content/browser/webui/url_data_manager_backend.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "content/browser/webui/url_data_manager_backend.h"
   6
   7 #include <set>
   8
   9 #include "base/basictypes.h"
  10 #include "base/bind.h"
  11 #include "base/command_line.h"
  12 #include "base/compiler_specific.h"
  13 #include "base/debug/alias.h"
  14 #include "base/lazy_instance.h"
  15 #include "base/location.h"
  16 #include "base/memory/ref_counted.h"
  17 #include "base/memory/ref_counted_memory.h"
  18 #include "base/memory/weak_ptr.h"
  19 #include "base/profiler/scoped_tracker.h"
  20 #include "base/single_thread_task_runner.h"
  21 #include "base/strings/string_util.h"
  22 #include "base/strings/stringprintf.h"
  23 #include "base/trace_event/trace_event.h"
  24 #include "content/browser/appcache/view_appcache_internals_job.h"
  25 #include "content/browser/fileapi/chrome_blob_storage_context.h"
  26 #include "content/browser/histogram_internals_request_job.h"
  27 #include "content/browser/net/view_blob_internals_job_factory.h"
  28 #include "content/browser/net/view_http_cache_job_factory.h"
  29 #include "content/browser/resource_context_impl.h"
  30 #include "content/browser/tcmalloc_internals_request_job.h"
  31 #include "content/browser/webui/shared_resources_data_source.h"
  32 #include "content/browser/webui/url_data_source_impl.h"
  33 #include "content/public/browser/browser_context.h"
  34 #include "content/public/browser/browser_thread.h"
  35 #include "content/public/browser/content_browser_client.h"
  36 #include "content/public/browser/render_process_host.h"
  37 #include "content/public/browser/resource_request_info.h"
  38 #include "content/public/common/url_constants.h"
  39 #include "net/base/io_buffer.h"
  40 #include "net/base/net_errors.h"
  41 #include "net/http/http_response_headers.h"
  42 #include "net/http/http_status_code.h"
  43 #include "net/url_request/url_request.h"
  44 #include "net/url_request/url_request_context.h"
  45 #include "net/url_request/url_request_job.h"
  46 #include "net/url_request/url_request_job_factory.h"
  47 #include "url/url_util.h"
  48
  49 namespace content {
  50
  51 namespace {
  52
  53 // TODO(tsepez) remove unsafe-eval when bidichecker_packaged.js fixed.
  54 const char kChromeURLContentSecurityPolicyHeaderBase[] =
  55     "Content-Security-Policy: script-src chrome://resources "
  56     "'self' 'unsafe-eval'; ";
  57
  58 const char kChromeURLXFrameOptionsHeader[] = "X-Frame-Options: DENY";
  59
  60 const int kNoRenderProcessId = -1;
  61
  62 bool SchemeIsInSchemes(const std::string& scheme,
  63                        const std::vector<std::string>& schemes) {
  64   return std::find(schemes.begin(), schemes.end(), scheme) != schemes.end();
  65 }
  66
  67 // Returns whether |url| passes some sanity checks and is a valid GURL.
  68 bool CheckURLIsValid(const GURL& url) {
  69   std::vector<std::string> additional_schemes;
  70   DCHECK(url.SchemeIs(kChromeDevToolsScheme) || url.SchemeIs(kChromeUIScheme) ||
  71          (GetContentClient()->browser()->GetAdditionalWebUISchemes(
  72               &additional_schemes),
  73           SchemeIsInSchemes(url.scheme(), additional_schemes)));
  74
  75   if (!url.is_valid()) {
  76     NOTREACHED();
  77     return false;
  78   }
  79
  80   return true;
  81 }
  82
  83 // Parse |url| to get the path which will be used to resolve the request. The
  84 // path is the remaining portion after the scheme and hostname.
  85 void URLToRequestPath(const GURL& url, std::string* path) {
  86   const std::string& spec = url.possibly_invalid_spec();
  87   const url::Parsed& parsed = url.parsed_for_possibly_invalid_spec();
  88   // + 1 to skip the slash at the beginning of the path.
