content/browser/webui/url_data_manager_backend.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/webui/url_data_manager_backend.h"
   6
   7 #include <set>
   8
   9 #include "base/basictypes.h"
  10 #include "base/bind.h"
  11 #include "base/command_line.h"
  12 #include "base/compiler_specific.h"
  13 #include "base/debug/alias.h"
  14 #include "base/lazy_instance.h"
  15 #include "base/location.h"
  16 #include "base/memory/ref_counted.h"
  17 #include "base/memory/ref_counted_memory.h"
  18 #include "base/memory/weak_ptr.h"
  19 #include "base/profiler/scoped_tracker.h"
  20 #include "base/single_thread_task_runner.h"
  21 #include "base/strings/string_util.h"
  22 #include "base/strings/stringprintf.h"
  23 #include "base/trace_event/trace_event.h"
  24 #include "content/browser/appcache/view_appcache_internals_job.h"
  25 #include "content/browser/fileapi/chrome_blob_storage_context.h"
  26 #include "content/browser/histogram_internals_request_job.h"
  27 #include "content/browser/net/view_blob_internals_job_factory.h"
  28 #include "content/browser/net/view_http_cache_job_factory.h"
  29 #include "content/browser/resource_context_impl.h"
  30 #include "content/browser/tcmalloc_internals_request_job.h"
  31 #include "content/browser/webui/shared_resources_data_source.h"
  32 #include "content/browser/webui/url_data_source_impl.h"
  33 #include "content/public/browser/browser_context.h"
  34 #include "content/public/browser/browser_thread.h"
  35 #include "content/public/browser/content_browser_client.h"
  36 #include "content/public/browser/render_process_host.h"
  37 #include "content/public/browser/resource_request_info.h"
  38 #include "content/public/common/url_constants.h"
  39 #include "net/base/io_buffer.h"
  40 #include "net/base/net_errors.h"
  41 #include "net/http/http_response_headers.h"
  42 #include "net/http/http_status_code.h"
  43 #include "net/url_request/url_request.h"
  44 #include "net/url_request/url_request_context.h"
  45 #include "net/url_request/url_request_job.h"
  46 #include "net/url_request/url_request_job_factory.h"
  47 #include "url/url_util.h"
  48
  49 namespace content {
  50
  51 namespace {
  52
  53 // TODO(tsepez) remove unsafe-eval when bidichecker_packaged.js fixed.
  54 const char kChromeURLContentSecurityPolicyHeaderBase[] =
  55     "Content-Security-Policy: script-src chrome://resources "
  56     "'self' 'unsafe-eval'; ";
  57
  58 const char kChromeURLXFrameOptionsHeader[] = "X-Frame-Options: DENY";
  59
  60 const int kNoRenderProcessId = -1;
  61
  62 bool SchemeIsInSchemes(const std::string& scheme,
  63                        const std::vector<std::string>& schemes) {
  64   return std::find(schemes.begin(), schemes.end(), scheme) != schemes.end();
  65 }
  66
  67 // Returns whether |url| passes some sanity checks and is a valid GURL.
  68 bool CheckURLIsValid(const GURL& url) {
  69   std::vector<std::string> additional_schemes;
  70   DCHECK(url.SchemeIs(kChromeDevToolsScheme) || url.SchemeIs(kChromeUIScheme) ||
  71          (GetContentClient()->browser()->GetAdditionalWebUISchemes(
  72               &additional_schemes),
  73           SchemeIsInSchemes(url.scheme(), additional_schemes)));
  74
  75   if (!url.is_valid()) {
  76     NOTREACHED();
  77     return false;
  78   }
  79
  80   return true;
  81 }
  82
  83 // Parse |url| to get the path which will be used to resolve the request. The
  84 // path is the remaining portion after the scheme and hostname.
  85 void URLToRequestPath(const GURL& url, std::string* path) {
  86   const std::string& spec = url.possibly_invalid_spec();
  87   const url::Parsed& parsed = url.parsed_for_possibly_invalid_spec();
  88   // + 1 to skip the slash at the beginning of the path.
