content/browser/frame_host/render_frame_host_impl.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/frame_host/render_frame_host_impl.h"
   6
   7 #include "base/containers/hash_tables.h"
   8 #include "base/lazy_instance.h"
   9 #include "base/metrics/user_metrics_action.h"
  10 #include "content/browser/child_process_security_policy_impl.h"
  11 #include "content/browser/frame_host/cross_process_frame_connector.h"
  12 #include "content/browser/frame_host/cross_site_transferring_request.h"
  13 #include "content/browser/frame_host/frame_tree.h"
  14 #include "content/browser/frame_host/frame_tree_node.h"
  15 #include "content/browser/frame_host/navigator.h"
  16 #include "content/browser/frame_host/render_frame_host_delegate.h"
  17 #include "content/browser/renderer_host/render_view_host_impl.h"
  18 #include "content/common/frame_messages.h"
  19 #include "content/public/browser/browser_thread.h"
  20 #include "content/public/browser/content_browser_client.h"
  21 #include "content/public/browser/render_process_host.h"
  22 #include "content/public/browser/render_widget_host_view.h"
  23 #include "content/public/browser/user_metrics.h"
  24 #include "content/public/common/url_constants.h"
  25 #include "url/gurl.h"
  26
  27 namespace content {
  28
  29 // The (process id, routing id) pair that identifies one RenderFrame.
  30 typedef std::pair<int32, int32> RenderFrameHostID;
  31 typedef base::hash_map<RenderFrameHostID, RenderFrameHostImpl*>
  32     RoutingIDFrameMap;
  33 static base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
  34     LAZY_INSTANCE_INITIALIZER;
  35
  36 RenderFrameHost* RenderFrameHost::FromID(int render_process_id,
  37                                          int render_frame_id) {
  38   return RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
  39 }
  40
  41 // static
  42 RenderFrameHostImpl* RenderFrameHostImpl::FromID(
  43     int process_id, int routing_id) {
  44   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
  45   RoutingIDFrameMap* frames = g_routing_id_frame_map.Pointer();
  46   RoutingIDFrameMap::iterator it = frames->find(
  47       RenderFrameHostID(process_id, routing_id));
  48   return it == frames->end() ? NULL : it->second;
  49 }
  50
  51 RenderFrameHostImpl::RenderFrameHostImpl(
  52     RenderViewHostImpl* render_view_host,
  53     RenderFrameHostDelegate* delegate,
  54     FrameTree* frame_tree,
  55     FrameTreeNode* frame_tree_node,
  56     int routing_id,
  57     bool is_swapped_out)
  58     : render_view_host_(render_view_host),
  59       delegate_(delegate),
  60       cross_process_frame_connector_(NULL),
  61       frame_tree_(frame_tree),
  62       frame_tree_node_(frame_tree_node),
  63       routing_id_(routing_id),
  64       is_swapped_out_(is_swapped_out) {
  65   frame_tree_->RegisterRenderFrameHost(this);
  66   GetProcess()->AddRoute(routing_id_, this);
  67   g_routing_id_frame_map.Get().insert(std::make_pair(
  68       RenderFrameHostID(GetProcess()->GetID(), routing_id_),
  69       this));
  70 }
  71
  72 RenderFrameHostImpl::~RenderFrameHostImpl() {
  73   GetProcess()->RemoveRoute(routing_id_);
  74   g_routing_id_frame_map.Get().erase(
  75       RenderFrameHostID(GetProcess()->GetID(), routing_id_));
  76   if (delegate_)
  77     delegate_->RenderFrameDeleted(this);
  78
  79   // Notify the FrameTree that this RFH is going away, allowing it to shut down
  80   // the corresponding RenderViewHost if it is no longer needed.
  81   frame_tree_->UnregisterRenderFrameHost(this);
  82 }
  83
  84 int RenderFrameHostImpl::GetRoutingID() {
  85   return routing_id_;
  86 }
  87
  88 SiteInstance* RenderFrameHostImpl::GetSiteInstance() {
  89   return render_view_host_->GetSiteInstance();
  90 }
  91
  92 RenderProcessHost* RenderFrameHostImpl::GetProcess() {
  93   // TODO(nasko): This should return its own process, once we have working
  94   // cross-process navigation for subframes.
