218       HasDevChannelPermission(np_obj)) {
 219     return false;
 220   }
 221   // Invoke on the passthrough object, if we have one.
 222   NPObject* passthrough = ToPassThroughObject(np_obj);
 223   if (passthrough)
 224     return WebBindings::setProperty(NULL, passthrough, name, variant);
 225   return false;
 226 }
 227
 228 bool MessageChannelEnumerate(NPObject* np_obj,
 229                              NPIdentifier** value,
 230                              uint32_t* count) {
 231   if (!np_obj)
 232     return false;
 233
 234   // Invoke on the passthrough object, if we have one, to enumerate its
 235   // properties.
 236   NPObject* passthrough = ToPassThroughObject(np_obj);
 237   if (passthrough) {
 238     bool success = WebBindings::enumerate(NULL, passthrough, value, count);
 239     if (success) {
 240       // Add postMessage to the list and return it.
 241       if (std::numeric_limits<size_t>::max() / sizeof(NPIdentifier) <=
 242           static_cast<size_t>(*count) + 1)  // Else, "always false" x64 warning.
 243         return false;
 244       NPIdentifier* new_array = static_cast<NPIdentifier*>(
 245           std::malloc(sizeof(NPIdentifier) * (*count + 1)));
 246       std::memcpy(new_array, *value, sizeof(NPIdentifier) * (*count));
 247       new_array[*count] = WebBindings::getStringIdentifier(kPostMessage);
 248       std::free(*value);
 249       *value = new_array;
 250       ++(*count);
 251       return true;
 252     }
 253   }
 254
 255   // Otherwise, build an array that includes only postMessage.
 256   *value = static_cast<NPIdentifier*>(malloc(sizeof(NPIdentifier)));
 257   (*value)[0] = WebBindings::getStringIdentifier(kPostMessage);
 258   *count = 1;
 259   return true;
 260 }
 261
 262 NPClass message_channel_class = {
 263     NP_CLASS_STRUCT_VERSION,      &MessageChannelAllocate,
 264     &MessageChannelDeallocate,    NULL,
 265     &MessageChannelHasMethod,     &MessageChannelInvoke,
 266     &MessageChannelInvokeDefault, &MessageChannelHasProperty,
 267     &MessageChannelGetProperty,   &MessageChannelSetProperty,
 268     NULL,                         &MessageChannelEnumerate, };
 269
 270 }  // namespace
 271
 272 // MessageChannel --------------------------------------------------------------
 273 struct MessageChannel::VarConversionResult {
 274   VarConversionResult() : success_(false), conversion_completed_(false) {}
 275   void ConversionCompleted(const ScopedPPVar& var,
 276                            bool success) {
 277     conversion_completed_ = true;
 278     var_ = var;
 279     success_ = success;
 280   }
 281   const ScopedPPVar& var() const { return var_; }
 282   bool success() const { return success_; }
 283   bool conversion_completed() const { return conversion_completed_; }
 284
 285  private:
 286   ScopedPPVar var_;
 287   bool success_;
 288   bool conversion_completed_;
 289 };
 290
 291 MessageChannel::MessageChannelNPObject::MessageChannelNPObject() {}
 292
 293 MessageChannel::MessageChannelNPObject::~MessageChannelNPObject() {}
 294
 295 MessageChannel::MessageChannel(PepperPluginInstanceImpl* instance)
 296     : instance_(instance),
 297       passthrough_object_(NULL),
 298       np_object_(NULL),
 299       early_message_queue_state_(QUEUE_MESSAGES),
 300       weak_ptr_factory_(this) {
 301   // Now create an NPObject for receiving calls to postMessage. This sets the
 302   // reference count to 1.  We release it in the destructor.
 303   NPObject* obj = WebBindings::createObject(instance_->instanceNPP(),
 304                                             &message_channel_class);
 305   DCHECK(obj);
 306   np_object_ = static_cast<MessageChannel::MessageChannelNPObject*>(obj);
 307   np_object_->message_channel = weak_ptr_factory_.GetWeakPtr();
 308 }
 309
 310 MessageChannel::~MessageChannel() {
 311   WebBindings::releaseObject(np_object_);
 312   if (passthrough_object_)
 313     WebBindings::releaseObject(passthrough_object_);
 314 }
 315
 316 void MessageChannel::Start() {
 317   // We PostTask here instead of draining the message queue directly
 318   // since we haven't finished initializing the PepperWebPluginImpl yet, so
 319   // the plugin isn't available in the DOM.