  89   int offset = parsed.CountCharactersBefore(url::Parsed::PATH, false) + 1;
  90
  91   if (offset < static_cast<int>(spec.size()))
  92     path->assign(spec.substr(offset));
  93 }
  94
  95 // Returns a value of 'Origin:' header for the |request| if the header is set.
  96 // Otherwise returns an empty string.
  97 std::string GetOriginHeaderValue(const net::URLRequest* request) {
  98   std::string result;
  99   if (request->extra_request_headers().GetHeader(
 100           net::HttpRequestHeaders::kOrigin, &result))
 101     return result;
 102   net::HttpRequestHeaders headers;
 103   if (request->GetFullRequestHeaders(&headers))
 104     headers.GetHeader(net::HttpRequestHeaders::kOrigin, &result);
 105   return result;
 106 }
 107
 108 }  // namespace
 109
 110 // URLRequestChromeJob is a net::URLRequestJob that manages running
 111 // chrome-internal resource requests asynchronously.
 112 // It hands off URL requests to ChromeURLDataManager, which asynchronously
 113 // calls back once the data is available.
 114 class URLRequestChromeJob : public net::URLRequestJob {
 115  public:
 116   // |is_incognito| set when job is generated from an incognito profile.
 117   URLRequestChromeJob(net::URLRequest* request,
 118                       net::NetworkDelegate* network_delegate,
 119                       URLDataManagerBackend* backend,
 120                       bool is_incognito);
 121
 122   // net::URLRequestJob implementation.
 123   void Start() override;
 124   void Kill() override;
 125   bool ReadRawData(net::IOBuffer* buf, int buf_size, int* bytes_read) override;
 126   bool GetMimeType(std::string* mime_type) const override;
 127   int GetResponseCode() const override;
 128   void GetResponseInfo(net::HttpResponseInfo* info) override;
 129
 130   // Used to notify that the requested data's |mime_type| is ready.
 131   void MimeTypeAvailable(const std::string& mime_type);
 132
 133   // Called by ChromeURLDataManager to notify us that the data blob is ready
 134   // for us.
 135   void DataAvailable(base::RefCountedMemory* bytes);
 136
 137   // Returns a weak pointer to the job.
 138   base::WeakPtr<URLRequestChromeJob> AsWeakPtr();
 139
 140   void set_mime_type(const std::string& mime_type) {
 141     mime_type_ = mime_type;
 142   }
 143
 144   void set_allow_caching(bool allow_caching) {
 145     allow_caching_ = allow_caching;
 146   }
 147
 148   void set_add_content_security_policy(bool add_content_security_policy) {
 149     add_content_security_policy_ = add_content_security_policy;
 150   }
 151
 152   void set_content_security_policy_object_source(
 153       const std::string& data) {
 154     content_security_policy_object_source_ = data;
 155   }
 156
 157   void set_content_security_policy_frame_source(
 158       const std::string& data) {
 159     content_security_policy_frame_source_ = data;
 160   }
 161
 162   void set_deny_xframe_options(bool deny_xframe_options) {
 163     deny_xframe_options_ = deny_xframe_options;
 164   }
 165
 166   void set_send_content_type_header(bool send_content_type_header) {
 167     send_content_type_header_ = send_content_type_header;
 168   }
 169
 170   void set_access_control_allow_origin(const std::string& value) {
 171     access_control_allow_origin_ = value;
 172   }
 173
 174   // Returns true when job was generated from an incognito profile.
 175   bool is_incognito() const {
 176     return is_incognito_;
 177   }
 178
 179  private:
 180   ~URLRequestChromeJob() override;
 181
 182   // Helper for Start(), to let us start asynchronously.
 183   // (This pattern is shared by most net::URLRequestJob implementations.)
 184   void StartAsync(bool allowed);
 185
 186   // Called on the UI thread to check if this request is allowed.
 187   static void CheckStoragePartitionMatches(
 188       int render_process_id,
 189       const GURL& url,
 190       const base::WeakPtr<URLRequestChromeJob>& job);
 191
 192   // Do the actual copy from data_ (the data we're serving) into |buf|.
 193   // Separate from ReadRawData so we can handle async I/O.