  95   return render_view_host_->GetProcess();
  96 }
  97
  98 RenderFrameHost* RenderFrameHostImpl::GetParent() {
  99   FrameTreeNode* parent_node = frame_tree_node_->parent();
 100   if (!parent_node)
 101     return NULL;
 102   return parent_node->current_frame_host();
 103 }
 104
 105 bool RenderFrameHostImpl::IsCrossProcessSubframe() {
 106   FrameTreeNode* parent_node = frame_tree_node_->parent();
 107   if (!parent_node)
 108     return false;
 109   return GetSiteInstance() !=
 110       parent_node->current_frame_host()->GetSiteInstance();
 111 }
 112
 113 GURL RenderFrameHostImpl::GetLastCommittedURL() {
 114   return frame_tree_node_->current_url();
 115 }
 116
 117 gfx::NativeView RenderFrameHostImpl::GetNativeView() {
 118   RenderWidgetHostView* view = render_view_host_->GetView();
 119   if (!view)
 120     return NULL;
 121   return view->GetNativeView();
 122 }
 123
 124 void RenderFrameHostImpl::NotifyContextMenuClosed(
 125     const CustomContextMenuContext& context) {
 126   Send(new FrameMsg_ContextMenuClosed(routing_id_, context));
 127 }
 128
 129 void RenderFrameHostImpl::ExecuteCustomContextMenuCommand(
 130     int action, const CustomContextMenuContext& context) {
 131   Send(new FrameMsg_CustomContextMenuAction(routing_id_, context, action));
 132 }
 133
 134 RenderViewHost* RenderFrameHostImpl::GetRenderViewHost() {
 135   return render_view_host_;
 136 }
 137
 138 bool RenderFrameHostImpl::Send(IPC::Message* message) {
 139   return GetProcess()->Send(message);
 140 }
 141
 142 bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
 143   if (delegate_->OnMessageReceived(this, msg))
 144     return true;
 145
 146   if (cross_process_frame_connector_ &&
 147       cross_process_frame_connector_->OnMessageReceived(msg))
 148     return true;
 149
 150   bool handled = true;
 151   bool msg_is_ok = true;
 152   IPC_BEGIN_MESSAGE_MAP_EX(RenderFrameHostImpl, msg, msg_is_ok)
 153     IPC_MESSAGE_HANDLER(FrameHostMsg_Detach, OnDetach)
 154     IPC_MESSAGE_HANDLER(FrameHostMsg_DidStartProvisionalLoadForFrame,
 155                         OnDidStartProvisionalLoadForFrame)
 156     IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailProvisionalLoadWithError,
 157                         OnDidFailProvisionalLoadWithError)
 158     IPC_MESSAGE_HANDLER(FrameHostMsg_DidRedirectProvisionalLoad,
 159                         OnDidRedirectProvisionalLoad)
 160     IPC_MESSAGE_HANDLER(FrameHostMsg_DidFailLoadWithError,
 161                         OnDidFailLoadWithError)
 162     IPC_MESSAGE_HANDLER_GENERIC(FrameHostMsg_DidCommitProvisionalLoad,
 163                                 OnNavigate(msg))
 164     IPC_MESSAGE_HANDLER(FrameHostMsg_DidStartLoading, OnDidStartLoading)
 165     IPC_MESSAGE_HANDLER(FrameHostMsg_DidStopLoading, OnDidStopLoading)
 166     IPC_MESSAGE_HANDLER(FrameHostMsg_OpenURL, OnOpenURL)
 167     IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK)
 168     IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu)
 169   IPC_END_MESSAGE_MAP_EX()
 170
 171   if (!msg_is_ok) {
 172     // The message had a handler, but its de-serialization failed.
 173     // Kill the renderer.
