chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/extensions/chrome_content_browser_client_extensions_part.h"
   6
   7 #include <set>
   8
   9 #include "base/command_line.h"
  10 #include "chrome/browser/browser_process.h"
  11 #include "chrome/browser/extensions/browser_permissions_policy_delegate.h"
  12 #include "chrome/browser/extensions/extension_service.h"
  13 #include "chrome/browser/extensions/extension_web_ui.h"
  14 #include "chrome/browser/extensions/extension_webkit_preferences.h"
  15 #include "chrome/browser/media_galleries/fileapi/media_file_system_backend.h"
  16 #include "chrome/browser/profiles/profile.h"
  17 #include "chrome/browser/profiles/profile_io_data.h"
  18 #include "chrome/browser/profiles/profile_manager.h"
  19 #include "chrome/browser/renderer_host/chrome_extension_message_filter.h"
  20 #include "chrome/browser/sync_file_system/local/sync_file_system_backend.h"
  21 #include "chrome/common/chrome_constants.h"
  22 #include "chrome/common/extensions/extension_process_policy.h"
  23 #include "components/guest_view/browser/guest_view_message_filter.h"
  24 #include "content/public/browser/browser_thread.h"
  25 #include "content/public/browser/browser_url_handler.h"
  26 #include "content/public/browser/render_process_host.h"
  27 #include "content/public/browser/render_view_host.h"
  28 #include "content/public/browser/site_instance.h"
  29 #include "content/public/browser/web_contents.h"
  30 #include "content/public/common/content_switches.h"
  31 #include "extensions/browser/api/web_request/web_request_api.h"
  32 #include "extensions/browser/api/web_request/web_request_api_helpers.h"
  33 #include "extensions/browser/extension_host.h"
  34 #include "extensions/browser/extension_message_filter.h"
  35 #include "extensions/browser/extension_registry.h"
  36 #include "extensions/browser/extension_system.h"
  37 #include "extensions/browser/guest_view/extensions_guest_view_message_filter.h"
  38 #include "extensions/browser/guest_view/web_view/web_view_renderer_state.h"
  39 #include "extensions/browser/info_map.h"
  40 #include "extensions/browser/io_thread_extension_message_filter.h"
  41 #include "extensions/browser/view_type_utils.h"
  42 #include "extensions/common/constants.h"
  43 #include "extensions/common/manifest_constants.h"
  44 #include "extensions/common/manifest_handlers/app_isolation_info.h"
  45 #include "extensions/common/manifest_handlers/background_info.h"
  46 #include "extensions/common/manifest_handlers/web_accessible_resources_info.h"
  47 #include "extensions/common/switches.h"
  48
  49 using content::BrowserContext;
  50 using content::BrowserThread;
  51 using content::BrowserURLHandler;
  52 using content::RenderViewHost;
  53 using content::SiteInstance;
  54 using content::WebContents;
  55 using content::WebPreferences;
  56
  57 namespace extensions {
  58
  59 namespace {
  60
  61 // Used by the GetPrivilegeRequiredByUrl() and GetProcessPrivilege() functions
  62 // below.  Extension, and isolated apps require different privileges to be
  63 // granted to their RenderProcessHosts.  This classification allows us to make
  64 // sure URLs are served by hosts with the right set of privileges.
  65 enum RenderProcessHostPrivilege {
  66   PRIV_NORMAL,
  67   PRIV_HOSTED,
  68   PRIV_ISOLATED,
  69   PRIV_EXTENSION,
  70 };
  71
  72 RenderProcessHostPrivilege GetPrivilegeRequiredByUrl(
  73     const GURL& url,
  74     ExtensionRegistry* registry) {
  75   // Default to a normal renderer cause it is lower privileged. This should only
  76   // occur if the URL on a site instance is either malformed, or uninitialized.
  77   // If it is malformed, then there is no need for better privileges anyways.
  78   // If it is uninitialized, but eventually settles on being an a scheme other
  79   // than normal webrenderer, the navigation logic will correct us out of band
  80   // anyways.