 194   void CompleteRead(net::IOBuffer* buf, int buf_size, int* bytes_read);
 195
 196   // The actual data we're serving.  NULL until it's been fetched.
 197   scoped_refptr<base::RefCountedMemory> data_;
 198   // The current offset into the data that we're handing off to our
 199   // callers via the Read interfaces.
 200   int data_offset_;
 201
 202   // For async reads, we keep around a pointer to the buffer that
 203   // we're reading into.
 204   scoped_refptr<net::IOBuffer> pending_buf_;
 205   int pending_buf_size_;
 206   std::string mime_type_;
 207
 208   // If true, set a header in the response to prevent it from being cached.
 209   bool allow_caching_;
 210
 211   // If true, set the Content Security Policy (CSP) header.
 212   bool add_content_security_policy_;
 213
 214   // These are used with the CSP.
 215   std::string content_security_policy_object_source_;
 216   std::string content_security_policy_frame_source_;
 217
 218   // If true, sets  the "X-Frame-Options: DENY" header.
 219   bool deny_xframe_options_;
 220
 221   // If true, sets the "Content-Type: <mime-type>" header.
 222   bool send_content_type_header_;
 223
 224   // If not empty, "Access-Control-Allow-Origin:" is set to the value of this
 225   // string.
 226   std::string access_control_allow_origin_;
 227
 228   // True when job is generated from an incognito profile.
 229   const bool is_incognito_;
 230
 231   // The backend is owned by net::URLRequestContext and always outlives us.
 232   URLDataManagerBackend* backend_;
 233
 234   base::WeakPtrFactory<URLRequestChromeJob> weak_factory_;
 235
 236   DISALLOW_COPY_AND_ASSIGN(URLRequestChromeJob);
 237 };
 238
 239 URLRequestChromeJob::URLRequestChromeJob(net::URLRequest* request,
 240                                          net::NetworkDelegate* network_delegate,
 241                                          URLDataManagerBackend* backend,
 242                                          bool is_incognito)
 243     : net::URLRequestJob(request, network_delegate),
 244       data_offset_(0),
 245       pending_buf_size_(0),
 246       allow_caching_(true),
 247       add_content_security_policy_(true),
 248       content_security_policy_object_source_("object-src 'none';"),
 249       content_security_policy_frame_source_("frame-src 'none';"),
 250       deny_xframe_options_(true),
 251       send_content_type_header_(false),
 252       is_incognito_(is_incognito),
 253       backend_(backend),
 254       weak_factory_(this) {
 255   DCHECK(backend);
 256 }
 257
 258 URLRequestChromeJob::~URLRequestChromeJob() {
 259   CHECK(!backend_->HasPendingJob(this));
 260 }
 261
 262 void URLRequestChromeJob::Start() {
 263   int render_process_id, unused;
 264   bool is_renderer_request = ResourceRequestInfo::GetRenderFrameForRequest(
 265       request_, &render_process_id, &unused);
 266   if (!is_renderer_request)
 267     render_process_id = kNoRenderProcessId;
 268   BrowserThread::PostTask(
 269       BrowserThread::UI,
 270       FROM_HERE,
 271       base::Bind(&URLRequestChromeJob::CheckStoragePartitionMatches,
 272                  render_process_id, request_->url(),
 273                  weak_factory_.GetWeakPtr()));
 274   TRACE_EVENT_ASYNC_BEGIN1("browser", "DataManager:Request", this, "URL",
 275       request_->url().possibly_invalid_spec());
 276 }
 277
 278 void URLRequestChromeJob::Kill() {
 279   weak_factory_.InvalidateWeakPtrs();
 280   backend_->RemoveRequest(this);
 281   URLRequestJob::Kill();
 282 }
 283
 284 bool URLRequestChromeJob::GetMimeType(std::string* mime_type) const {
 285   *mime_type = mime_type_;
 286   return !mime_type_.empty();
 287 }
 288
 289 int URLRequestChromeJob::GetResponseCode() const {
 290   return net::HTTP_OK;
 291 }
 292
 293 void URLRequestChromeJob::GetResponseInfo(net::HttpResponseInfo* info) {
 294   DCHECK(!info->headers.get());
 295   // Set the headers so that requests serviced by ChromeURLDataManager return a
 296   // status code of 200. Without this they return a 0, which makes the status
 297   // indistiguishable from other error types. Instant relies on getting a 200.