 174     RecordAction(base::UserMetricsAction("BadMessageTerminate_RFH"));
 175     GetProcess()->ReceivedBadMessage();
 176   }
 177
 178   return handled;
 179 }
 180
 181 void RenderFrameHostImpl::Init() {
 182   GetProcess()->ResumeRequestsForView(routing_id_);
 183 }
 184
 185 void RenderFrameHostImpl::OnCreateChildFrame(int new_routing_id,
 186                                              const std::string& frame_name) {
 187   RenderFrameHostImpl* new_frame = frame_tree_->AddFrame(
 188       frame_tree_node_, new_routing_id, frame_name);
 189   if (delegate_)
 190     delegate_->RenderFrameCreated(new_frame);
 191 }
 192
 193 void RenderFrameHostImpl::OnDetach() {
 194   frame_tree_->RemoveFrame(frame_tree_node_);
 195 }
 196
 197 void RenderFrameHostImpl::OnOpenURL(
 198     const FrameHostMsg_OpenURL_Params& params) {
 199   GURL validated_url(params.url);
 200   GetProcess()->FilterURL(false, &validated_url);
 201
 202   frame_tree_node_->navigator()->RequestOpenURL(
 203       this, validated_url, params.referrer, params.disposition, params.frame_id,
 204       params.should_replace_current_entry, params.user_gesture);
 205 }
 206
 207 void RenderFrameHostImpl::OnDidStartProvisionalLoadForFrame(
 208     int parent_routing_id,
 209     bool is_main_frame,
 210     const GURL& url) {
 211   frame_tree_node_->navigator()->DidStartProvisionalLoad(
 212       this, parent_routing_id, is_main_frame, url);
 213 }
 214
 215 void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
 216     const FrameHostMsg_DidFailProvisionalLoadWithError_Params& params) {
 217   frame_tree_node_->navigator()->DidFailProvisionalLoadWithError(this, params);
 218 }
 219
 220 void RenderFrameHostImpl::OnDidFailLoadWithError(
 221     const GURL& url,
 222     bool is_main_frame,
 223     int error_code,
 224     const base::string16& error_description) {
 225   GURL validated_url(url);
 226   GetProcess()->FilterURL(false, &validated_url);
 227
 228   frame_tree_node_->navigator()->DidFailLoadWithError(
 229       this, validated_url, is_main_frame, error_code,
 230       error_description);
 231 }
 232
 233 void RenderFrameHostImpl::OnDidRedirectProvisionalLoad(
 234     int32 page_id,
 235     const GURL& source_url,
 236     const GURL& target_url) {
 237   frame_tree_node_->navigator()->DidRedirectProvisionalLoad(
 238       this, page_id, source_url, target_url);
 239 }
 240
 241 // Called when the renderer navigates.  For every frame loaded, we'll get this
 242 // notification containing parameters identifying the navigation.
 243 //
 244 // Subframes are identified by the page transition type.  For subframes loaded
 245 // as part of a wider page load, the page_id will be the same as for the top
 246 // level frame.  If the user explicitly requests a subframe navigation, we will
 247 // get a new page_id because we need to create a new navigation entry for that
 248 // action.
 249 void RenderFrameHostImpl::OnNavigate(const IPC::Message& msg) {
 250   // Read the parameters out of the IPC message directly to avoid making another
 251   // copy when we filter the URLs.
 252   PickleIterator iter(msg);
 253   FrameHostMsg_DidCommitProvisionalLoad_Params validated_params;
 254   if (!IPC::ParamTraits<FrameHostMsg_DidCommitProvisionalLoad_Params>::
 255       Read(&msg, &iter, &validated_params))
 256     return;
 257
 258   // If we're waiting for a cross-site beforeunload ack from this renderer and
 259   // we receive a Navigate message from the main frame, then the renderer was
 260   // navigating already and sent it before hearing the ViewMsg_Stop message.
 261   // We do not want to cancel the pending navigation in this case, since the
 262   // old page will soon be stopped.  Instead, treat this as a beforeunload ack
 263   // to allow the pending navigation to continue.
 264   if (render_view_host_->is_waiting_for_beforeunload_ack_ &&
 265       render_view_host_->unload_ack_is_for_cross_site_transition_ &&
 266       PageTransitionIsMainFrame(validated_params.transition)) {
 267     render_view_host_->OnShouldCloseACK(
 268         true, render_view_host_->send_should_close_start_time_,
 269         base::TimeTicks::Now());
 270     return;
 271   }
 272
 273   // If we're waiting for an unload ack from this renderer and we receive a
 274   // Navigate message, then the renderer was navigating before it received the
 275   // unload request.  It will either respond to the unload request soon or our
 276   // timer will expire.  Either way, we should ignore this message, because we
 277   // have already committed to closing this renderer.