 320   base::MessageLoop::current()->PostTask(
 321       FROM_HERE,
 322       base::Bind(&MessageChannel::DrainEarlyMessageQueue,
 323                  weak_ptr_factory_.GetWeakPtr()));
 324 }
 325
 326 void MessageChannel::SetPassthroughObject(NPObject* passthrough) {
 327   // Retain the passthrough object; We need to ensure it lives as long as this
 328   // MessageChannel.
 329   if (passthrough)
 330     WebBindings::retainObject(passthrough);
 331
 332   // If we had a passthrough set already, release it. Note that we retain the
 333   // incoming passthrough object first, so that we behave correctly if anyone
 334   // invokes:
 335   //   SetPassthroughObject(passthrough_object());
 336   if (passthrough_object_)
 337     WebBindings::releaseObject(passthrough_object_);
 338
 339   passthrough_object_ = passthrough;
 340 }
 341
 342 bool MessageChannel::GetReadOnlyProperty(NPIdentifier key,
 343                                          NPVariant* value) const {
 344   std::map<NPIdentifier, ScopedPPVar>::const_iterator it =
 345       internal_properties_.find(key);
 346   if (it != internal_properties_.end()) {
 347     if (value)
 348       return PPVarToNPVariant(it->second.get(), value);
 349     return true;
 350   }
 351   return false;
 352 }
 353
 354 void MessageChannel::SetReadOnlyProperty(PP_Var key, PP_Var value) {
 355   internal_properties_[PPVarToNPIdentifier(key)] = ScopedPPVar(value);
 356 }
 357
 358 void MessageChannel::PostMessageToJavaScript(PP_Var message_data) {
 359   v8::HandleScope scope(v8::Isolate::GetCurrent());
 360
 361   // Because V8 is probably not on the stack for Native->JS calls, we need to
 362   // enter the appropriate context for the plugin.
 363   WebPluginContainer* container = instance_->container();
 364   // It's possible that container() is NULL if the plugin has been removed from
 365   // the DOM (but the PluginInstance is not destroyed yet).
 366   if (!container)
 367     return;
 368
 369   v8::Local<v8::Context> context =
 370       container->element().document().frame()->mainWorldScriptContext();
 371   // If the page is being destroyed, the context may be empty.
 372   if (context.IsEmpty())
 373     return;
 374   v8::Context::Scope context_scope(context);
 375
 376   v8::Handle<v8::Value> v8_val;
 377   if (!V8VarConverter(instance_->pp_instance())
 378            .ToV8Value(message_data, context, &v8_val)) {
 379     PpapiGlobals::Get()->LogWithSource(instance_->pp_instance(),
 380                                        PP_LOGLEVEL_ERROR,
 381                                        std::string(),
 382                                        kVarToV8ConversionError);
 383     return;
 384   }
 385
 386   WebSerializedScriptValue serialized_val =
 387       WebSerializedScriptValue::serialize(v8_val);
 388
 389   if (early_message_queue_state_ != SEND_DIRECTLY) {
 390     // We can't just PostTask here; the messages would arrive out of
 391     // order. Instead, we queue them up until we're ready to post
 392     // them.
 393     early_message_queue_.push_back(serialized_val);
 394   } else {
 395     // The proxy sent an asynchronous message, so the plugin is already
 396     // unblocked. Therefore, there's no need to PostTask.
