extensions/renderer/script_context.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "extensions/renderer/script_context.h"
   6
   7 #include "base/logging.h"
   8 #include "base/memory/scoped_ptr.h"
   9 #include "base/strings/string_split.h"
  10 #include "base/strings/string_util.h"
  11 #include "base/strings/stringprintf.h"
  12 #include "base/values.h"
  13 #include "content/public/child/v8_value_converter.h"
  14 #include "content/public/common/url_constants.h"
  15 #include "content/public/renderer/render_frame.h"
  16 #include "content/public/renderer/render_view.h"
  17 #include "extensions/common/constants.h"
  18 #include "extensions/common/extension.h"
  19 #include "extensions/common/extension_api.h"
  20 #include "extensions/common/extension_set.h"
  21 #include "extensions/common/extension_urls.h"
  22 #include "extensions/common/features/base_feature_provider.h"
  23 #include "extensions/common/manifest_handlers/sandboxed_page_info.h"
  24 #include "extensions/common/permissions/permissions_data.h"
  25 #include "gin/per_context_data.h"
  26 #include "third_party/WebKit/public/web/WebDataSource.h"
  27 #include "third_party/WebKit/public/web/WebDocument.h"
  28 #include "third_party/WebKit/public/web/WebFrame.h"
  29 #include "third_party/WebKit/public/web/WebLocalFrame.h"
  30 #include "third_party/WebKit/public/web/WebScopedMicrotaskSuppression.h"
  31 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
  32 #include "third_party/WebKit/public/web/WebView.h"
  33 #include "v8/include/v8.h"
  34
  35 using content::V8ValueConverter;
  36
  37 namespace extensions {
  38
  39 namespace {
  40
  41 std::string GetContextTypeDescriptionString(Feature::Context context_type) {
  42   switch (context_type) {
  43     case Feature::UNSPECIFIED_CONTEXT:
  44       return "UNSPECIFIED";
  45     case Feature::BLESSED_EXTENSION_CONTEXT:
  46       return "BLESSED_EXTENSION";
  47     case Feature::UNBLESSED_EXTENSION_CONTEXT:
  48       return "UNBLESSED_EXTENSION";
  49     case Feature::CONTENT_SCRIPT_CONTEXT:
  50       return "CONTENT_SCRIPT";
  51     case Feature::WEB_PAGE_CONTEXT:
  52       return "WEB_PAGE";
  53     case Feature::BLESSED_WEB_PAGE_CONTEXT:
  54       return "BLESSED_WEB_PAGE";
  55     case Feature::WEBUI_CONTEXT:
  56       return "WEBUI";
  57   }
  58   NOTREACHED();
  59   return std::string();
  60 }
  61
  62 }  // namespace
  63
  64 // A gin::Runner that delegates to its ScriptContext.
  65 class ScriptContext::Runner : public gin::Runner {
  66  public:
  67   explicit Runner(ScriptContext* context);
  68
  69   // gin::Runner overrides.