 298   info->headers = new net::HttpResponseHeaders("HTTP/1.1 200 OK");
 299
 300   // Determine the least-privileged content security policy header, if any,
 301   // that is compatible with a given WebUI URL, and append it to the existing
 302   // response headers.
 303   if (add_content_security_policy_) {
 304     std::string base = kChromeURLContentSecurityPolicyHeaderBase;
 305     base.append(content_security_policy_object_source_);
 306     base.append(content_security_policy_frame_source_);
 307     info->headers->AddHeader(base);
 308   }
 309
 310   if (deny_xframe_options_)
 311     info->headers->AddHeader(kChromeURLXFrameOptionsHeader);
 312
 313   if (!allow_caching_)
 314     info->headers->AddHeader("Cache-Control: no-cache");
 315
 316   if (send_content_type_header_ && !mime_type_.empty()) {
 317     std::string content_type =
 318         base::StringPrintf("%s:%s", net::HttpRequestHeaders::kContentType,
 319                            mime_type_.c_str());
 320     info->headers->AddHeader(content_type);
 321   }
 322
 323   if (!access_control_allow_origin_.empty()) {
 324     info->headers->AddHeader("Access-Control-Allow-Origin: " +
 325                              access_control_allow_origin_);
 326     info->headers->AddHeader("Vary: Origin");
 327   }
 328 }
 329
 330 void URLRequestChromeJob::MimeTypeAvailable(const std::string& mime_type) {
 331   set_mime_type(mime_type);
 332   NotifyHeadersComplete();
 333 }
 334
 335 void URLRequestChromeJob::DataAvailable(base::RefCountedMemory* bytes) {
 336   TRACE_EVENT_ASYNC_END0("browser", "DataManager:Request", this);
 337   if (bytes) {
 338     // The request completed, and we have all the data.
 339     // Clear any IO pending status.
 340     SetStatus(net::URLRequestStatus());
 341
 342     data_ = bytes;
 343     int bytes_read;
 344     if (pending_buf_.get()) {
 345       CHECK(pending_buf_->data());
 346       CompleteRead(pending_buf_.get(), pending_buf_size_, &bytes_read);
 347       pending_buf_ = NULL;
 348       NotifyReadComplete(bytes_read);
 349     }
 350   } else {
 351     // The request failed.
 352     NotifyDone(net::URLRequestStatus(net::URLRequestStatus::FAILED,
 353                                      net::ERR_FAILED));
 354   }
 355 }
 356
 357 base::WeakPtr<URLRequestChromeJob> URLRequestChromeJob::AsWeakPtr() {
 358   return weak_factory_.GetWeakPtr();
 359 }
 360
 361 bool URLRequestChromeJob::ReadRawData(net::IOBuffer* buf, int buf_size,
 362                                       int* bytes_read) {
 363   if (!data_.get()) {
 364     SetStatus(net::URLRequestStatus(net::URLRequestStatus::IO_PENDING, 0));
 365     DCHECK(!pending_buf_.get());
 366     CHECK(buf->data());
 367     pending_buf_ = buf;
 368     pending_buf_size_ = buf_size;
 369     return false;  // Tell the caller we're still waiting for data.
 370   }
 371
 372   // Otherwise, the data is available.
 373   CompleteRead(buf, buf_size, bytes_read);
 374   return true;
 375 }
 376
 377 void URLRequestChromeJob::CompleteRead(net::IOBuffer* buf, int buf_size,
 378                                        int* bytes_read) {
 379   int remaining = static_cast<int>(data_->size()) - data_offset_;
 380   if (buf_size > remaining)
 381     buf_size = remaining;
 382   if (buf_size > 0) {
 383     // TODO(pkasting): Remove ScopedTracker below once crbug.com/455423 is
 384     // fixed.