  81   if (!url.is_valid())
  82     return PRIV_NORMAL;
  83
  84   if (!url.SchemeIs(kExtensionScheme))
  85     return PRIV_NORMAL;
  86
  87   const Extension* extension =
  88       registry->enabled_extensions().GetByID(url.host());
  89   if (extension && AppIsolationInfo::HasIsolatedStorage(extension))
  90     return PRIV_ISOLATED;
  91   if (extension && extension->is_hosted_app())
  92     return PRIV_HOSTED;
  93   return PRIV_EXTENSION;
  94 }
  95
  96 RenderProcessHostPrivilege GetProcessPrivilege(
  97     content::RenderProcessHost* process_host,
  98     ProcessMap* process_map,
  99     ExtensionRegistry* registry) {
 100   std::set<std::string> extension_ids =
 101       process_map->GetExtensionsInProcess(process_host->GetID());
 102   if (extension_ids.empty())
 103     return PRIV_NORMAL;
 104
 105   for (const std::string& extension_id : extension_ids) {
 106     const Extension* extension =
 107         registry->enabled_extensions().GetByID(extension_id);
 108     if (extension && AppIsolationInfo::HasIsolatedStorage(extension))
 109       return PRIV_ISOLATED;
 110     if (extension && extension->is_hosted_app())
 111       return PRIV_HOSTED;
 112   }
 113
 114   return PRIV_EXTENSION;
 115 }
 116
 117 }  // namespace
 118
 119 ChromeContentBrowserClientExtensionsPart::
 120     ChromeContentBrowserClientExtensionsPart() {
 121   permissions_policy_delegate_.reset(new BrowserPermissionsPolicyDelegate());
 122 }
 123
 124 ChromeContentBrowserClientExtensionsPart::
 125     ~ChromeContentBrowserClientExtensionsPart() {
 126 }
 127
 128 // static
 129 GURL ChromeContentBrowserClientExtensionsPart::GetEffectiveURL(
 130     Profile* profile, const GURL& url) {
 131   // If the input |url| is part of an installed app, the effective URL is an
 132   // extension URL with the ID of that extension as the host. This has the
 133   // effect of grouping apps together in a common SiteInstance.
 134   ExtensionRegistry* registry = ExtensionRegistry::Get(profile);
 135   if (!registry)
 136     return url;
 137
 138   const Extension* extension =
 139       registry->enabled_extensions().GetHostedAppByURL(url);
 140   if (!extension)
 141     return url;
 142
 143   // Bookmark apps do not use the hosted app process model, and should be
 144   // treated as normal URLs.
 145   if (extension->from_bookmark())
 146     return url;
 147
 148   // If the URL is part of an extension's web extent, convert it to an
 149   // extension URL.
 150   return extension->GetResourceURL(url.path());
 151 }
 152
 153 // static
 154 bool ChromeContentBrowserClientExtensionsPart::ShouldUseProcessPerSite(
 155     Profile* profile, const GURL& effective_url) {
 156   if (!effective_url.SchemeIs(kExtensionScheme))
 157     return false;
 158
 159   ExtensionRegistry* registry = ExtensionRegistry::Get(profile);
 160   if (!registry)
 161     return false;
 162
 163   const Extension* extension =
 164       registry->enabled_extensions().GetByID(effective_url.host());
 165   if (!extension)
 166     return false;
 167
 168   // If the URL is part of a hosted app that does not have the background
 169   // permission, or that does not allow JavaScript access to the background
 170   // page, we want to give each instance its own process to improve
 171   // responsiveness.
 172   if (extension->GetType() == Manifest::TYPE_HOSTED_APP) {
 173     if (!extension->permissions_data()->HasAPIPermission(
 174             APIPermission::kBackground) ||
 175         !BackgroundInfo::AllowJSAccess(extension)) {
 176       return false;
 177     }
 178   }
 179
 180   // Hosted apps that have script access to their background page must use
 181   // process per site, since all instances can make synchronous calls to the
 182   // background window.  Other extensions should use process per site as well.
 183   return true;
 184 }
 185
 186 // static
 187 bool ChromeContentBrowserClientExtensionsPart::CanCommitURL(
 188     content::RenderProcessHost* process_host, const GURL& url) {
 189   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 190
 191   // We need to let most extension URLs commit in any process, since this can
 192   // be allowed due to web_accessible_resources.  Most hosted app URLs may also
 193   // load in any process (e.g., in an iframe).  However, the Chrome Web Store
 194   // cannot be loaded in iframes and should never be requested outside its
 195   // process.
