content/browser/webui/url_data_manager_backend.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/webui/url_data_manager_backend.h"
   6
   7 #include <set>
   8
   9 #include "base/basictypes.h"
  10 #include "base/bind.h"
  11 #include "base/command_line.h"
  12 #include "base/compiler_specific.h"
  13 #include "base/debug/trace_event.h"
  14 #include "base/lazy_instance.h"
  15 #include "base/memory/ref_counted.h"
  16 #include "base/memory/ref_counted_memory.h"
  17 #include "base/memory/weak_ptr.h"
  18 #include "base/message_loop/message_loop.h"
  19 #include "base/strings/string_util.h"
  20 #include "base/strings/stringprintf.h"
  21 #include "content/browser/appcache/view_appcache_internals_job.h"
  22 #include "content/browser/fileapi/chrome_blob_storage_context.h"
  23 #include "content/browser/histogram_internals_request_job.h"
  24 #include "content/browser/net/view_blob_internals_job_factory.h"
  25 #include "content/browser/net/view_http_cache_job_factory.h"
  26 #include "content/browser/resource_context_impl.h"
  27 #include "content/browser/tcmalloc_internals_request_job.h"
  28 #include "content/browser/webui/shared_resources_data_source.h"
  29 #include "content/browser/webui/url_data_source_impl.h"
  30 #include "content/public/browser/browser_context.h"
  31 #include "content/public/browser/browser_thread.h"
  32 #include "content/public/browser/content_browser_client.h"
  33 #include "content/public/browser/render_process_host.h"
  34 #include "content/public/browser/resource_request_info.h"
  35 #include "content/public/common/url_constants.h"
  36 #include "net/base/io_buffer.h"
  37 #include "net/base/net_errors.h"
  38 #include "net/http/http_response_headers.h"
  39 #include "net/http/http_status_code.h"
  40 #include "net/url_request/url_request.h"
  41 #include "net/url_request/url_request_context.h"
  42 #include "net/url_request/url_request_job.h"
  43 #include "net/url_request/url_request_job_factory.h"
  44 #include "url/url_util.h"
  45
  46 using appcache::AppCacheService;
  47
  48 namespace content {
  49
  50 namespace {
  51
  52 // TODO(tsepez) remove unsafe-eval when bidichecker_packaged.js fixed.
  53 const char kChromeURLContentSecurityPolicyHeaderBase[] =
  54     "Content-Security-Policy: script-src chrome://resources "
  55     "'self' 'unsafe-eval'; ";
  56
  57 const char kChromeURLXFrameOptionsHeader[] = "X-Frame-Options: DENY";
  58
  59 const int kNoRenderProcessId = -1;
  60
  61 bool SchemeIsInSchemes(const std::string& scheme,
  62                        const std::vector<std::string>& schemes) {
  63   return std::find(schemes.begin(), schemes.end(), scheme) != schemes.end();
  64 }
  65
  66 // Returns whether |url| passes some sanity checks and is a valid GURL.
  67 bool CheckURLIsValid(const GURL& url) {
  68   std::vector<std::string> additional_schemes;
  69   DCHECK(url.SchemeIs(kChromeDevToolsScheme) || url.SchemeIs(kChromeUIScheme) ||
  70          (GetContentClient()->browser()->GetAdditionalWebUISchemes(
  71               &additional_schemes),
  72           SchemeIsInSchemes(url.scheme(), additional_schemes)));
  73
  74   if (!url.is_valid()) {
  75     NOTREACHED();
  76     return false;
  77   }
  78
  79   return true;
  80 }
  81
  82 // Parse |url| to get the path which will be used to resolve the request. The
  83 // path is the remaining portion after the scheme and hostname.
  84 void URLToRequestPath(const GURL& url, std::string* path) {
  85   const std::string& spec = url.possibly_invalid_spec();
  86   const url_parse::Parsed& parsed = url.parsed_for_possibly_invalid_spec();
  87   // + 1 to skip the slash at the beginning of the path.