 278   if (render_view_host_->IsWaitingForUnloadACK())
 279     return;
 280
 281   RenderProcessHost* process = GetProcess();
 282
 283   // Attempts to commit certain off-limits URL should be caught more strictly
 284   // than our FilterURL checks below.  If a renderer violates this policy, it
 285   // should be killed.
 286   if (!CanCommitURL(validated_params.url)) {
 287     VLOG(1) << "Blocked URL " << validated_params.url.spec();
 288     validated_params.url = GURL(kAboutBlankURL);
 289     RecordAction(base::UserMetricsAction("CanCommitURL_BlockedAndKilled"));
 290     // Kills the process.
 291     process->ReceivedBadMessage();
 292   }
 293
 294   // Now that something has committed, we don't need to track whether the
 295   // initial page has been accessed.
 296   render_view_host_->has_accessed_initial_document_ = false;
 297
 298   // Without this check, an evil renderer can trick the browser into creating
 299   // a navigation entry for a banned URL.  If the user clicks the back button
 300   // followed by the forward button (or clicks reload, or round-trips through
 301   // session restore, etc), we'll think that the browser commanded the
 302   // renderer to load the URL and grant the renderer the privileges to request
 303   // the URL.  To prevent this attack, we block the renderer from inserting
 304   // banned URLs into the navigation controller in the first place.
 305   process->FilterURL(false, &validated_params.url);
 306   process->FilterURL(true, &validated_params.referrer.url);
 307   for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
 308       it != validated_params.redirects.end(); ++it) {
 309     process->FilterURL(false, &(*it));
 310   }
 311   process->FilterURL(true, &validated_params.searchable_form_url);
 312
 313   // Without this check, the renderer can trick the browser into using
 314   // filenames it can't access in a future session restore.
 315   if (!render_view_host_->CanAccessFilesOfPageState(
 316           validated_params.page_state)) {
 317     GetProcess()->ReceivedBadMessage();
 318     return;
 319   }
 320
 321   frame_tree_node()->navigator()->DidNavigate(this, validated_params);
 322 }
 323
 324 int RenderFrameHostImpl::GetEnabledBindings() {
 325   return render_view_host_->GetEnabledBindings();
 326 }
 327
 328 void RenderFrameHostImpl::OnCrossSiteResponse(
 329     const GlobalRequestID& global_request_id,
 330     scoped_ptr<CrossSiteTransferringRequest> cross_site_transferring_request,
 331     const std::vector<GURL>& transfer_url_chain,
 332     const Referrer& referrer,
 333     PageTransition page_transition,
 334     bool should_replace_current_entry) {
 335   frame_tree_node_->render_manager()->OnCrossSiteResponse(
 336       this, global_request_id, cross_site_transferring_request.Pass(),
 337       transfer_url_chain, referrer, page_transition,
 338       should_replace_current_entry);
 339 }
 340
 341 void RenderFrameHostImpl::SwapOut() {
 342   if (render_view_host_->IsRenderViewLive()) {
 343     Send(new FrameMsg_SwapOut(routing_id_));
 344   } else {
 345     // Our RenderViewHost doesn't have a live renderer, so just skip the unload
 346     // event.
 347     OnSwappedOut(true);
 348   }
 349 }
 350
 351 void RenderFrameHostImpl::OnDidStartLoading() {
 352   delegate_->DidStartLoading(this);
 353 }
 354
 355 void RenderFrameHostImpl::OnDidStopLoading() {
 356   delegate_->DidStopLoading(this);
 357 }
 358
 359 void RenderFrameHostImpl::OnSwapOutACK() {
 360   OnSwappedOut(false);
 361 }
 362
 363 void RenderFrameHostImpl::OnSwappedOut(bool timed_out) {
 364   frame_tree_node_->render_manager()->SwappedOutFrame(this);
 365 }
 366
 367 void RenderFrameHostImpl::OnContextMenu(const ContextMenuParams& params) {
 368   // Validate the URLs in |params|.  If the renderer can't request the URLs
 369   // directly, don't show them in the context menu.