  89   int offset = parsed.CountCharactersBefore(url::Parsed::PATH, false) + 1;
  90
  91   if (offset < static_cast<int>(spec.size()))
  92     path->assign(spec.substr(offset));
  93 }
  94
  95 // Returns a value of 'Origin:' header for the |request| if the header is set.
  96 // Otherwise returns an empty string.
  97 std::string GetOriginHeaderValue(const net::URLRequest* request) {
  98   std::string result;
  99   if (request->extra_request_headers().GetHeader(
 100           net::HttpRequestHeaders::kOrigin, &result))
 101     return result;
 102   net::HttpRequestHeaders headers;
 103   if (request->GetFullRequestHeaders(&headers))
 104     headers.GetHeader(net::HttpRequestHeaders::kOrigin, &result);
 105   return result;
 106 }
 107
 108 }  // namespace
 109
 110 // URLRequestChromeJob is a net::URLRequestJob that manages running
 111 // chrome-internal resource requests asynchronously.
 112 // It hands off URL requests to ChromeURLDataManager, which asynchronously
 113 // calls back once the data is available.
 114 class URLRequestChromeJob : public net::URLRequestJob,
 115                             public base::SupportsWeakPtr<URLRequestChromeJob> {
 116  public:
 117   // |is_incognito| set when job is generated from an incognito profile.
 118   URLRequestChromeJob(net::URLRequest* request,
 119                       net::NetworkDelegate* network_delegate,
 120                       URLDataManagerBackend* backend,
 121                       bool is_incognito);
 122
 123   // net::URLRequestJob implementation.
 124   void Start() override;
 125   void Kill() override;
 126   bool ReadRawData(net::IOBuffer* buf, int buf_size, int* bytes_read) override;
 127   bool GetMimeType(std::string* mime_type) const override;
 128   int GetResponseCode() const override;
 129   void GetResponseInfo(net::HttpResponseInfo* info) override;
 130
 131   // Used to notify that the requested data's |mime_type| is ready.
 132   void MimeTypeAvailable(const std::string& mime_type);
 133
 134   // Called by ChromeURLDataManager to notify us that the data blob is ready
 135   // for us.
 136   void DataAvailable(base::RefCountedMemory* bytes);
 137
 138   void set_mime_type(const std::string& mime_type) {
 139     mime_type_ = mime_type;
 140   }
 141
 142   void set_allow_caching(bool allow_caching) {
 143     allow_caching_ = allow_caching;
 144   }
 145
 146   void set_add_content_security_policy(bool add_content_security_policy) {
 147     add_content_security_policy_ = add_content_security_policy;
 148   }
 149
 150   void set_content_security_policy_object_source(
 151       const std::string& data) {
 152     content_security_policy_object_source_ = data;
 153   }
 154
 155   void set_content_security_policy_frame_source(
 156       const std::string& data) {
 157     content_security_policy_frame_source_ = data;
 158   }
 159
 160   void set_deny_xframe_options(bool deny_xframe_options) {
 161     deny_xframe_options_ = deny_xframe_options;
 162   }
 163
 164   void set_send_content_type_header(bool send_content_type_header) {
 165     send_content_type_header_ = send_content_type_header;
 166   }
 167
 168   void set_access_control_allow_origin(const std::string& value) {
 169     access_control_allow_origin_ = value;
 170   }
 171
 172   // Returns true when job was generated from an incognito profile.
 173   bool is_incognito() const {
 174     return is_incognito_;
 175   }
 176
 177  private:
 178   ~URLRequestChromeJob() override;
 179
 180   // Helper for Start(), to let us start asynchronously.
 181   // (This pattern is shared by most net::URLRequestJob implementations.)
 182   void StartAsync(bool allowed);
 183
 184   // Called on the UI thread to check if this request is allowed.
 185   static void CheckStoragePartitionMatches(
 186       int render_process_id,
 187       const GURL& url,
 188       const base::WeakPtr<URLRequestChromeJob>& job);
 189
 190   // Do the actual copy from data_ (the data we're serving) into |buf|.
 191   // Separate from ReadRawData so we can handle async I/O.