  88   int offset = parsed.CountCharactersBefore(url_parse::Parsed::PATH, false) + 1;
  89
  90   if (offset < static_cast<int>(spec.size()))
  91     path->assign(spec.substr(offset));
  92 }
  93
  94 }  // namespace
  95
  96 // URLRequestChromeJob is a net::URLRequestJob that manages running
  97 // chrome-internal resource requests asynchronously.
  98 // It hands off URL requests to ChromeURLDataManager, which asynchronously
  99 // calls back once the data is available.
 100 class URLRequestChromeJob : public net::URLRequestJob,
 101                             public base::SupportsWeakPtr<URLRequestChromeJob> {
 102  public:
 103   // |is_incognito| set when job is generated from an incognito profile.
 104   URLRequestChromeJob(net::URLRequest* request,
 105                       net::NetworkDelegate* network_delegate,
 106                       URLDataManagerBackend* backend,
 107                       bool is_incognito);
 108
 109   // net::URLRequestJob implementation.
 110   virtual void Start() OVERRIDE;
 111   virtual void Kill() OVERRIDE;
 112   virtual bool ReadRawData(net::IOBuffer* buf,
 113                            int buf_size,
 114                            int* bytes_read) OVERRIDE;
 115   virtual bool GetMimeType(std::string* mime_type) const OVERRIDE;
 116   virtual int GetResponseCode() const OVERRIDE;
 117   virtual void GetResponseInfo(net::HttpResponseInfo* info) OVERRIDE;
 118
 119   // Used to notify that the requested data's |mime_type| is ready.
 120   void MimeTypeAvailable(const std::string& mime_type);
 121
 122   // Called by ChromeURLDataManager to notify us that the data blob is ready
 123   // for us.
 124   void DataAvailable(base::RefCountedMemory* bytes);
 125
 126   void set_mime_type(const std::string& mime_type) {
 127     mime_type_ = mime_type;
 128   }
 129
 130   void set_allow_caching(bool allow_caching) {
 131     allow_caching_ = allow_caching;
 132   }
 133
 134   void set_add_content_security_policy(bool add_content_security_policy) {
 135     add_content_security_policy_ = add_content_security_policy;
 136   }
 137
 138   void set_content_security_policy_object_source(
 139       const std::string& data) {
 140     content_security_policy_object_source_ = data;
 141   }
 142
 143   void set_content_security_policy_frame_source(
 144       const std::string& data) {
 145     content_security_policy_frame_source_ = data;
 146   }
 147
 148   void set_deny_xframe_options(bool deny_xframe_options) {
 149     deny_xframe_options_ = deny_xframe_options;
 150   }
 151
 152   void set_send_content_type_header(bool send_content_type_header) {
 153     send_content_type_header_ = send_content_type_header;
 154   }
 155
 156   // Returns true when job was generated from an incognito profile.
 157   bool is_incognito() const {
 158     return is_incognito_;
 159   }
 160
 161  private:
 162   virtual ~URLRequestChromeJob();
 163
 164   // Helper for Start(), to let us start asynchronously.
 165   // (This pattern is shared by most net::URLRequestJob implementations.)
 166   void StartAsync(bool allowed);
 167
 168   // Called on the UI thread to check if this request is allowed.
 169   static void CheckStoragePartitionMatches(
 170       int render_process_id,
 171       const GURL& url,
 172       const base::WeakPtr<URLRequestChromeJob>& job);
 173
 174   // Do the actual copy from data_ (the data we're serving) into |buf|.
 175   // Separate from ReadRawData so we can handle async I/O.
 176   void CompleteRead(net::IOBuffer* buf, int buf_size, int* bytes_read);
 177
 178   // The actual data we're serving.  NULL until it's been fetched.