 196   ExtensionRegistry* registry =
 197       ExtensionRegistry::Get(process_host->GetBrowserContext());
 198   if (!registry)
 199     return true;
 200
 201   const Extension* new_extension =
 202       registry->enabled_extensions().GetExtensionOrAppByURL(url);
 203   if (new_extension && new_extension->is_hosted_app() &&
 204       new_extension->id() == extensions::kWebStoreAppId &&
 205       !ProcessMap::Get(process_host->GetBrowserContext())
 206            ->Contains(new_extension->id(), process_host->GetID())) {
 207     return false;
 208   }
 209   return true;
 210 }
 211
 212 bool ChromeContentBrowserClientExtensionsPart::IsIllegalOrigin(
 213     content::ResourceContext* resource_context,
 214     int child_process_id,
 215     const GURL& origin) {
 216   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 217
 218   // Consider non-extension URLs safe; they will be checked elsewhere.
 219   if (!origin.SchemeIs(extensions::kExtensionScheme))
 220     return false;
 221
 222   // If there is no extension installed for the URL, it couldn't have committed.
 223   // (If the extension was recently uninstalled, the tab would have closed.)
 224   ProfileIOData* io_data = ProfileIOData::FromResourceContext(resource_context);
 225   extensions::InfoMap* extension_info_map = io_data->GetExtensionInfoMap();
 226   const extensions::Extension* extension =
 227       extension_info_map->extensions().GetExtensionOrAppByURL(origin);
 228   if (!extension)
 229     return true;
 230
 231   // Check for platform app origins.  These can only be committed by the app
 232   // itself, or by one if its guests if there are accessible_resources.
 233   const extensions::ProcessMap& process_map = extension_info_map->process_map();
 234   if (extension->is_platform_app() &&
 235       !process_map.Contains(extension->id(), child_process_id)) {
 236     // This is a platform app origin not in the app's own process.  If there are
 237     // no accessible resources, this is illegal.
 238     if (!extension->GetManifestData(manifest_keys::kWebviewAccessibleResources))
 239       return true;
 240
 241     // If there are accessible resources, the origin is only legal if the given
 242     // process is a guest of the app.
 243     std::string owner_extension_id;
 244     int owner_process_id;
 245     WebViewRendererState::GetInstance()->GetOwnerInfo(
 246         child_process_id, &owner_process_id, &owner_extension_id);
 247     const Extension* owner_extension =
 248         extension_info_map->extensions().GetByID(owner_extension_id);
 249     return !owner_extension || owner_extension != extension;
 250   }
 251
 252   // With only the origin and not the full URL, we don't have enough information
 253   // to validate hosted apps or web_accessible_resources in normal extensions.
 254   // Assume they're legal.
 255   return false;
 256 }
 257
 258 // static
 259 bool ChromeContentBrowserClientExtensionsPart::IsSuitableHost(
 260     Profile* profile,
 261     content::RenderProcessHost* process_host,
 262     const GURL& site_url) {
 263   DCHECK(profile);
 264
 265   ExtensionRegistry* registry = ExtensionRegistry::Get(profile);
 266   ProcessMap* process_map = ProcessMap::Get(profile);
 267
 268   // These may be NULL during tests. In that case, just assume any site can
 269   // share any host.
 270   if (!registry || !process_map)
 271     return true;
 272
 273   // Otherwise, just make sure the process privilege matches the privilege
 274   // required by the site.
 275   RenderProcessHostPrivilege privilege_required =
 276       GetPrivilegeRequiredByUrl(site_url, registry);
 277   return GetProcessPrivilege(process_host, process_map, registry) ==
 278          privilege_required;
 279 }
 280
 281 // static
 282 bool
 283 ChromeContentBrowserClientExtensionsPart::ShouldTryToUseExistingProcessHost(
 284     Profile* profile, const GURL& url) {
 285   // This function is trying to limit the amount of processes used by extensions
 286   // with background pages. It uses a globally set percentage of processes to
 287   // run such extensions and if the limit is exceeded, it returns true, to
 288   // indicate to the content module to group extensions together.
