extensions/renderer/script_context_set.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "extensions/renderer/script_context_set.h"
   6
   7 #include "base/message_loop/message_loop.h"
   8 #include "content/public/common/url_constants.h"
   9 #include "content/public/renderer/render_frame.h"
  10 #include "extensions/common/extension.h"
  11 #include "extensions/renderer/extension_groups.h"
  12 #include "extensions/renderer/script_context.h"
  13 #include "extensions/renderer/script_injection.h"
  14 #include "third_party/WebKit/public/web/WebDocument.h"
  15 #include "third_party/WebKit/public/web/WebLocalFrame.h"
  16 #include "v8/include/v8.h"
  17
  18 namespace extensions {
  19
  20 namespace {
  21 // There is only ever one instance of the ScriptContextSet.
  22 ScriptContextSet* g_context_set = nullptr;
  23 }
  24
  25 ScriptContextSet::ScriptContextSet(ExtensionIdSet* active_extension_ids)
  26     : active_extension_ids_(active_extension_ids) {
  27   DCHECK(!g_context_set);
  28   g_context_set = this;
  29 }
  30
  31 ScriptContextSet::~ScriptContextSet() {
  32   g_context_set = nullptr;
  33 }
  34
  35 ScriptContext* ScriptContextSet::Register(
  36     blink::WebLocalFrame* frame,
  37     const v8::Local<v8::Context>& v8_context,
  38     int extension_group,
  39     int world_id) {
  40   const Extension* extension =
  41       GetExtensionFromFrameAndWorld(frame, world_id, false);
  42   const Extension* effective_extension =
  43       GetExtensionFromFrameAndWorld(frame, world_id, true);
  44
  45   GURL frame_url = ScriptContext::GetDataSourceURLForFrame(frame);
  46   Feature::Context context_type =
  47       ClassifyJavaScriptContext(extension, extension_group, frame_url,
  48                                 frame->document().securityOrigin());
  49   Feature::Context effective_context_type = ClassifyJavaScriptContext(
  50       effective_extension, extension_group,
  51       ScriptContext::GetEffectiveDocumentURL(frame, frame_url, true),
  52       frame->document().securityOrigin());
  53
  54   ScriptContext* context =
  55       new ScriptContext(v8_context, frame, extension, context_type,
  56                         effective_extension, effective_context_type);
  57   contexts_.insert(context);  // takes ownership
  58   return context;
  59 }
  60
  61 void ScriptContextSet::Remove(ScriptContext* context) {
  62   if (contexts_.erase(context)) {
  63     context->Invalidate();
  64     base::MessageLoop::current()->DeleteSoon(FROM_HERE, context);
  65   }
  66 }
  67
  68 ScriptContext* ScriptContextSet::GetCurrent() const {
  69   v8::Isolate* isolate = v8::Isolate::GetCurrent();
  70   return isolate->InContext() ? GetByV8Context(isolate->GetCurrentContext())
  71                               : nullptr;
  72 }
  73
  74 ScriptContext* ScriptContextSet::GetCalling() const {
  75   v8::Isolate* isolate = v8::Isolate::GetCurrent();
  76   v8::Local<v8::Context> calling = isolate->GetCallingContext();
  77   return calling.IsEmpty() ? nullptr : GetByV8Context(calling);
  78 }
  79
  80 ScriptContext* ScriptContextSet::GetByV8Context(
  81     const v8::Local<v8::Context>& v8_context) const {
  82   for (ScriptContext* script_context : contexts_) {
  83     if (script_context->v8_context() == v8_context)
  84       return script_context;
  85   }
  86   return nullptr;
  87 }
  88
  89 ScriptContext* ScriptContextSet::GetContextByV8Context(
  90     const v8::Local<v8::Context>& v8_context) {
  91   // g_context_set can be null in unittests.
  92   return g_context_set ? g_context_set->GetByV8Context(v8_context) : nullptr;
  93 }
  94
  95 void ScriptContextSet::ForEach(
  96     const std::string& extension_id,
  97     content::RenderFrame* render_frame,
  98     const base::Callback<void(ScriptContext*)>& callback) const {
  99   // We copy the context list, because calling into javascript may modify it
 100   // out from under us.
 101   std::set<ScriptContext*> contexts_copy = contexts_;
 102
 103   for (ScriptContext* context : contexts_copy) {
 104     // For the same reason as above, contexts may become invalid while we run.