 179   scoped_refptr<base::RefCountedMemory> data_;
 180   // The current offset into the data that we're handing off to our
 181   // callers via the Read interfaces.
 182   int data_offset_;
 183
 184   // For async reads, we keep around a pointer to the buffer that
 185   // we're reading into.
 186   scoped_refptr<net::IOBuffer> pending_buf_;
 187   int pending_buf_size_;
 188   std::string mime_type_;
 189
 190   // If true, set a header in the response to prevent it from being cached.
 191   bool allow_caching_;
 192
 193   // If true, set the Content Security Policy (CSP) header.
 194   bool add_content_security_policy_;
 195
 196   // These are used with the CSP.
 197   std::string content_security_policy_object_source_;
 198   std::string content_security_policy_frame_source_;
 199
 200   // If true, sets  the "X-Frame-Options: DENY" header.
 201   bool deny_xframe_options_;
 202
 203   // If true, sets the "Content-Type: <mime-type>" header.
 204   bool send_content_type_header_;
 205
 206   // True when job is generated from an incognito profile.
 207   const bool is_incognito_;
 208
 209   // The backend is owned by ChromeURLRequestContext and always outlives us.
 210   URLDataManagerBackend* backend_;
 211
 212   base::WeakPtrFactory<URLRequestChromeJob> weak_factory_;
 213
 214   DISALLOW_COPY_AND_ASSIGN(URLRequestChromeJob);
 215 };
 216
 217 URLRequestChromeJob::URLRequestChromeJob(net::URLRequest* request,
 218                                          net::NetworkDelegate* network_delegate,
 219                                          URLDataManagerBackend* backend,
 220                                          bool is_incognito)
 221     : net::URLRequestJob(request, network_delegate),
 222       data_offset_(0),
 223       pending_buf_size_(0),
 224       allow_caching_(true),
 225       add_content_security_policy_(true),
 226       content_security_policy_object_source_("object-src 'none';"),
 227       content_security_policy_frame_source_("frame-src 'none';"),
 228       deny_xframe_options_(true),
 229       send_content_type_header_(false),
 230       is_incognito_(is_incognito),
 231       backend_(backend),
 232       weak_factory_(this) {
 233   DCHECK(backend);
 234 }
 235
 236 URLRequestChromeJob::~URLRequestChromeJob() {
 237   CHECK(!backend_->HasPendingJob(this));
 238 }
 239
 240 void URLRequestChromeJob::Start() {
 241   int render_process_id, unused;
 242   bool is_renderer_request = ResourceRequestInfo::GetRenderFrameForRequest(
 243       request_, &render_process_id, &unused);
 244   if (!is_renderer_request)
 245     render_process_id = kNoRenderProcessId;
 246   BrowserThread::PostTask(
 247       BrowserThread::UI,
 248       FROM_HERE,
 249       base::Bind(&URLRequestChromeJob::CheckStoragePartitionMatches,
 250                  render_process_id, request_->url(), AsWeakPtr()));
 251   TRACE_EVENT_ASYNC_BEGIN1("browser", "DataManager:Request", this, "URL",
 252       request_->url().possibly_invalid_spec());
 253 }
 254
 255 void URLRequestChromeJob::Kill() {
 256   backend_->RemoveRequest(this);
 257 }
 258
 259 bool URLRequestChromeJob::GetMimeType(std::string* mime_type) const {
 260   *mime_type = mime_type_;
 261   return !mime_type_.empty();
 262 }
 263
 264 int URLRequestChromeJob::GetResponseCode() const {
 265   return net::HTTP_OK;
 266 }
 267
 268 void URLRequestChromeJob::GetResponseInfo(net::HttpResponseInfo* info) {
 269   DCHECK(!info->headers.get());
 270   // Set the headers so that requests serviced by ChromeURLDataManager return a
 271   // status code of 200. Without this they return a 0, which makes the status
 272   // indistiguishable from other error types. Instant relies on getting a 200.