 385     tracked_objects::ScopedTracker tracking_profile(
 386         FROM_HERE_WITH_EXPLICIT_FUNCTION(
 387             "455423 URLRequestChromeJob::CompleteRead memcpy"));
 388     memcpy(buf->data(), data_->front() + data_offset_, buf_size);
 389     data_offset_ += buf_size;
 390   }
 391   *bytes_read = buf_size;
 392 }
 393
 394 void URLRequestChromeJob::CheckStoragePartitionMatches(
 395     int render_process_id,
 396     const GURL& url,
 397     const base::WeakPtr<URLRequestChromeJob>& job) {
 398   // The embedder could put some webui pages in separate storage partition.
 399   // RenderProcessHostImpl::IsSuitableHost would guard against top level pages
 400   // being in the same process. We do an extra check to guard against an
 401   // exploited renderer pretending to add them as a subframe. We skip this check
 402   // for resources.
 403   bool allowed = false;
 404   std::vector<std::string> hosts;
 405   GetContentClient()->
 406       browser()->GetAdditionalWebUIHostsToIgnoreParititionCheck(&hosts);
 407   if (url.SchemeIs(kChromeUIScheme) &&
 408       (url.SchemeIs(kChromeUIScheme) ||
 409        std::find(hosts.begin(), hosts.end(), url.host()) != hosts.end())) {
 410     allowed = true;
 411   } else if (render_process_id == kNoRenderProcessId) {
 412     // Request was not issued by renderer.
 413     allowed = true;
 414   } else {
 415     RenderProcessHost* process = RenderProcessHost::FromID(render_process_id);
 416     if (process) {
 417       StoragePartition* partition = BrowserContext::GetStoragePartitionForSite(
 418           process->GetBrowserContext(), url);
 419       allowed = partition == process->GetStoragePartition();
 420     }
 421   }
 422
 423   BrowserThread::PostTask(
 424       BrowserThread::IO,
 425       FROM_HERE,
 426       base::Bind(&URLRequestChromeJob::StartAsync, job, allowed));
 427 }
 428
 429 void URLRequestChromeJob::StartAsync(bool allowed) {
 430   if (!request_)
 431     return;
 432
 433   if (!allowed || !backend_->StartRequest(request_, this)) {
 434     NotifyStartError(net::URLRequestStatus(net::URLRequestStatus::FAILED,
 435                                            net::ERR_INVALID_URL));
 436   }
 437 }
 438
 439 namespace {
 440
 441 // Gets mime type for data that is available from |source| by |path|.
 442 // After that, notifies |job| that mime type is available. This method
 443 // should be called on the UI thread, but notification is performed on
 444 // the IO thread.
 445 void GetMimeTypeOnUI(URLDataSourceImpl* source,
 446                      const std::string& path,
 447                      const base::WeakPtr<URLRequestChromeJob>& job) {
 448   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 449   std::string mime_type = source->source()->GetMimeType(path);
 450   BrowserThread::PostTask(
 451       BrowserThread::IO, FROM_HERE,
 452       base::Bind(&URLRequestChromeJob::MimeTypeAvailable, job, mime_type));
 453 }
 454
 455 }  // namespace
 456
 457 namespace {
 458
 459 class ChromeProtocolHandler
 460     : public net::URLRequestJobFactory::ProtocolHandler {
 461  public:
 462   // |is_incognito| should be set for incognito profiles.
 463   ChromeProtocolHandler(ResourceContext* resource_context,
 464                         bool is_incognito,
 465                         AppCacheServiceImpl* appcache_service,
 466                         ChromeBlobStorageContext* blob_storage_context)
 467       : resource_context_(resource_context),
 468         is_incognito_(is_incognito),
 469         appcache_service_(appcache_service),
 470         blob_storage_context_(blob_storage_context) {}
 471   ~ChromeProtocolHandler() override {}
 472
 473   net::URLRequestJob* MaybeCreateJob(
 474       net::URLRequest* request,
 475       net::NetworkDelegate* network_delegate) const override {
 476     DCHECK(request);
 477
 478     // Check for chrome://view-http-cache/*, which uses its own job type.
 479     if (ViewHttpCacheJobFactory::IsSupportedURL(request->url()))
 480       return ViewHttpCacheJobFactory::CreateJobForRequest(request,
 481                                                           network_delegate);
 482
 483     // Next check for chrome://appcache-internals/, which uses its own job type.