 192   void CompleteRead(net::IOBuffer* buf, int buf_size, int* bytes_read);
 193
 194   // The actual data we're serving.  NULL until it's been fetched.
 195   scoped_refptr<base::RefCountedMemory> data_;
 196   // The current offset into the data that we're handing off to our
 197   // callers via the Read interfaces.
 198   int data_offset_;
 199
 200   // For async reads, we keep around a pointer to the buffer that
 201   // we're reading into.
 202   scoped_refptr<net::IOBuffer> pending_buf_;
 203   int pending_buf_size_;
 204   std::string mime_type_;
 205
 206   // If true, set a header in the response to prevent it from being cached.
 207   bool allow_caching_;
 208
 209   // If true, set the Content Security Policy (CSP) header.
 210   bool add_content_security_policy_;
 211
 212   // These are used with the CSP.
 213   std::string content_security_policy_object_source_;
 214   std::string content_security_policy_frame_source_;
 215
 216   // If true, sets  the "X-Frame-Options: DENY" header.
 217   bool deny_xframe_options_;
 218
 219   // If true, sets the "Content-Type: <mime-type>" header.
 220   bool send_content_type_header_;
 221
 222   // If not empty, "Access-Control-Allow-Origin:" is set to the value of this
 223   // string.
 224   std::string access_control_allow_origin_;
 225
 226   // True when job is generated from an incognito profile.
 227   const bool is_incognito_;
 228
 229   // The backend is owned by net::URLRequestContext and always outlives us.
 230   URLDataManagerBackend* backend_;
 231
 232   base::WeakPtrFactory<URLRequestChromeJob> weak_factory_;
 233
 234   DISALLOW_COPY_AND_ASSIGN(URLRequestChromeJob);
 235 };
 236
 237 URLRequestChromeJob::URLRequestChromeJob(net::URLRequest* request,
 238                                          net::NetworkDelegate* network_delegate,
 239                                          URLDataManagerBackend* backend,
 240                                          bool is_incognito)
 241     : net::URLRequestJob(request, network_delegate),
 242       data_offset_(0),
 243       pending_buf_size_(0),
 244       allow_caching_(true),
 245       add_content_security_policy_(true),
 246       content_security_policy_object_source_("object-src 'none';"),
 247       content_security_policy_frame_source_("frame-src 'none';"),
 248       deny_xframe_options_(true),
 249       send_content_type_header_(false),
 250       is_incognito_(is_incognito),
 251       backend_(backend),
 252       weak_factory_(this) {
 253   DCHECK(backend);
 254 }
 255
 256 URLRequestChromeJob::~URLRequestChromeJob() {
 257   CHECK(!backend_->HasPendingJob(this));
 258 }
 259
 260 void URLRequestChromeJob::Start() {
 261   int render_process_id, unused;
 262   bool is_renderer_request = ResourceRequestInfo::GetRenderFrameForRequest(
 263       request_, &render_process_id, &unused);
 264   if (!is_renderer_request)
 265     render_process_id = kNoRenderProcessId;
 266   BrowserThread::PostTask(
 267       BrowserThread::UI,
 268       FROM_HERE,
 269       base::Bind(&URLRequestChromeJob::CheckStoragePartitionMatches,
 270                  render_process_id, request_->url(), AsWeakPtr()));
 271   TRACE_EVENT_ASYNC_BEGIN1("browser", "DataManager:Request", this, "URL",
 272       request_->url().possibly_invalid_spec());
 273 }
 274
 275 void URLRequestChromeJob::Kill() {
 276   backend_->RemoveRequest(this);
 277 }
 278
 279 bool URLRequestChromeJob::GetMimeType(std::string* mime_type) const {
 280   *mime_type = mime_type_;
 281   return !mime_type_.empty();
 282 }
 283
 284 int URLRequestChromeJob::GetResponseCode() const {
 285   return net::HTTP_OK;
 286 }
 287
 288 void URLRequestChromeJob::GetResponseInfo(net::HttpResponseInfo* info) {
 289   DCHECK(!info->headers.get());
 290   // Set the headers so that requests serviced by ChromeURLDataManager return a
 291   // status code of 200. Without this they return a 0, which makes the status
 292   // indistiguishable from other error types. Instant relies on getting a 200.