 273   info->headers = new net::HttpResponseHeaders("HTTP/1.1 200 OK");
 274
 275   // Determine the least-privileged content security policy header, if any,
 276   // that is compatible with a given WebUI URL, and append it to the existing
 277   // response headers.
 278   if (add_content_security_policy_) {
 279     std::string base = kChromeURLContentSecurityPolicyHeaderBase;
 280     base.append(content_security_policy_object_source_);
 281     base.append(content_security_policy_frame_source_);
 282     info->headers->AddHeader(base);
 283   }
 284
 285   if (deny_xframe_options_)
 286     info->headers->AddHeader(kChromeURLXFrameOptionsHeader);
 287
 288   if (!allow_caching_)
 289     info->headers->AddHeader("Cache-Control: no-cache");
 290
 291   if (send_content_type_header_ && !mime_type_.empty()) {
 292     std::string content_type =
 293         base::StringPrintf("%s:%s", net::HttpRequestHeaders::kContentType,
 294                            mime_type_.c_str());
 295     info->headers->AddHeader(content_type);
 296   }
 297 }
 298
 299 void URLRequestChromeJob::MimeTypeAvailable(const std::string& mime_type) {
 300   set_mime_type(mime_type);
 301   NotifyHeadersComplete();
 302 }
 303
 304 void URLRequestChromeJob::DataAvailable(base::RefCountedMemory* bytes) {
 305   TRACE_EVENT_ASYNC_END0("browser", "DataManager:Request", this);
 306   if (bytes) {
 307     // The request completed, and we have all the data.
 308     // Clear any IO pending status.
 309     SetStatus(net::URLRequestStatus());
 310
 311     data_ = bytes;
 312     int bytes_read;
 313     if (pending_buf_.get()) {
 314       CHECK(pending_buf_->data());
 315       CompleteRead(pending_buf_.get(), pending_buf_size_, &bytes_read);
 316       pending_buf_ = NULL;
 317       NotifyReadComplete(bytes_read);
 318     }
 319   } else {
 320     // The request failed.
 321     NotifyDone(net::URLRequestStatus(net::URLRequestStatus::FAILED,
 322                                      net::ERR_FAILED));
 323   }
 324 }
 325
 326 bool URLRequestChromeJob::ReadRawData(net::IOBuffer* buf, int buf_size,
 327                                       int* bytes_read) {
 328   if (!data_.get()) {
 329     SetStatus(net::URLRequestStatus(net::URLRequestStatus::IO_PENDING, 0));
 330     DCHECK(!pending_buf_.get());
 331     CHECK(buf->data());
 332     pending_buf_ = buf;
 333     pending_buf_size_ = buf_size;
 334     return false;  // Tell the caller we're still waiting for data.
 335   }
 336
 337   // Otherwise, the data is available.
 338   CompleteRead(buf, buf_size, bytes_read);
 339   return true;
 340 }
 341
 342 void URLRequestChromeJob::CompleteRead(net::IOBuffer* buf, int buf_size,
 343                                        int* bytes_read) {
 344   int remaining = static_cast<int>(data_->size()) - data_offset_;
 345   if (buf_size > remaining)
 346     buf_size = remaining;
 347   if (buf_size > 0) {
 348     memcpy(buf->data(), data_->front() + data_offset_, buf_size);
 349     data_offset_ += buf_size;
 350   }
 351   *bytes_read = buf_size;
 352 }
 353
 354 void URLRequestChromeJob::CheckStoragePartitionMatches(
 355     int render_process_id,
 356     const GURL& url,
 357     const base::WeakPtr<URLRequestChromeJob>& job) {
 358   // The embedder could put some webui pages in separate storage partition.
 359   // RenderProcessHostImpl::IsSuitableHost would guard against top level pages
 360   // being in the same process. We do an extra check to guard against an
 361   // exploited renderer pretending to add them as a subframe. We skip this check
 362   // for resources.