 289   ExtensionRegistry* registry =
 290       profile ? ExtensionRegistry::Get(profile) : NULL;
 291   if (!registry)
 292     return false;
 293
 294   // We have to have a valid extension with background page to proceed.
 295   const Extension* extension =
 296       registry->enabled_extensions().GetExtensionOrAppByURL(url);
 297   if (!extension)
 298     return false;
 299   if (!BackgroundInfo::HasBackgroundPage(extension))
 300     return false;
 301
 302   std::set<int> process_ids;
 303   size_t max_process_count =
 304       content::RenderProcessHost::GetMaxRendererProcessCount();
 305
 306   // Go through all profiles to ensure we have total count of extension
 307   // processes containing background pages, otherwise one profile can
 308   // starve the other.
 309   std::vector<Profile*> profiles = g_browser_process->profile_manager()->
 310       GetLoadedProfiles();
 311   for (size_t i = 0; i < profiles.size(); ++i) {
 312     ProcessManager* epm = ProcessManager::Get(profiles[i]);
 313     for (extensions::ExtensionHost* host : epm->background_hosts())
 314       process_ids.insert(host->render_process_host()->GetID());
 315   }
 316
 317   return (process_ids.size() >
 318           (max_process_count * chrome::kMaxShareOfExtensionProcesses));
 319 }
 320
 321 // static
 322 bool ChromeContentBrowserClientExtensionsPart::
 323     ShouldSwapBrowsingInstancesForNavigation(SiteInstance* site_instance,
 324                                              const GURL& current_url,
 325                                              const GURL& new_url) {
 326   // If we don't have an ExtensionRegistry, then rely on the SiteInstance logic
 327   // in RenderFrameHostManager to decide when to swap.
 328   ExtensionRegistry* registry =
 329       ExtensionRegistry::Get(site_instance->GetBrowserContext());
 330   if (!registry)
 331     return false;
 332
 333   // We must use a new BrowsingInstance (forcing a process swap and disabling
 334   // scripting by existing tabs) if one of the URLs is an extension and the
 335   // other is not the exact same extension.
 336   //
 337   // We ignore hosted apps here so that other tabs in their BrowsingInstance can
 338   // use postMessage with them.  (The exception is the Chrome Web Store, which
 339   // is a hosted app that requires its own BrowsingInstance.)  Navigations
 340   // to/from a hosted app will still trigger a SiteInstance swap in
 341   // RenderFrameHostManager.
 342   const Extension* current_extension =
 343       registry->enabled_extensions().GetExtensionOrAppByURL(current_url);
 344   if (current_extension &&
 345       current_extension->is_hosted_app() &&
 346       current_extension->id() != extensions::kWebStoreAppId)
 347     current_extension = NULL;
 348
 349   const Extension* new_extension =
 350       registry->enabled_extensions().GetExtensionOrAppByURL(new_url);
 351   if (new_extension &&
 352       new_extension->is_hosted_app() &&
 353       new_extension->id() != extensions::kWebStoreAppId)
 354     new_extension = NULL;
 355
 356   // First do a process check.  We should force a BrowsingInstance swap if the
 357   // current process doesn't know about new_extension, even if current_extension
 358   // is somehow the same as new_extension.
 359   ProcessMap* process_map = ProcessMap::Get(site_instance->GetBrowserContext());
 360   if (new_extension &&
 361       site_instance->HasProcess() &&
 362       !process_map->Contains(
 363           new_extension->id(), site_instance->GetProcess()->GetID()))
 364     return true;
 365
 366   // Otherwise, swap BrowsingInstances if current_extension and new_extension
 367   // differ.
 368   return current_extension != new_extension;
 369 }
 370
 371 // static
 372 bool ChromeContentBrowserClientExtensionsPart::ShouldSwapProcessesForRedirect(
 373     content::ResourceContext* resource_context,
 374     const GURL& current_url,
 375     const GURL& new_url) {
 376   ProfileIOData* io_data = ProfileIOData::FromResourceContext(resource_context);
 377   return CrossesExtensionProcessBoundary(
 378       io_data->GetExtensionInfoMap()->extensions(),
 379       current_url, new_url, false);
 380 }
 381
 382 // static
 383 bool ChromeContentBrowserClientExtensionsPart::ShouldAllowOpenURL(
 384     content::SiteInstance* site_instance,
 385     const GURL& from_url,
 386     const GURL& to_url,
 387     bool* result) {
 388   DCHECK(result);
 389
 390   // Do not allow pages from the web or other extensions navigate to
 391   // non-web-accessible extension resources.
