chrome/browser/extensions/api/cryptotoken_private/cryptotoken_private_api.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/extensions/api/cryptotoken_private/cryptotoken_private_api.h"
   6
   7 #include "extensions/common/error_utils.h"
   8 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
   9
  10 namespace extensions {
  11 namespace api {
  12
  13 const char kGoogleDotCom[] = "google.com";
  14 const char* kGoogleGstaticAppIds[] = {
  15   "https://www.gstatic.com/securitykey/origins.json",
  16   "https://www.gstatic.com/securitykey/a/google.com/origins.json"
  17 };
  18
  19 CryptotokenPrivateCanOriginAssertAppIdFunction::
  20     CryptotokenPrivateCanOriginAssertAppIdFunction()
  21     : chrome_details_(this) {
  22 }
  23
  24 ExtensionFunction::ResponseAction
  25 CryptotokenPrivateCanOriginAssertAppIdFunction::Run() {
  26   scoped_ptr<cryptotoken_private::CanOriginAssertAppId::Params> params =
  27       cryptotoken_private::CanOriginAssertAppId::Params::Create(*args_);
  28   EXTENSION_FUNCTION_VALIDATE(params);
  29
  30   const GURL origin_url(params->security_origin);
  31   if (!origin_url.is_valid()) {
  32     return RespondNow(Error(extensions::ErrorUtils::FormatErrorMessage(
  33         "Security origin * is not a valid URL", params->security_origin)));
  34   }
  35   const GURL app_id_url(params->app_id_url);
  36   if (!app_id_url.is_valid()) {
  37     return RespondNow(Error(extensions::ErrorUtils::FormatErrorMessage(
  38         "appId * is not a valid URL", params->app_id_url)));
  39   }
  40
  41   if (origin_url == app_id_url) {
  42     return RespondNow(OneArgument(new base::FundamentalValue(true)));
  43   }
  44
  45   // Fetch the eTLD+1 of both.
  46   const std::string origin_etldp1 =
  47       net::registry_controlled_domains::GetDomainAndRegistry(
  48           origin_url,
  49           net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
  50   if (origin_etldp1.empty()) {
  51     return RespondNow(Error(extensions::ErrorUtils::FormatErrorMessage(
  52         "Could not find an eTLD for origin *", params->security_origin)));
  53   }
  54   const std::string app_id_etldp1 =
  55       net::registry_controlled_domains::GetDomainAndRegistry(
  56           app_id_url,
  57           net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
  58   if (app_id_etldp1.empty()) {
  59     return RespondNow(Error(extensions::ErrorUtils::FormatErrorMessage(
  60         "Could not find an eTLD for appId *", params->app_id_url)));
  61   }
  62   if (origin_etldp1 == app_id_etldp1) {
  63     return RespondNow(OneArgument(new base::FundamentalValue(true)));
  64   }
  65   // For legacy purposes, allow google.com origins to assert certain
  66   // gstatic.com appIds.
  67   // TODO(juanlang): remove when legacy constraints are removed.
  68   if (origin_etldp1 == kGoogleDotCom) {
  69     for (size_t i = 0;
  70          i < sizeof(kGoogleGstaticAppIds) / sizeof(kGoogleGstaticAppIds[0]);
  71          i++) {
  72       if (params->app_id_url == kGoogleGstaticAppIds[i]) {
  73         return RespondNow(OneArgument(new base::FundamentalValue(true)));
  74       }
  75     }
  76   }
  77   return RespondNow(OneArgument(new base::FundamentalValue(false)));
  78 }
  79
  80 }  // namespace api
  81 }  // namespace extensions