 397     DCHECK(early_message_queue_.empty());
 398     PostMessageToJavaScriptImpl(serialized_val);
 399   }
 400 }
 401
 402 void MessageChannel::PostMessageToNative(const NPVariant* message_data) {
 403   EnqueuePluginMessage(message_data);
 404   DrainCompletedPluginMessages();
 405 }
 406
 407 void MessageChannel::PostBlockingMessageToNative(const NPVariant* message_data,
 408                                                  NPVariant* np_result) {
 409   if (early_message_queue_state_ == QUEUE_MESSAGES) {
 410     WebBindings::setException(
 411         np_object_,
 412         "Attempted to call a synchronous method on a plugin that was not "
 413         "yet loaded.");
 414     return;
 415   }
 416
 417   // If the queue of messages to the plugin is non-empty, we're still waiting on
 418   // pending Var conversions. This means at some point in the past, JavaScript
 419   // called postMessage (the async one) and passed us something with a browser-
 420   // side host (e.g., FileSystem) and we haven't gotten a response from the
 421   // browser yet. We can't currently support sending a sync message if the
 422   // plugin does this, because it will break the ordering of the messages
 423   // arriving at the plugin.
 424   // TODO(dmichael): Fix this.
 425   // See https://code.google.com/p/chromium/issues/detail?id=367896#c4
 426   if (!plugin_message_queue_.empty()) {
 427     WebBindings::setException(
 428         np_object_,
 429         "Failed to convert parameter synchronously, because a prior "
 430         "call to postMessage contained a type which required asynchronous "
 431         "transfer which has not completed. Not all types are supported yet by "
 432         "postMessageAndAwaitResponse. See crbug.com/367896.");
 433     return;
 434   }
 435   ScopedPPVar param;
 436   if (message_data->type == NPVariantType_Object) {
 437     // Convert NPVariantType_Object in to an appropriate PP_Var like Dictionary,
 438     // Array, etc. Note NPVariantToVar would convert to an "Object" PP_Var,
 439     // which we don't support for Messaging.
 440     v8::Handle<v8::Value> v8_value = WebBindings::toV8Value(message_data);
 441     V8VarConverter v8_var_converter(instance_->pp_instance());
 442     bool success = v8_var_converter.FromV8ValueSync(
 443         v8_value,
 444         v8::Isolate::GetCurrent()->GetCurrentContext(),
 445         &param);
 446     if (!success) {
 447       WebBindings::setException(
 448           np_object_,
 449           "Failed to convert the given parameter to a PP_Var to send to "
 450           "the plugin.");
 451       return;
 452     }
 453   } else {
 454     param = ScopedPPVar(ScopedPPVar::PassRef(),
 455                         NPVariantToPPVar(instance(), message_data));
 456   }
 457   ScopedPPVar pp_result;
 458   bool was_handled = instance_->HandleBlockingMessage(param, &pp_result);
 459   if (!was_handled) {
 460     WebBindings::setException(
 461         np_object_,
 462         "The plugin has not registered a handler for synchronous messages. "
 463         "See the documentation for PPB_Messaging::RegisterMessageHandler "
 464         "and PPP_MessageHandler.");
 465     return;
 466   }
 467   v8::Handle<v8::Value> v8_val;
 468   if (!V8VarConverter(instance_->pp_instance()).ToV8Value(
 469           pp_result.get(),
 470           v8::Isolate::GetCurrent()->GetCurrentContext(),
 471           &v8_val)) {
 472     WebBindings::setException(
 473         np_object_,
 474         "Failed to convert the plugin's result to a JavaScript type.");
 475     return;
 476   }
 477   // Success! Convert the result to an NPVariant.
 478   WebBindings::toNPVariant(v8_val, NULL, np_result);
 479 }
 480
 481 void MessageChannel::PostMessageToJavaScriptImpl(
 482     const WebSerializedScriptValue& message_data) {
 483   DCHECK(instance_);
 484
 485   WebPluginContainer* container = instance_->container();
 486   // It's possible that container() is NULL if the plugin has been removed from
 487   // the DOM (but the PluginInstance is not destroyed yet).
 488   if (!container)
 489     return;
 490
 491   WebDOMEvent event =
 492       container->element().document().createEvent("MessageEvent");
 493   WebDOMMessageEvent msg_event = event.to<WebDOMMessageEvent>();
 494   msg_event.initMessageEvent("message",     // type
 495                              false,         // canBubble
 496                              false,         // cancelable
 497                              message_data,  // data
 498                              "",            // origin [*]
 499                              NULL,          // source [*]
 500                              "");           // lastEventId
 501   // [*] Note that the |origin| is only specified for cross-document and server-
 502   //     sent messages, while |source| is only specified for cross-document
 503   //     messages:
 504   //      http://www.whatwg.org/specs/web-apps/current-work/multipage/comms.html
 505   //     This currently behaves like Web Workers. On Firefox, Chrome, and Safari
 506   //     at least, postMessage on Workers does not provide the origin or source.