 293   info->headers = new net::HttpResponseHeaders("HTTP/1.1 200 OK");
 294
 295   // Determine the least-privileged content security policy header, if any,
 296   // that is compatible with a given WebUI URL, and append it to the existing
 297   // response headers.
 298   if (add_content_security_policy_) {
 299     std::string base = kChromeURLContentSecurityPolicyHeaderBase;
 300     base.append(content_security_policy_object_source_);
 301     base.append(content_security_policy_frame_source_);
 302     info->headers->AddHeader(base);
 303   }
 304
 305   if (deny_xframe_options_)
 306     info->headers->AddHeader(kChromeURLXFrameOptionsHeader);
 307
 308   if (!allow_caching_)
 309     info->headers->AddHeader("Cache-Control: no-cache");
 310
 311   if (send_content_type_header_ && !mime_type_.empty()) {
 312     std::string content_type =
 313         base::StringPrintf("%s:%s", net::HttpRequestHeaders::kContentType,
 314                            mime_type_.c_str());
 315     info->headers->AddHeader(content_type);
 316   }
 317
 318   if (!access_control_allow_origin_.empty()) {
 319     info->headers->AddHeader("Access-Control-Allow-Origin: " +
 320                              access_control_allow_origin_);
 321     info->headers->AddHeader("Vary: Origin");
 322   }
 323 }
 324
 325 void URLRequestChromeJob::MimeTypeAvailable(const std::string& mime_type) {
 326   set_mime_type(mime_type);
 327   NotifyHeadersComplete();
 328 }
 329
 330 void URLRequestChromeJob::DataAvailable(base::RefCountedMemory* bytes) {
 331   TRACE_EVENT_ASYNC_END0("browser", "DataManager:Request", this);
 332   if (bytes) {
 333     // The request completed, and we have all the data.
 334     // Clear any IO pending status.
 335     SetStatus(net::URLRequestStatus());
 336
 337     data_ = bytes;
 338     int bytes_read;
 339     if (pending_buf_.get()) {
 340       CHECK(pending_buf_->data());
 341       CompleteRead(pending_buf_.get(), pending_buf_size_, &bytes_read);
 342       pending_buf_ = NULL;
 343       NotifyReadComplete(bytes_read);
 344     }
 345   } else {
 346     // The request failed.
 347     NotifyDone(net::URLRequestStatus(net::URLRequestStatus::FAILED,
 348                                      net::ERR_FAILED));
 349   }
 350 }
 351
 352 bool URLRequestChromeJob::ReadRawData(net::IOBuffer* buf, int buf_size,
 353                                       int* bytes_read) {
 354   if (!data_.get()) {
 355     SetStatus(net::URLRequestStatus(net::URLRequestStatus::IO_PENDING, 0));
 356     DCHECK(!pending_buf_.get());
 357     CHECK(buf->data());
 358     pending_buf_ = buf;
 359     pending_buf_size_ = buf_size;
 360     return false;  // Tell the caller we're still waiting for data.
 361   }
 362
 363   // Otherwise, the data is available.
 364   CompleteRead(buf, buf_size, bytes_read);
 365   return true;
 366 }
 367
 368 void URLRequestChromeJob::CompleteRead(net::IOBuffer* buf, int buf_size,
 369                                        int* bytes_read) {
 370   int remaining = static_cast<int>(data_->size()) - data_offset_;
 371   if (buf_size > remaining)
 372     buf_size = remaining;
 373   if (buf_size > 0) {
 374     // TODO(pkasting): Remove ScopedTracker below once crbug.com/455423 is
 375     // fixed.
 376     tracked_objects::ScopedTracker tracking_profile(
 377         FROM_HERE_WITH_EXPLICIT_FUNCTION(
 378             "455423 URLRequestChromeJob::CompleteRead memcpy"));
 379     memcpy(buf->data(), data_->front() + data_offset_, buf_size);
 380     data_offset_ += buf_size;
 381   }
 382   *bytes_read = buf_size;
 383 }
 384
 385 void URLRequestChromeJob::CheckStoragePartitionMatches(
 386     int render_process_id,
 387     const GURL& url,
 388     const base::WeakPtr<URLRequestChromeJob>& job) {
 389   // The embedder could put some webui pages in separate storage partition.