 363   bool allowed = false;
 364   std::vector<std::string> hosts;
 365   GetContentClient()->
 366       browser()->GetAdditionalWebUIHostsToIgnoreParititionCheck(&hosts);
 367   if (url.SchemeIs(kChromeUIScheme) &&
 368       (url.SchemeIs(kChromeUIScheme) ||
 369        std::find(hosts.begin(), hosts.end(), url.host()) != hosts.end())) {
 370     allowed = true;
 371   } else if (render_process_id == kNoRenderProcessId) {
 372     // Request was not issued by renderer.
 373     allowed = true;
 374   } else {
 375     RenderProcessHost* process = RenderProcessHost::FromID(render_process_id);
 376     if (process) {
 377       StoragePartition* partition = BrowserContext::GetStoragePartitionForSite(
 378           process->GetBrowserContext(), url);
 379       allowed = partition == process->GetStoragePartition();
 380     }
 381   }
 382
 383   BrowserThread::PostTask(
 384       BrowserThread::IO,
 385       FROM_HERE,
 386       base::Bind(&URLRequestChromeJob::StartAsync, job, allowed));
 387 }
 388
 389 void URLRequestChromeJob::StartAsync(bool allowed) {
 390   if (!request_)
 391     return;
 392
 393   if (!allowed || !backend_->StartRequest(request_, this)) {
 394     NotifyStartError(net::URLRequestStatus(net::URLRequestStatus::FAILED,
 395                                            net::ERR_INVALID_URL));
 396   }
 397 }
 398
 399 namespace {
 400
 401 // Gets mime type for data that is available from |source| by |path|.
 402 // After that, notifies |job| that mime type is available. This method
 403 // should be called on the UI thread, but notification is performed on
 404 // the IO thread.
 405 void GetMimeTypeOnUI(URLDataSourceImpl* source,
 406                      const std::string& path,
 407                      const base::WeakPtr<URLRequestChromeJob>& job) {
 408   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 409   std::string mime_type = source->source()->GetMimeType(path);
 410   BrowserThread::PostTask(
 411       BrowserThread::IO, FROM_HERE,
 412       base::Bind(&URLRequestChromeJob::MimeTypeAvailable, job, mime_type));
 413 }
 414
 415 }  // namespace
 416
 417 namespace {
 418
 419 class ChromeProtocolHandler
 420     : public net::URLRequestJobFactory::ProtocolHandler {
 421  public:
 422   // |is_incognito| should be set for incognito profiles.
 423   ChromeProtocolHandler(ResourceContext* resource_context,
 424                         bool is_incognito,
 425                         AppCacheService* appcache_service,
 426                         ChromeBlobStorageContext* blob_storage_context)
 427       : resource_context_(resource_context),
 428         is_incognito_(is_incognito),
 429         appcache_service_(appcache_service),
 430         blob_storage_context_(blob_storage_context) {}
 431   virtual ~ChromeProtocolHandler() {}
 432
 433   virtual net::URLRequestJob* MaybeCreateJob(
 434       net::URLRequest* request,
 435       net::NetworkDelegate* network_delegate) const OVERRIDE {
 436     DCHECK(request);
 437
 438     // Check for chrome://view-http-cache/*, which uses its own job type.
 439     if (ViewHttpCacheJobFactory::IsSupportedURL(request->url()))
 440       return ViewHttpCacheJobFactory::CreateJobForRequest(request,
 441                                                           network_delegate);
 442
 443     // Next check for chrome://appcache-internals/, which uses its own job type.
 444     if (request->url().SchemeIs(kChromeUIScheme) &&
 445         request->url().host() == kChromeUIAppCacheInternalsHost) {
 446       return ViewAppCacheInternalsJobFactory::CreateJobForRequest(
 447           request, network_delegate, appcache_service_);
 448     }
 449
 450     // Next check for chrome://blob-internals/, which uses its own job type.