 484     if (request->url().SchemeIs(kChromeUIScheme) &&
 485         request->url().host() == kChromeUIAppCacheInternalsHost) {
 486       return ViewAppCacheInternalsJobFactory::CreateJobForRequest(
 487           request, network_delegate, appcache_service_);
 488     }
 489
 490     // Next check for chrome://blob-internals/, which uses its own job type.
 491     if (ViewBlobInternalsJobFactory::IsSupportedURL(request->url())) {
 492       return ViewBlobInternalsJobFactory::CreateJobForRequest(
 493           request, network_delegate, blob_storage_context_->context());
 494     }
 495
 496 #if defined(USE_TCMALLOC)
 497     // Next check for chrome://tcmalloc/, which uses its own job type.
 498     if (request->url().SchemeIs(kChromeUIScheme) &&
 499         request->url().host() == kChromeUITcmallocHost) {
 500       return new TcmallocInternalsRequestJob(request, network_delegate);
 501     }
 502 #endif
 503
 504     // Next check for chrome://histograms/, which uses its own job type.
 505     if (request->url().SchemeIs(kChromeUIScheme) &&
 506         request->url().host() == kChromeUIHistogramHost) {
 507       return new HistogramInternalsRequestJob(request, network_delegate);
 508     }
 509
 510     // Fall back to using a custom handler
 511     return new URLRequestChromeJob(
 512         request, network_delegate,
 513         GetURLDataManagerForResourceContext(resource_context_), is_incognito_);
 514   }
 515
 516   bool IsSafeRedirectTarget(const GURL& location) const override {
 517     return false;
 518   }
 519
 520  private:
 521   // These members are owned by ProfileIOData, which owns this ProtocolHandler.
 522   content::ResourceContext* const resource_context_;
 523
 524   // True when generated from an incognito profile.
 525   const bool is_incognito_;
 526   AppCacheServiceImpl* appcache_service_;
 527   ChromeBlobStorageContext* blob_storage_context_;
 528
 529   DISALLOW_COPY_AND_ASSIGN(ChromeProtocolHandler);
 530 };
 531
 532 }  // namespace
 533
 534 URLDataManagerBackend::URLDataManagerBackend()
 535     : next_request_id_(0) {
 536   URLDataSource* shared_source = new SharedResourcesDataSource();
 537   URLDataSourceImpl* source_impl =
 538       new URLDataSourceImpl(shared_source->GetSource(), shared_source);
 539   AddDataSource(source_impl);
 540 }
 541
 542 URLDataManagerBackend::~URLDataManagerBackend() {
 543   for (DataSourceMap::iterator i = data_sources_.begin();
 544        i != data_sources_.end(); ++i) {
 545     i->second->backend_ = NULL;
 546   }
 547   data_sources_.clear();
 548 }
 549
 550 // static
 551 net::URLRequestJobFactory::ProtocolHandler*
 552 URLDataManagerBackend::CreateProtocolHandler(
 553     content::ResourceContext* resource_context,
 554     bool is_incognito,
 555     AppCacheServiceImpl* appcache_service,
 556     ChromeBlobStorageContext* blob_storage_context) {
 557   DCHECK(resource_context);
 558   return new ChromeProtocolHandler(
 559       resource_context, is_incognito, appcache_service, blob_storage_context);
 560 }
 561
 562 void URLDataManagerBackend::AddDataSource(
 563     URLDataSourceImpl* source) {
 564   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 565   DataSourceMap::iterator i = data_sources_.find(source->source_name());
 566   if (i != data_sources_.end()) {
 567     if (!source->source()->ShouldReplaceExistingSource())
 568       return;
 569     i->second->backend_ = NULL;
 570   }
 571   data_sources_[source->source_name()] = source;
 572   source->backend_ = this;
 573 }
 574
 575 bool URLDataManagerBackend::HasPendingJob(
 576     URLRequestChromeJob* job) const {
 577   for (PendingRequestMap::const_iterator i = pending_requests_.begin();
 578        i != pending_requests_.end(); ++i) {
 579     if (i->second == job)
 580       return true;
 581   }
 582   return false;
 583 }
 584
 585 bool URLDataManagerBackend::StartRequest(const net::URLRequest* request,
 586                                          URLRequestChromeJob* job) {
 587   if (!CheckURLIsValid(request->url()))
 588     return false;
 589
 590   URLDataSourceImpl* source = GetDataSourceFromURL(request->url());
 591   if (!source)
 592     return false;
 593
 594   if (!source->source()->ShouldServiceRequest(request))
 595     return false;
 596
 597   std::string path;
 598   URLToRequestPath(request->url(), &path);
 599   source->source()->WillServiceRequest(request, &path);
 600
 601   // Save this request so we know where to send the data.