 390   // RenderProcessHostImpl::IsSuitableHost would guard against top level pages
 391   // being in the same process. We do an extra check to guard against an
 392   // exploited renderer pretending to add them as a subframe. We skip this check
 393   // for resources.
 394   bool allowed = false;
 395   std::vector<std::string> hosts;
 396   GetContentClient()->
 397       browser()->GetAdditionalWebUIHostsToIgnoreParititionCheck(&hosts);
 398   if (url.SchemeIs(kChromeUIScheme) &&
 399       (url.SchemeIs(kChromeUIScheme) ||
 400        std::find(hosts.begin(), hosts.end(), url.host()) != hosts.end())) {
 401     allowed = true;
 402   } else if (render_process_id == kNoRenderProcessId) {
 403     // Request was not issued by renderer.
 404     allowed = true;
 405   } else {
 406     RenderProcessHost* process = RenderProcessHost::FromID(render_process_id);
 407     if (process) {
 408       StoragePartition* partition = BrowserContext::GetStoragePartitionForSite(
 409           process->GetBrowserContext(), url);
 410       allowed = partition == process->GetStoragePartition();
 411     }
 412   }
 413
 414   BrowserThread::PostTask(
 415       BrowserThread::IO,
 416       FROM_HERE,
 417       base::Bind(&URLRequestChromeJob::StartAsync, job, allowed));
 418 }
 419
 420 void URLRequestChromeJob::StartAsync(bool allowed) {
 421   if (!request_)
 422     return;
 423
 424   if (!allowed || !backend_->StartRequest(request_, this)) {
 425     NotifyStartError(net::URLRequestStatus(net::URLRequestStatus::FAILED,
 426                                            net::ERR_INVALID_URL));
 427   }
 428 }
 429
 430 namespace {
 431
 432 // Gets mime type for data that is available from |source| by |path|.
 433 // After that, notifies |job| that mime type is available. This method
 434 // should be called on the UI thread, but notification is performed on
 435 // the IO thread.
 436 void GetMimeTypeOnUI(URLDataSourceImpl* source,
 437                      const std::string& path,
 438                      const base::WeakPtr<URLRequestChromeJob>& job) {
 439   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 440   std::string mime_type = source->source()->GetMimeType(path);
 441   BrowserThread::PostTask(
 442       BrowserThread::IO, FROM_HERE,
 443       base::Bind(&URLRequestChromeJob::MimeTypeAvailable, job, mime_type));
 444 }
 445
 446 }  // namespace
 447
 448 namespace {
 449
 450 class ChromeProtocolHandler
 451     : public net::URLRequestJobFactory::ProtocolHandler {
 452  public:
 453   // |is_incognito| should be set for incognito profiles.
 454   ChromeProtocolHandler(ResourceContext* resource_context,
 455                         bool is_incognito,
 456                         AppCacheServiceImpl* appcache_service,
 457                         ChromeBlobStorageContext* blob_storage_context)
 458       : resource_context_(resource_context),
 459         is_incognito_(is_incognito),
 460         appcache_service_(appcache_service),
 461         blob_storage_context_(blob_storage_context) {}
 462   ~ChromeProtocolHandler() override {}
 463
 464   net::URLRequestJob* MaybeCreateJob(
 465       net::URLRequest* request,
 466       net::NetworkDelegate* network_delegate) const override {
 467     DCHECK(request);
 468
 469     // Check for chrome://view-http-cache/*, which uses its own job type.
 470     if (ViewHttpCacheJobFactory::IsSupportedURL(request->url()))
 471       return ViewHttpCacheJobFactory::CreateJobForRequest(request,
 472                                                           network_delegate);
 473
 474     // Next check for chrome://appcache-internals/, which uses its own job type.