 451     if (ViewBlobInternalsJobFactory::IsSupportedURL(request->url())) {
 452       return ViewBlobInternalsJobFactory::CreateJobForRequest(
 453           request, network_delegate, blob_storage_context_->context());
 454     }
 455
 456 #if defined(USE_TCMALLOC)
 457     // Next check for chrome://tcmalloc/, which uses its own job type.
 458     if (request->url().SchemeIs(kChromeUIScheme) &&
 459         request->url().host() == kChromeUITcmallocHost) {
 460       return new TcmallocInternalsRequestJob(request, network_delegate);
 461     }
 462 #endif
 463
 464     // Next check for chrome://histograms/, which uses its own job type.
 465     if (request->url().SchemeIs(kChromeUIScheme) &&
 466         request->url().host() == kChromeUIHistogramHost) {
 467       return new HistogramInternalsRequestJob(request, network_delegate);
 468     }
 469
 470     // Fall back to using a custom handler
 471     return new URLRequestChromeJob(
 472         request, network_delegate,
 473         GetURLDataManagerForResourceContext(resource_context_), is_incognito_);
 474   }
 475
 476   virtual bool IsSafeRedirectTarget(const GURL& location) const OVERRIDE {
 477     return false;
 478   }
 479
 480  private:
 481   // These members are owned by ProfileIOData, which owns this ProtocolHandler.
 482   content::ResourceContext* const resource_context_;
 483
 484   // True when generated from an incognito profile.
 485   const bool is_incognito_;
 486   AppCacheService* appcache_service_;
 487   ChromeBlobStorageContext* blob_storage_context_;
 488
 489   DISALLOW_COPY_AND_ASSIGN(ChromeProtocolHandler);
 490 };
 491
 492 }  // namespace
 493
 494 URLDataManagerBackend::URLDataManagerBackend()
 495     : next_request_id_(0) {
 496   URLDataSource* shared_source = new SharedResourcesDataSource();
 497   URLDataSourceImpl* source_impl =
 498       new URLDataSourceImpl(shared_source->GetSource(), shared_source);
 499   AddDataSource(source_impl);
 500 }
 501
 502 URLDataManagerBackend::~URLDataManagerBackend() {
 503   for (DataSourceMap::iterator i = data_sources_.begin();
 504        i != data_sources_.end(); ++i) {
 505     i->second->backend_ = NULL;
 506   }
 507   data_sources_.clear();
 508 }
 509
 510 // static
 511 net::URLRequestJobFactory::ProtocolHandler*
 512 URLDataManagerBackend::CreateProtocolHandler(
 513     content::ResourceContext* resource_context,
 514     bool is_incognito,
 515     AppCacheService* appcache_service,
 516     ChromeBlobStorageContext* blob_storage_context) {
 517   DCHECK(resource_context);
 518   return new ChromeProtocolHandler(
 519       resource_context, is_incognito, appcache_service, blob_storage_context);
 520 }
 521
 522 void URLDataManagerBackend::AddDataSource(
 523     URLDataSourceImpl* source) {
 524   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 525   DataSourceMap::iterator i = data_sources_.find(source->source_name());
 526   if (i != data_sources_.end()) {
 527     if (!source->source()->ShouldReplaceExistingSource())
 528       return;
 529     i->second->backend_ = NULL;
 530   }
 531   data_sources_[source->source_name()] = source;
 532   source->backend_ = this;
 533 }
 534
 535 bool URLDataManagerBackend::HasPendingJob(
 536     URLRequestChromeJob* job) const {
 537   for (PendingRequestMap::const_iterator i = pending_requests_.begin();
 538        i != pending_requests_.end(); ++i) {
 539     if (i->second == job)
 540       return true;
 541   }
 542   return false;
 543 }
 544
 545 bool URLDataManagerBackend::StartRequest(const net::URLRequest* request,
 546                                          URLRequestChromeJob* job) {
 547   if (!CheckURLIsValid(request->url()))
 548     return false;
 549
 550   URLDataSourceImpl* source = GetDataSourceFromURL(request->url());
 551   if (!source)
 552     return false;
 553
 554   if (!source->source()->ShouldServiceRequest(request))
 555     return false;
 556
 557   std::string path;
 558   URLToRequestPath(request->url(), &path);
 559   source->source()->WillServiceRequest(request, &path);
 560
 561   // Save this request so we know where to send the data.