 392   if (to_url.SchemeIs(kExtensionScheme) &&
 393       (from_url.SchemeIsHTTPOrHTTPS() || from_url.SchemeIs(kExtensionScheme))) {
 394     Profile* profile = Profile::FromBrowserContext(
 395         site_instance->GetProcess()->GetBrowserContext());
 396     ExtensionRegistry* registry = ExtensionRegistry::Get(profile);
 397     if (!registry) {
 398       *result = true;
 399       return true;
 400     }
 401     const Extension* extension =
 402         registry->enabled_extensions().GetExtensionOrAppByURL(to_url);
 403     if (!extension) {
 404       *result = true;
 405       return true;
 406     }
 407     const Extension* from_extension =
 408         registry->enabled_extensions().GetExtensionOrAppByURL(
 409             site_instance->GetSiteURL());
 410     if (from_extension && from_extension->id() == extension->id()) {
 411       *result = true;
 412       return true;
 413     }
 414
 415     if (!WebAccessibleResourcesInfo::IsResourceWebAccessible(
 416             extension, to_url.path())) {
 417       *result = false;
 418       return true;
 419     }
 420   }
 421   return false;
 422 }
 423
 424 void ChromeContentBrowserClientExtensionsPart::RenderProcessWillLaunch(
 425     content::RenderProcessHost* host) {
 426   int id = host->GetID();
 427   Profile* profile = Profile::FromBrowserContext(host->GetBrowserContext());
 428
 429   host->AddFilter(new ChromeExtensionMessageFilter(id, profile));
 430   host->AddFilter(new ExtensionMessageFilter(id, profile));
 431   host->AddFilter(new IOThreadExtensionMessageFilter(id, profile));
 432   host->AddFilter(new ExtensionsGuestViewMessageFilter(id, profile));
 433   extension_web_request_api_helpers::SendExtensionWebRequestStatusToHost(host);
 434 }
 435
 436 void ChromeContentBrowserClientExtensionsPart::SiteInstanceGotProcess(
 437     SiteInstance* site_instance) {
 438   BrowserContext* context = site_instance->GetProcess()->GetBrowserContext();
 439   ExtensionRegistry* registry = ExtensionRegistry::Get(context);
 440   if (!registry)
 441     return;
 442
 443   const Extension* extension =
 444       registry->enabled_extensions().GetExtensionOrAppByURL(
 445           site_instance->GetSiteURL());
 446   if (!extension)
 447     return;
 448
 449   ProcessMap::Get(context)->Insert(extension->id(),
 450                                    site_instance->GetProcess()->GetID(),
 451                                    site_instance->GetId());
 452
 453   BrowserThread::PostTask(
 454       BrowserThread::IO, FROM_HERE,
 455       base::Bind(&InfoMap::RegisterExtensionProcess,
 456                  ExtensionSystem::Get(context)->info_map(), extension->id(),
 457                  site_instance->GetProcess()->GetID(), site_instance->GetId()));
 458 }
 459
 460 void ChromeContentBrowserClientExtensionsPart::SiteInstanceDeleting(
 461     SiteInstance* site_instance) {
 462   BrowserContext* context = site_instance->GetBrowserContext();
 463   ExtensionRegistry* registry = ExtensionRegistry::Get(context);
 464   if (!registry)
 465     return;
 466
 467   const Extension* extension =
 468       registry->enabled_extensions().GetExtensionOrAppByURL(
 469           site_instance->GetSiteURL());
 470   if (!extension)
 471     return;
 472
 473   ProcessMap::Get(context)->Remove(extension->id(),
 474                                    site_instance->GetProcess()->GetID(),
 475                                    site_instance->GetId());
 476
 477   BrowserThread::PostTask(
 478       BrowserThread::IO, FROM_HERE,
 479       base::Bind(&InfoMap::UnregisterExtensionProcess,
 480                  ExtensionSystem::Get(context)->info_map(), extension->id(),
 481                  site_instance->GetProcess()->GetID(), site_instance->GetId()));
 482 }
 483
 484 void ChromeContentBrowserClientExtensionsPart::OverrideWebkitPrefs(
 485     RenderViewHost* rvh,
 486     WebPreferences* web_prefs) {
 487   const ExtensionRegistry* registry =
 488       ExtensionRegistry::Get(rvh->GetProcess()->GetBrowserContext());
 489   if (!registry)
 490     return;
 491
 492   // Note: it's not possible for kExtensionsScheme to change during the lifetime
 493   // of the process.