 370   ContextMenuParams validated_params(params);
 371   RenderProcessHost* process = GetProcess();
 372
 373   // We don't validate |unfiltered_link_url| so that this field can be used
 374   // when users want to copy the original link URL.
 375   process->FilterURL(true, &validated_params.link_url);
 376   process->FilterURL(true, &validated_params.src_url);
 377   process->FilterURL(false, &validated_params.page_url);
 378   process->FilterURL(true, &validated_params.frame_url);
 379
 380   delegate_->ShowContextMenu(this, validated_params);
 381 }
 382
 383 void RenderFrameHostImpl::SetPendingShutdown(const base::Closure& on_swap_out) {
 384   render_view_host_->SetPendingShutdown(on_swap_out);
 385 }
 386
 387 bool RenderFrameHostImpl::CanCommitURL(const GURL& url) {
 388   // TODO(creis): We should also check for WebUI pages here.  Also, when the
 389   // out-of-process iframes implementation is ready, we should check for
 390   // cross-site URLs that are not allowed to commit in this process.
 391
 392   // Give the client a chance to disallow URLs from committing.
 393   return GetContentClient()->browser()->CanCommitURL(GetProcess(), url);
 394 }
 395
 396 void RenderFrameHostImpl::Navigate(const FrameMsg_Navigate_Params& params) {
 397   TRACE_EVENT0("frame_host", "RenderFrameHostImpl::Navigate");
 398   // Browser plugin guests are not allowed to navigate outside web-safe schemes,
 399   // so do not grant them the ability to request additional URLs.
 400   if (!GetProcess()->IsGuest()) {
 401     ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
 402         GetProcess()->GetID(), params.url);
 403     if (params.url.SchemeIs(kDataScheme) &&
 404         params.base_url_for_data_url.SchemeIs(kFileScheme)) {
 405       // If 'data:' is used, and we have a 'file:' base url, grant access to
 406       // local files.
 407       ChildProcessSecurityPolicyImpl::GetInstance()->GrantRequestURL(
 408           GetProcess()->GetID(), params.base_url_for_data_url);
 409     }
 410   }
 411
 412   // Only send the message if we aren't suspended at the start of a cross-site
 413   // request.
 414   if (render_view_host_->navigations_suspended_) {
 415     // Shouldn't be possible to have a second navigation while suspended, since
 416     // navigations will only be suspended during a cross-site request.  If a
 417     // second navigation occurs, RenderFrameHostManager will cancel this pending
 418     // RFH and create a new pending RFH.
 419     DCHECK(!render_view_host_->suspended_nav_params_.get());
 420     render_view_host_->suspended_nav_params_.reset(
 421         new FrameMsg_Navigate_Params(params));
 422   } else {
 423     // Get back to a clean state, in case we start a new navigation without
 424     // completing a RVH swap or unload handler.
 425     render_view_host_->SetState(RenderViewHostImpl::STATE_DEFAULT);
 426
 427     Send(new FrameMsg_Navigate(GetRoutingID(), params));
 428   }
 429
 430   // Force the throbber to start. We do this because Blink's "started
 431   // loading" message will be received asynchronously from the UI of the
 432   // browser. But we want to keep the throbber in sync with what's happening
 433   // in the UI. For example, we want to start throbbing immediately when the
 434   // user naivgates even if the renderer is delayed. There is also an issue
 435   // with the throbber starting because the WebUI (which controls whether the
 436   // favicon is displayed) happens synchronously. If the start loading
 437   // messages was asynchronous, then the default favicon would flash in.
 438   //
 439   // Blink doesn't send throb notifications for JavaScript URLs, so we
 440   // don't want to either.
 441   if (!params.url.SchemeIs(kJavaScriptScheme))
 442     delegate_->DidStartLoading(this);
 443 }
 444
 445 void RenderFrameHostImpl::NavigateToURL(const GURL& url) {
 446   FrameMsg_Navigate_Params params;
 447   params.page_id = -1;
 448   params.pending_history_list_offset = -1;
 449   params.current_history_list_offset = -1;
 450   params.current_history_list_length = 0;
 451   params.url = url;
 452   params.transition = PAGE_TRANSITION_LINK;
 453   params.navigation_type = FrameMsg_Navigate_Type::NORMAL;
 454   Navigate(params);
 455 }
 456
 457 }  // namespace content