 562   RequestID request_id = next_request_id_++;
 563   pending_requests_.insert(std::make_pair(request_id, job));
 564
 565   job->set_allow_caching(source->source()->AllowCaching());
 566   job->set_add_content_security_policy(
 567       source->source()->ShouldAddContentSecurityPolicy());
 568   job->set_content_security_policy_object_source(
 569       source->source()->GetContentSecurityPolicyObjectSrc());
 570   job->set_content_security_policy_frame_source(
 571       source->source()->GetContentSecurityPolicyFrameSrc());
 572   job->set_deny_xframe_options(
 573       source->source()->ShouldDenyXFrameOptions());
 574   job->set_send_content_type_header(
 575       source->source()->ShouldServeMimeTypeAsContentTypeHeader());
 576
 577   // Look up additional request info to pass down.
 578   int render_process_id = -1;
 579   int render_frame_id = -1;
 580   ResourceRequestInfo::GetRenderFrameForRequest(request,
 581                                                 &render_process_id,
 582                                                 &render_frame_id);
 583
 584   // Forward along the request to the data source.
 585   base::MessageLoop* target_message_loop =
 586       source->source()->MessageLoopForRequestPath(path);
 587   if (!target_message_loop) {
 588     job->MimeTypeAvailable(source->source()->GetMimeType(path));
 589     // Eliminate potentially dangling pointer to avoid future use.
 590     job = NULL;
 591
 592     // The DataSource is agnostic to which thread StartDataRequest is called
 593     // on for this path.  Call directly into it from this thread, the IO
 594     // thread.
 595     source->source()->StartDataRequest(
 596         path, render_process_id, render_frame_id,
 597         base::Bind(&URLDataSourceImpl::SendResponse, source, request_id));
 598   } else {
 599     // URLRequestChromeJob should receive mime type before data. This
 600     // is guaranteed because request for mime type is placed in the
 601     // message loop before request for data. And correspondingly their
 602     // replies are put on the IO thread in the same order.
 603     target_message_loop->PostTask(
 604         FROM_HERE,
 605         base::Bind(&GetMimeTypeOnUI,
 606                    scoped_refptr<URLDataSourceImpl>(source),
 607                    path, job->AsWeakPtr()));
 608
 609     // The DataSource wants StartDataRequest to be called on a specific thread,
 610     // usually the UI thread, for this path.
 611     target_message_loop->PostTask(
 612         FROM_HERE,
 613         base::Bind(&URLDataManagerBackend::CallStartRequest,
 614                    make_scoped_refptr(source), path, render_process_id,
 615                    render_frame_id, request_id));
 616   }
 617   return true;
 618 }
 619
 620 URLDataSourceImpl* URLDataManagerBackend::GetDataSourceFromURL(
 621     const GURL& url) {
 622   // The input usually looks like: chrome://source_name/extra_bits?foo
 623   // so do a lookup using the host of the URL.
 624   DataSourceMap::iterator i = data_sources_.find(url.host());
 625   if (i != data_sources_.end())
 626     return i->second.get();
 627
 628   // No match using the host of the URL, so do a lookup using the scheme for
 629   // URLs on the form source_name://extra_bits/foo .
 630   i = data_sources_.find(url.scheme() + "://");
 631   if (i != data_sources_.end())
 632     return i->second.get();
 633
 634   // No matches found, so give up.