 494   //
 495   // Ensure that we are only granting extension preferences to URLs with
 496   // the correct scheme. Without this check, chrome-guest:// schemes used by
 497   // webview tags as well as hosts that happen to match the id of an
 498   // installed extension would get the wrong preferences.
 499   const GURL& site_url = rvh->GetSiteInstance()->GetSiteURL();
 500   if (!site_url.SchemeIs(kExtensionScheme))
 501     return;
 502
 503   WebContents* web_contents = WebContents::FromRenderViewHost(rvh);
 504   ViewType view_type = GetViewType(web_contents);
 505   const Extension* extension =
 506       registry->enabled_extensions().GetByID(site_url.host());
 507   extension_webkit_preferences::SetPreferences(extension, view_type, web_prefs);
 508 }
 509
 510 void ChromeContentBrowserClientExtensionsPart::BrowserURLHandlerCreated(
 511     BrowserURLHandler* handler) {
 512   handler->AddHandlerPair(&ExtensionWebUI::HandleChromeURLOverride,
 513                           BrowserURLHandler::null_handler());
 514   handler->AddHandlerPair(BrowserURLHandler::null_handler(),
 515                           &ExtensionWebUI::HandleChromeURLOverrideReverse);
 516 }
 517
 518 void ChromeContentBrowserClientExtensionsPart::
 519     GetAdditionalAllowedSchemesForFileSystem(
 520         std::vector<std::string>* additional_allowed_schemes) {
 521   additional_allowed_schemes->push_back(kExtensionScheme);
 522 }
 523
 524 void ChromeContentBrowserClientExtensionsPart::GetURLRequestAutoMountHandlers(
 525     std::vector<storage::URLRequestAutoMountHandler>* handlers) {
 526   handlers->push_back(
 527       base::Bind(MediaFileSystemBackend::AttemptAutoMountForURLRequest));
 528 }
 529
 530 void ChromeContentBrowserClientExtensionsPart::GetAdditionalFileSystemBackends(
 531     content::BrowserContext* browser_context,
 532     const base::FilePath& storage_partition_path,
 533     ScopedVector<storage::FileSystemBackend>* additional_backends) {
 534   base::SequencedWorkerPool* pool = content::BrowserThread::GetBlockingPool();
 535   additional_backends->push_back(new MediaFileSystemBackend(
 536       storage_partition_path,
 537       pool->GetSequencedTaskRunner(
 538                 pool->GetNamedSequenceToken(
 539                     MediaFileSystemBackend::kMediaTaskRunnerName)).get()));
 540
 541   additional_backends->push_back(new sync_file_system::SyncFileSystemBackend(
 542       Profile::FromBrowserContext(browser_context)));
 543 }
 544
 545 void ChromeContentBrowserClientExtensionsPart::
 546     AppendExtraRendererCommandLineSwitches(base::CommandLine* command_line,
 547                                            content::RenderProcessHost* process,
 548                                            Profile* profile) {
 549   if (!process)
 550     return;
 551   DCHECK(profile);
 552   if (ProcessMap::Get(profile)->Contains(process->GetID())) {
 553     command_line->AppendSwitch(switches::kExtensionProcess);
 554 #if defined(ENABLE_WEBRTC)
 555     command_line->AppendSwitch(::switches::kEnableWebRtcHWH264Encoding);
 556 #endif
 557     if (base::CommandLine::ForCurrentProcess()->HasSwitch(
 558             switches::kEnableMojoSerialService)) {
 559       command_line->AppendSwitch(switches::kEnableMojoSerialService);
 560     }
 561   }
 562 }
 563
 564 }  // namespace extensions