 475     if (request->url().SchemeIs(kChromeUIScheme) &&
 476         request->url().host() == kChromeUIAppCacheInternalsHost) {
 477       return ViewAppCacheInternalsJobFactory::CreateJobForRequest(
 478           request, network_delegate, appcache_service_);
 479     }
 480
 481     // Next check for chrome://blob-internals/, which uses its own job type.
 482     if (ViewBlobInternalsJobFactory::IsSupportedURL(request->url())) {
 483       return ViewBlobInternalsJobFactory::CreateJobForRequest(
 484           request, network_delegate, blob_storage_context_->context());
 485     }
 486
 487 #if defined(USE_TCMALLOC)
 488     // Next check for chrome://tcmalloc/, which uses its own job type.
 489     if (request->url().SchemeIs(kChromeUIScheme) &&
 490         request->url().host() == kChromeUITcmallocHost) {
 491       return new TcmallocInternalsRequestJob(request, network_delegate);
 492     }
 493 #endif
 494
 495     // Next check for chrome://histograms/, which uses its own job type.
 496     if (request->url().SchemeIs(kChromeUIScheme) &&
 497         request->url().host() == kChromeUIHistogramHost) {
 498       return new HistogramInternalsRequestJob(request, network_delegate);
 499     }
 500
 501     // Fall back to using a custom handler
 502     return new URLRequestChromeJob(
 503         request, network_delegate,
 504         GetURLDataManagerForResourceContext(resource_context_), is_incognito_);
 505   }
 506
 507   bool IsSafeRedirectTarget(const GURL& location) const override {
 508     return false;
 509   }
 510
 511  private:
 512   // These members are owned by ProfileIOData, which owns this ProtocolHandler.
 513   content::ResourceContext* const resource_context_;
 514
 515   // True when generated from an incognito profile.
 516   const bool is_incognito_;
 517   AppCacheServiceImpl* appcache_service_;
 518   ChromeBlobStorageContext* blob_storage_context_;
 519
 520   DISALLOW_COPY_AND_ASSIGN(ChromeProtocolHandler);
 521 };
 522
 523 }  // namespace
 524
 525 URLDataManagerBackend::URLDataManagerBackend()
 526     : next_request_id_(0) {
 527   URLDataSource* shared_source = new SharedResourcesDataSource();
 528   URLDataSourceImpl* source_impl =
 529       new URLDataSourceImpl(shared_source->GetSource(), shared_source);
 530   AddDataSource(source_impl);
 531 }
 532
 533 URLDataManagerBackend::~URLDataManagerBackend() {
 534   for (DataSourceMap::iterator i = data_sources_.begin();
 535        i != data_sources_.end(); ++i) {
 536     i->second->backend_ = NULL;
 537   }
 538   data_sources_.clear();
 539 }
 540
 541 // static
 542 net::URLRequestJobFactory::ProtocolHandler*
 543 URLDataManagerBackend::CreateProtocolHandler(
 544     content::ResourceContext* resource_context,
 545     bool is_incognito,
 546     AppCacheServiceImpl* appcache_service,
 547     ChromeBlobStorageContext* blob_storage_context) {
 548   DCHECK(resource_context);
 549   return new ChromeProtocolHandler(
 550       resource_context, is_incognito, appcache_service, blob_storage_context);
 551 }
 552
 553 void URLDataManagerBackend::AddDataSource(
 554     URLDataSourceImpl* source) {
 555   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 556   DataSourceMap::iterator i = data_sources_.find(source->source_name());
 557   if (i != data_sources_.end()) {
 558     if (!source->source()->ShouldReplaceExistingSource())
 559       return;
 560     i->second->backend_ = NULL;
 561   }
 562   data_sources_[source->source_name()] = source;
 563   source->backend_ = this;
 564 }
 565
 566 bool URLDataManagerBackend::HasPendingJob(
 567     URLRequestChromeJob* job) const {
 568   for (PendingRequestMap::const_iterator i = pending_requests_.begin();
 569        i != pending_requests_.end(); ++i) {
 570     if (i->second == job)
 571       return true;
 572   }
 573   return false;
 574 }
 575
 576 bool URLDataManagerBackend::StartRequest(const net::URLRequest* request,
 577                                          URLRequestChromeJob* job) {
 578   if (!CheckURLIsValid(request->url()))
 579     return false;
 580
 581   URLDataSourceImpl* source = GetDataSourceFromURL(request->url());
 582   if (!source)
 583     return false;
 584
 585   if (!source->source()->ShouldServiceRequest(request))
 586     return false;
 587
 588   std::string path;
 589   URLToRequestPath(request->url(), &path);
 590   source->source()->WillServiceRequest(request, &path);
 591
 592   // Save this request so we know where to send the data.