 602   RequestID request_id = next_request_id_++;
 603   pending_requests_.insert(std::make_pair(request_id, job));
 604
 605   job->set_allow_caching(source->source()->AllowCaching());
 606   job->set_add_content_security_policy(
 607       source->source()->ShouldAddContentSecurityPolicy());
 608   job->set_content_security_policy_object_source(
 609       source->source()->GetContentSecurityPolicyObjectSrc());
 610   job->set_content_security_policy_frame_source(
 611       source->source()->GetContentSecurityPolicyFrameSrc());
 612   job->set_deny_xframe_options(
 613       source->source()->ShouldDenyXFrameOptions());
 614   job->set_send_content_type_header(
 615       source->source()->ShouldServeMimeTypeAsContentTypeHeader());
 616
 617   std::string origin = GetOriginHeaderValue(request);
 618   if (!origin.empty()) {
 619     std::string header =
 620         source->source()->GetAccessControlAllowOriginForOrigin(origin);
 621     DCHECK(header.empty() || header == origin || header == "*" ||
 622            header == "null");
 623     job->set_access_control_allow_origin(header);
 624   }
 625
 626   // Look up additional request info to pass down.
 627   int render_process_id = -1;
 628   int render_frame_id = -1;
 629   ResourceRequestInfo::GetRenderFrameForRequest(request,
 630                                                 &render_process_id,
 631                                                 &render_frame_id);
 632
 633   // Forward along the request to the data source.
 634   base::MessageLoop* target_message_loop =
 635       source->source()->MessageLoopForRequestPath(path);
 636   if (!target_message_loop) {
 637     job->MimeTypeAvailable(source->source()->GetMimeType(path));
 638     // Eliminate potentially dangling pointer to avoid future use.
 639     job = NULL;
 640
 641     // The DataSource is agnostic to which thread StartDataRequest is called
 642     // on for this path.  Call directly into it from this thread, the IO
 643     // thread.
 644     source->source()->StartDataRequest(
 645         path, render_process_id, render_frame_id,
 646         base::Bind(&URLDataSourceImpl::SendResponse, source, request_id));
 647   } else {
 648     // URLRequestChromeJob should receive mime type before data. This
 649     // is guaranteed because request for mime type is placed in the
 650     // message loop before request for data. And correspondingly their
 651     // replies are put on the IO thread in the same order.
 652     target_message_loop->task_runner()->PostTask(
 653         FROM_HERE,
 654         base::Bind(&GetMimeTypeOnUI, scoped_refptr<URLDataSourceImpl>(source),
 655                    path, job->AsWeakPtr()));
 656
 657     // The DataSource wants StartDataRequest to be called on a specific thread,
 658     // usually the UI thread, for this path.
 659     target_message_loop->task_runner()->PostTask(
 660         FROM_HERE, base::Bind(&URLDataManagerBackend::CallStartRequest,
 661                               make_scoped_refptr(source), path,
 662                               render_process_id, render_frame_id, request_id));
 663   }
 664   return true;
 665 }
 666
 667 URLDataSourceImpl* URLDataManagerBackend::GetDataSourceFromURL(
 668     const GURL& url) {
 669   // The input usually looks like: chrome://source_name/extra_bits?foo
 670   // so do a lookup using the host of the URL.
 671   DataSourceMap::iterator i = data_sources_.find(url.host());
 672   if (i != data_sources_.end())
 673     return i->second.get();
 674
 675   // No match using the host of the URL, so do a lookup using the scheme for
 676   // URLs on the form source_name://extra_bits/foo .