 635   return NULL;
 636 }
 637
 638 void URLDataManagerBackend::CallStartRequest(
 639     scoped_refptr<URLDataSourceImpl> source,
 640     const std::string& path,
 641     int render_process_id,
 642     int render_frame_id,
 643     int request_id) {
 644   if (BrowserThread::CurrentlyOn(BrowserThread::UI) &&
 645       render_process_id != -1 &&
 646       !RenderProcessHost::FromID(render_process_id)) {
 647     // Make the request fail if its initiating renderer is no longer valid.
 648     // This can happen when the IO thread posts this task just before the
 649     // renderer shuts down.
 650     source->SendResponse(request_id, NULL);
 651     return;
 652   }
 653   source->source()->StartDataRequest(
 654       path,
 655       render_process_id,
 656       render_frame_id,
 657       base::Bind(&URLDataSourceImpl::SendResponse, source, request_id));
 658 }
 659
 660 void URLDataManagerBackend::RemoveRequest(URLRequestChromeJob* job) {
 661   // Remove the request from our list of pending requests.
 662   // If/when the source sends the data that was requested, the data will just
 663   // be thrown away.
 664   for (PendingRequestMap::iterator i = pending_requests_.begin();
 665        i != pending_requests_.end(); ++i) {
 666     if (i->second == job) {
 667       pending_requests_.erase(i);
 668       return;
 669     }
 670   }
 671 }
 672
 673 void URLDataManagerBackend::DataAvailable(RequestID request_id,
 674                                           base::RefCountedMemory* bytes) {
 675   // Forward this data on to the pending net::URLRequest, if it exists.
 676   PendingRequestMap::iterator i = pending_requests_.find(request_id);
 677   if (i != pending_requests_.end()) {
 678     URLRequestChromeJob* job(i->second);
 679     pending_requests_.erase(i);
 680     job->DataAvailable(bytes);
 681   }
 682 }
 683
 684 namespace {
 685
 686 class DevToolsJobFactory
 687     : public net::URLRequestJobFactory::ProtocolHandler {
 688  public:
 689   // |is_incognito| should be set for incognito profiles.
 690   DevToolsJobFactory(content::ResourceContext* resource_context,
 691                      bool is_incognito);
 692   virtual ~DevToolsJobFactory();
 693
 694   virtual net::URLRequestJob* MaybeCreateJob(
 695       net::URLRequest* request,
 696       net::NetworkDelegate* network_delegate) const OVERRIDE;
 697
 698  private:
 699   // |resource_context_| and |network_delegate_| are owned by ProfileIOData,
 700   // which owns this ProtocolHandler.
 701   content::ResourceContext* const resource_context_;
 702
 703   // True when generated from an incognito profile.
 704   const bool is_incognito_;
 705
 706   DISALLOW_COPY_AND_ASSIGN(DevToolsJobFactory);
 707 };
 708
 709 DevToolsJobFactory::DevToolsJobFactory(
 710     content::ResourceContext* resource_context,
 711     bool is_incognito)
 712     : resource_context_(resource_context),
 713       is_incognito_(is_incognito) {
 714   DCHECK(resource_context_);
 715 }
 716
 717 DevToolsJobFactory::~DevToolsJobFactory() {}
 718
 719 net::URLRequestJob*
 720 DevToolsJobFactory::MaybeCreateJob(
 721     net::URLRequest* request, net::NetworkDelegate* network_delegate) const {
 722   return new URLRequestChromeJob(
 723       request, network_delegate,
 724       GetURLDataManagerForResourceContext(resource_context_), is_incognito_);
 725 }
 726
 727 }  // namespace
 728
 729 net::URLRequestJobFactory::ProtocolHandler*
 730 CreateDevToolsProtocolHandler(content::ResourceContext* resource_context,
 731                               bool is_incognito) {
 732   return new DevToolsJobFactory(resource_context, is_incognito);
 733 }
 734
 735 }  // namespace content