 105     if (!context->is_valid())
 106       continue;
 107
 108     if (!extension_id.empty()) {
 109       const Extension* extension = context->extension();
 110       if (!extension || (extension_id != extension->id()))
 111         continue;
 112     }
 113
 114     content::RenderFrame* context_render_frame = context->GetRenderFrame();
 115     if (!context_render_frame)
 116       continue;
 117
 118     if (render_frame && render_frame != context_render_frame)
 119       continue;
 120
 121     callback.Run(context);
 122   }
 123 }
 124
 125 std::set<ScriptContext*> ScriptContextSet::OnExtensionUnloaded(
 126     const std::string& extension_id) {
 127   std::set<ScriptContext*> removed;
 128   ForEach(extension_id,
 129           base::Bind(&ScriptContextSet::DispatchOnUnloadEventAndRemove,
 130                      base::Unretained(this), &removed));
 131   return removed;
 132 }
 133
 134 const Extension* ScriptContextSet::GetExtensionFromFrameAndWorld(
 135     const blink::WebLocalFrame* frame,
 136     int world_id,
 137     bool use_effective_url) {
 138   std::string extension_id;
 139   if (world_id != 0) {
 140     // Isolated worlds (content script).
 141     extension_id = ScriptInjection::GetHostIdForIsolatedWorld(world_id);
 142   } else if (!frame->document().securityOrigin().isUnique()) {
 143     // TODO(kalman): Delete the above check.
 144     // Extension pages (chrome-extension:// URLs).
 145     GURL frame_url = ScriptContext::GetDataSourceURLForFrame(frame);
 146     frame_url = ScriptContext::GetEffectiveDocumentURL(frame, frame_url,
 147                                                        use_effective_url);
 148     extension_id =
 149         RendererExtensionRegistry::Get()->GetExtensionOrAppIDByURL(frame_url);
 150   }
 151
 152   // There are conditions where despite a context being associated with an
 153   // extension, no extension actually gets found. Ignore "invalid" because CSP
 154   // blocks extension page loading by switching the extension ID to "invalid".
 155   const Extension* extension =
 156       RendererExtensionRegistry::Get()->GetByID(extension_id);
 157   if (!extension && !extension_id.empty() && extension_id != "invalid") {
 158     // TODO(kalman): Do something here?
 159   }
 160   return extension;
 161 }
 162
 163 Feature::Context ScriptContextSet::ClassifyJavaScriptContext(
 164     const Extension* extension,
 165     int extension_group,
 166     const GURL& url,
 167     const blink::WebSecurityOrigin& origin) {
 168   // WARNING: This logic must match ProcessMap::GetContextType, as much as
 169   // possible.
 170
 171   DCHECK_GE(extension_group, 0);
 172   if (extension_group == EXTENSION_GROUP_CONTENT_SCRIPTS) {
 173     return extension ?  // TODO(kalman): when does this happen?
 174                Feature::CONTENT_SCRIPT_CONTEXT
 175                      : Feature::UNSPECIFIED_CONTEXT;
 176   }
 177
 178   // We have an explicit check for sandboxed pages before checking whether the
 179   // extension is active in this process because:
 180   // 1. Sandboxed pages run in the same process as regular extension pages, so
 181   //    the extension is considered active.
 182   // 2. ScriptContext creation (which triggers bindings injection) happens
 183   //    before the SecurityContext is updated with the sandbox flags (after
 184   //    reading the CSP header), so the caller can't check if the context's
 185   //    security origin is unique yet.
 186   if (ScriptContext::IsSandboxedPage(url))
 187     return Feature::WEB_PAGE_CONTEXT;
 188
 189   if (extension && active_extension_ids_->count(extension->id()) > 0) {
 190     // |extension| is active in this process, but it could be either a true
 191     // extension process or within the extent of a hosted app. In the latter
 192     // case this would usually be considered a (blessed) web page context,
 193     // unless the extension in question is a component extension, in which case
 194     // we cheat and call it blessed.
 195     return (extension->is_hosted_app() &&
 196             extension->location() != Manifest::COMPONENT)
 197                ? Feature::BLESSED_WEB_PAGE_CONTEXT
 198                : Feature::BLESSED_EXTENSION_CONTEXT;
 199   }
 200
 201   // TODO(kalman): This isUnique() check is wrong, it should be performed as
 202   // part of ScriptContext::IsSandboxedPage().
 203   if (!origin.isUnique() &&
 204       RendererExtensionRegistry::Get()->ExtensionBindingsAllowed(url)) {
 205     if (!extension)  // TODO(kalman): when does this happen?
 206       return Feature::UNSPECIFIED_CONTEXT;
 207     return extension->is_hosted_app() ? Feature::BLESSED_WEB_PAGE_CONTEXT
 208                                       : Feature::UNBLESSED_EXTENSION_CONTEXT;
 209   }
 210
 211   if (!url.is_valid())
 212     return Feature::UNSPECIFIED_CONTEXT;
 213
 214   if (url.SchemeIs(content::kChromeUIScheme))
 215     return Feature::WEBUI_CONTEXT;
 216
 217   return Feature::WEB_PAGE_CONTEXT;
 218 }
 219
 220 void ScriptContextSet::DispatchOnUnloadEventAndRemove(
 221     std::set<ScriptContext*>* out,
 222     ScriptContext* context) {
 223   context->DispatchOnUnloadEvent();
 224   Remove(context);  // deleted asynchronously
 225   out->insert(context);
 226 }
 227
 228 }  // namespace extensions