 593   RequestID request_id = next_request_id_++;
 594   pending_requests_.insert(std::make_pair(request_id, job));
 595
 596   job->set_allow_caching(source->source()->AllowCaching());
 597   job->set_add_content_security_policy(
 598       source->source()->ShouldAddContentSecurityPolicy());
 599   job->set_content_security_policy_object_source(
 600       source->source()->GetContentSecurityPolicyObjectSrc());
 601   job->set_content_security_policy_frame_source(
 602       source->source()->GetContentSecurityPolicyFrameSrc());
 603   job->set_deny_xframe_options(
 604       source->source()->ShouldDenyXFrameOptions());
 605   job->set_send_content_type_header(
 606       source->source()->ShouldServeMimeTypeAsContentTypeHeader());
 607
 608   std::string origin = GetOriginHeaderValue(request);
 609   if (!origin.empty()) {
 610     std::string header =
 611         source->source()->GetAccessControlAllowOriginForOrigin(origin);
 612     DCHECK(header.empty() || header == origin || header == "*" ||
 613            header == "null");
 614     job->set_access_control_allow_origin(header);
 615   }
 616
 617   // Look up additional request info to pass down.
 618   int render_process_id = -1;
 619   int render_frame_id = -1;
 620   ResourceRequestInfo::GetRenderFrameForRequest(request,
 621                                                 &render_process_id,
 622                                                 &render_frame_id);
 623
 624   // Forward along the request to the data source.
 625   base::MessageLoop* target_message_loop =
 626       source->source()->MessageLoopForRequestPath(path);
 627   if (!target_message_loop) {
 628     job->MimeTypeAvailable(source->source()->GetMimeType(path));
 629     // Eliminate potentially dangling pointer to avoid future use.
 630     job = NULL;
 631
 632     // The DataSource is agnostic to which thread StartDataRequest is called
 633     // on for this path.  Call directly into it from this thread, the IO
 634     // thread.
 635     source->source()->StartDataRequest(
 636         path, render_process_id, render_frame_id,
 637         base::Bind(&URLDataSourceImpl::SendResponse, source, request_id));
 638   } else {
 639     // URLRequestChromeJob should receive mime type before data. This
 640     // is guaranteed because request for mime type is placed in the
 641     // message loop before request for data. And correspondingly their
 642     // replies are put on the IO thread in the same order.
 643     target_message_loop->task_runner()->PostTask(
 644         FROM_HERE,
 645         base::Bind(&GetMimeTypeOnUI, scoped_refptr<URLDataSourceImpl>(source),
 646                    path, job->AsWeakPtr()));
 647
 648     // The DataSource wants StartDataRequest to be called on a specific thread,
 649     // usually the UI thread, for this path.
 650     target_message_loop->task_runner()->PostTask(
 651         FROM_HERE, base::Bind(&URLDataManagerBackend::CallStartRequest,
 652                               make_scoped_refptr(source), path,
 653                               render_process_id, render_frame_id, request_id));
 654   }
 655   return true;
 656 }
 657
 658 URLDataSourceImpl* URLDataManagerBackend::GetDataSourceFromURL(
 659     const GURL& url) {
 660   // The input usually looks like: chrome://source_name/extra_bits?foo
 661   // so do a lookup using the host of the URL.
 662   DataSourceMap::iterator i = data_sources_.find(url.host());
 663   if (i != data_sources_.end())
 664     return i->second.get();
 665
 666   // No match using the host of the URL, so do a lookup using the scheme for
 667   // URLs on the form source_name://extra_bits/foo .