 507   //     TODO(dmichael):  Add origin if we change to a more iframe-like origin
 508   //                      policy (see crbug.com/81537)
 509   container->element().dispatchEvent(msg_event);
 510 }
 511
 512 void MessageChannel::EnqueuePluginMessage(const NPVariant* variant) {
 513   plugin_message_queue_.push_back(VarConversionResult());
 514   if (variant->type == NPVariantType_Object) {
 515     // Convert NPVariantType_Object in to an appropriate PP_Var like Dictionary,
 516     // Array, etc. Note NPVariantToVar would convert to an "Object" PP_Var,
 517     // which we don't support for Messaging.
 518
 519     // Calling WebBindings::toV8Value creates a wrapper around NPVariant so it
 520     // won't result in a deep copy.
 521     v8::Handle<v8::Value> v8_value = WebBindings::toV8Value(variant);
 522     V8VarConverter v8_var_converter(instance_->pp_instance());
 523     V8VarConverter::VarResult conversion_result =
 524         v8_var_converter.FromV8Value(
 525             v8_value,
 526             v8::Isolate::GetCurrent()->GetCurrentContext(),
 527             base::Bind(&MessageChannel::FromV8ValueComplete,
 528                        weak_ptr_factory_.GetWeakPtr(),
 529                        &plugin_message_queue_.back()));
 530     if (conversion_result.completed_synchronously) {
 531       plugin_message_queue_.back().ConversionCompleted(
 532           conversion_result.var,
 533           conversion_result.success);
 534     }
 535   } else {
 536     plugin_message_queue_.back().ConversionCompleted(
 537         ScopedPPVar(ScopedPPVar::PassRef(),
 538                     NPVariantToPPVar(instance(), variant)),
 539         true);
 540     DCHECK(plugin_message_queue_.back().var().get().type != PP_VARTYPE_OBJECT);
 541   }
 542 }
 543
 544 void MessageChannel::FromV8ValueComplete(VarConversionResult* result_holder,
 545                                          const ScopedPPVar& result,
 546                                          bool success) {
 547   result_holder->ConversionCompleted(result, success);
 548   DrainCompletedPluginMessages();
 549 }
 550
 551 void MessageChannel::DrainCompletedPluginMessages() {
 552   if (early_message_queue_state_ == QUEUE_MESSAGES)
 553     return;
 554
 555   while (!plugin_message_queue_.empty() &&
 556          plugin_message_queue_.front().conversion_completed()) {
 557     const VarConversionResult& front = plugin_message_queue_.front();
 558     if (front.success()) {
 559       instance_->HandleMessage(front.var());
 560     } else {
 561       PpapiGlobals::Get()->LogWithSource(instance()->pp_instance(),
 562                                          PP_LOGLEVEL_ERROR,
 563                                          std::string(),
 564                                          kV8ToVarConversionError);
 565     }
 566     plugin_message_queue_.pop_front();
 567   }
 568 }
 569
 570 void MessageChannel::DrainEarlyMessageQueue() {
 571   DCHECK(early_message_queue_state_ == QUEUE_MESSAGES);
 572
 573   // Take a reference on the PluginInstance. This is because JavaScript code
 574   // may delete the plugin, which would destroy the PluginInstance and its
 575   // corresponding MessageChannel.
 576   scoped_refptr<PepperPluginInstanceImpl> instance_ref(instance_);
 577   while (!early_message_queue_.empty()) {
 578     PostMessageToJavaScriptImpl(early_message_queue_.front());
 579     early_message_queue_.pop_front();
 580   }
 581   early_message_queue_state_ = SEND_DIRECTLY;
 582
 583   DrainCompletedPluginMessages();
 584 }
 585
 586 }  // namespace content