 677   i = data_sources_.find(url.scheme() + "://");
 678   if (i != data_sources_.end())
 679     return i->second.get();
 680
 681   // No matches found, so give up.
 682   return NULL;
 683 }
 684
 685 void URLDataManagerBackend::CallStartRequest(
 686     scoped_refptr<URLDataSourceImpl> source,
 687     const std::string& path,
 688     int render_process_id,
 689     int render_frame_id,
 690     int request_id) {
 691   if (BrowserThread::CurrentlyOn(BrowserThread::UI) &&
 692       render_process_id != -1 &&
 693       !RenderProcessHost::FromID(render_process_id)) {
 694     // Make the request fail if its initiating renderer is no longer valid.
 695     // This can happen when the IO thread posts this task just before the
 696     // renderer shuts down.
 697     source->SendResponse(request_id, NULL);
 698     return;
 699   }
 700   source->source()->StartDataRequest(
 701       path,
 702       render_process_id,
 703       render_frame_id,
 704       base::Bind(&URLDataSourceImpl::SendResponse, source, request_id));
 705 }
 706
 707 void URLDataManagerBackend::RemoveRequest(URLRequestChromeJob* job) {
 708   // Remove the request from our list of pending requests.
 709   // If/when the source sends the data that was requested, the data will just
 710   // be thrown away.
 711   for (PendingRequestMap::iterator i = pending_requests_.begin();
 712        i != pending_requests_.end(); ++i) {
 713     if (i->second == job) {
 714       pending_requests_.erase(i);
 715       return;
 716     }
 717   }
 718 }
 719
 720 void URLDataManagerBackend::DataAvailable(RequestID request_id,
 721                                           base::RefCountedMemory* bytes) {
 722   // Forward this data on to the pending net::URLRequest, if it exists.
 723   PendingRequestMap::iterator i = pending_requests_.find(request_id);
 724   if (i != pending_requests_.end()) {
 725     URLRequestChromeJob* job = i->second;
 726     pending_requests_.erase(i);
 727     job->DataAvailable(bytes);
 728   }
 729 }
 730
 731 namespace {
 732
 733 class DevToolsJobFactory
 734     : public net::URLRequestJobFactory::ProtocolHandler {
 735  public:
 736   // |is_incognito| should be set for incognito profiles.
 737   DevToolsJobFactory(content::ResourceContext* resource_context,
 738                      bool is_incognito);
 739   ~DevToolsJobFactory() override;
 740
 741   net::URLRequestJob* MaybeCreateJob(
 742       net::URLRequest* request,
 743       net::NetworkDelegate* network_delegate) const override;
 744
 745  private:
 746   // |resource_context_| and |network_delegate_| are owned by ProfileIOData,
 747   // which owns this ProtocolHandler.
 748   content::ResourceContext* const resource_context_;
 749
 750   // True when generated from an incognito profile.
 751   const bool is_incognito_;
 752
 753   DISALLOW_COPY_AND_ASSIGN(DevToolsJobFactory);
 754 };
 755
 756 DevToolsJobFactory::DevToolsJobFactory(
 757     content::ResourceContext* resource_context,
 758     bool is_incognito)
 759     : resource_context_(resource_context),
 760       is_incognito_(is_incognito) {
 761   DCHECK(resource_context_);
 762 }
 763
 764 DevToolsJobFactory::~DevToolsJobFactory() {}
 765
 766 net::URLRequestJob*
 767 DevToolsJobFactory::MaybeCreateJob(
 768     net::URLRequest* request, net::NetworkDelegate* network_delegate) const {
 769   return new URLRequestChromeJob(
 770       request, network_delegate,
 771       GetURLDataManagerForResourceContext(resource_context_), is_incognito_);
 772 }
 773
 774 }  // namespace
 775
 776 net::URLRequestJobFactory::ProtocolHandler*
 777 CreateDevToolsProtocolHandler(content::ResourceContext* resource_context,
 778                               bool is_incognito) {
 779   return new DevToolsJobFactory(resource_context, is_incognito);
 780 }
 781
 782 }  // namespace content