 668   i = data_sources_.find(url.scheme() + "://");
 669   if (i != data_sources_.end())
 670     return i->second.get();
 671
 672   // No matches found, so give up.
 673   return NULL;
 674 }
 675
 676 void URLDataManagerBackend::CallStartRequest(
 677     scoped_refptr<URLDataSourceImpl> source,
 678     const std::string& path,
 679     int render_process_id,
 680     int render_frame_id,
 681     int request_id) {
 682   if (BrowserThread::CurrentlyOn(BrowserThread::UI) &&
 683       render_process_id != -1 &&
 684       !RenderProcessHost::FromID(render_process_id)) {
 685     // Make the request fail if its initiating renderer is no longer valid.
 686     // This can happen when the IO thread posts this task just before the
 687     // renderer shuts down.
 688     source->SendResponse(request_id, NULL);
 689     return;
 690   }
 691   source->source()->StartDataRequest(
 692       path,
 693       render_process_id,
 694       render_frame_id,
 695       base::Bind(&URLDataSourceImpl::SendResponse, source, request_id));
 696 }
 697
 698 void URLDataManagerBackend::RemoveRequest(URLRequestChromeJob* job) {
 699   // Remove the request from our list of pending requests.
 700   // If/when the source sends the data that was requested, the data will just
 701   // be thrown away.
 702   for (PendingRequestMap::iterator i = pending_requests_.begin();
 703        i != pending_requests_.end(); ++i) {
 704     if (i->second == job) {
 705       pending_requests_.erase(i);
 706       return;
 707     }
 708   }
 709 }
 710
 711 void URLDataManagerBackend::DataAvailable(RequestID request_id,
 712                                           base::RefCountedMemory* bytes) {
 713   // Forward this data on to the pending net::URLRequest, if it exists.
 714   PendingRequestMap::iterator i = pending_requests_.find(request_id);
 715   if (i != pending_requests_.end()) {
 716     URLRequestChromeJob* job = i->second;
 717     pending_requests_.erase(i);
 718     job->DataAvailable(bytes);
 719   }
 720 }
 721
 722 namespace {
 723
 724 class DevToolsJobFactory
 725     : public net::URLRequestJobFactory::ProtocolHandler {
 726  public:
 727   // |is_incognito| should be set for incognito profiles.
 728   DevToolsJobFactory(content::ResourceContext* resource_context,
 729                      bool is_incognito);
 730   ~DevToolsJobFactory() override;
 731
 732   net::URLRequestJob* MaybeCreateJob(
 733       net::URLRequest* request,
 734       net::NetworkDelegate* network_delegate) const override;
 735
 736  private:
 737   // |resource_context_| and |network_delegate_| are owned by ProfileIOData,
 738   // which owns this ProtocolHandler.
 739   content::ResourceContext* const resource_context_;
 740
 741   // True when generated from an incognito profile.
 742   const bool is_incognito_;
 743
 744   DISALLOW_COPY_AND_ASSIGN(DevToolsJobFactory);
 745 };
 746
 747 DevToolsJobFactory::DevToolsJobFactory(
 748     content::ResourceContext* resource_context,
 749     bool is_incognito)
 750     : resource_context_(resource_context),
 751       is_incognito_(is_incognito) {
 752   DCHECK(resource_context_);
 753 }
 754
 755 DevToolsJobFactory::~DevToolsJobFactory() {}
 756
 757 net::URLRequestJob*
 758 DevToolsJobFactory::MaybeCreateJob(
 759     net::URLRequest* request, net::NetworkDelegate* network_delegate) const {
 760   return new URLRequestChromeJob(
 761       request, network_delegate,
 762       GetURLDataManagerForResourceContext(resource_context_), is_incognito_);
 763 }
 764
 765 }  // namespace
 766
 767 net::URLRequestJobFactory::ProtocolHandler*
 768 CreateDevToolsProtocolHandler(content::ResourceContext* resource_context,
 769                               bool is_incognito) {
 770   return new DevToolsJobFactory(resource_context, is_incognito);
 771 }
 772
 773 }  // namespace content