  70   void Run(const std::string& source,
  71            const std::string& resource_name) override;
  72   v8::Local<v8::Value> Call(v8::Local<v8::Function> function,
  73                             v8::Local<v8::Value> receiver,
  74                             int argc,
  75                             v8::Local<v8::Value> argv[]) override;
  76   gin::ContextHolder* GetContextHolder() override;
  77
  78  private:
  79   ScriptContext* context_;
  80 };
  81
  82 ScriptContext::ScriptContext(const v8::Local<v8::Context>& v8_context,
  83                              blink::WebLocalFrame* web_frame,
  84                              const Extension* extension,
  85                              Feature::Context context_type,
  86                              const Extension* effective_extension,
  87                              Feature::Context effective_context_type)
  88     : is_valid_(true),
  89       v8_context_(v8_context->GetIsolate(), v8_context),
  90       web_frame_(web_frame),
  91       extension_(extension),
  92       context_type_(context_type),
  93       effective_extension_(effective_extension),
  94       effective_context_type_(effective_context_type),
  95       safe_builtins_(this),
  96       isolate_(v8_context->GetIsolate()),
  97       url_(web_frame_ ? GetDataSourceURLForFrame(web_frame_) : GURL()),
  98       runner_(new Runner(this)) {
  99   VLOG(1) << "Created context:\n"
 100           << "  extension id: " << GetExtensionID() << "\n"
 101           << "  frame:        " << web_frame_ << "\n"
 102           << "  URL:          " << GetURL() << "\n"
 103           << "  context type: " << GetContextTypeDescription() << "\n"
 104           << "  effective extension id: "
 105           << (effective_extension_.get() ? effective_extension_->id() : "")
 106           << "  effective context type: "
 107           << GetEffectiveContextTypeDescription();
 108   gin::PerContextData* gin_data = gin::PerContextData::From(v8_context);
 109   CHECK(gin_data);  // may fail if the v8::Context hasn't been registered yet
 110   gin_data->set_runner(runner_.get());
 111 }
 112
 113 ScriptContext::~ScriptContext() {
 114   VLOG(1) << "Destroyed context for extension\n"
 115           << "  extension id: " << GetExtensionID() << "\n"
 116           << "  effective extension id: "
 117           << (effective_extension_.get() ? effective_extension_->id() : "");
 118   CHECK(!is_valid_) << "ScriptContexts must be invalidated before destruction";
 119 }
 120
 121 // static
 122 bool ScriptContext::IsSandboxedPage(const ExtensionSet& extensions,
 123                                     const GURL& url) {
 124   // TODO(kalman): This is checking the wrong thing. See comment in
 125   // HasAccessOrThrowError.
 126   if (url.SchemeIs(kExtensionScheme)) {
 127     const Extension* extension = extensions.GetByID(url.host());
 128     if (extension) {
 129       return SandboxedPageInfo::IsSandboxedPage(extension, url.path());
 130     }
 131   }
 132   return false;
 133 }
 134
 135 void ScriptContext::Invalidate() {
 136   CHECK(is_valid_);
 137   is_valid_ = false;
 138
 139   // TODO(kalman): Make ModuleSystem use AddInvalidationObserver.
 140   // Ownership graph is a bit weird here.
 141   if (module_system_)
 142     module_system_->Invalidate();
 143
 144   // Swap |invalidate_observers_| to a local variable to clear it, and to make
 145   // sure it's not mutated as we iterate.
 146   std::vector<base::Closure> observers;
 147   observers.swap(invalidate_observers_);
 148   for (const base::Closure& observer : observers) {
 149     observer.Run();
 150   }
 151   DCHECK(invalidate_observers_.empty())
 152       << "Invalidation observers cannot be added during invalidation";
 153
 154   runner_.reset();
 155   v8_context_.Reset();
 156 }
 157
 158 void ScriptContext::AddInvalidationObserver(const base::Closure& observer) {
 159   invalidate_observers_.push_back(observer);
 160 }
 161
 162 const std::string& ScriptContext::GetExtensionID() const {
 163   return extension_.get() ? extension_->id() : base::EmptyString();
 164 }
 165
 166 content::RenderView* ScriptContext::GetRenderView() const {
 167   if (web_frame_ && web_frame_->view())
 168     return content::RenderView::FromWebView(web_frame_->view());
 169   return NULL;
 170 }
 171
 172 content::RenderFrame* ScriptContext::GetRenderFrame() const {
 173   if (web_frame_)
 174     return content::RenderFrame::FromWebFrame(web_frame_);
 175   return NULL;
 176 }
 177
 178 v8::Local<v8::Value> ScriptContext::CallFunction(
 179     const v8::Local<v8::Function>& function,
 180     int argc,
 181     v8::Local<v8::Value> argv[]) const {
 182   v8::EscapableHandleScope handle_scope(isolate());
 183   v8::Context::Scope scope(v8_context());
 184
 185   blink::WebScopedMicrotaskSuppression suppression;
 186   if (!is_valid_) {
 187     return handle_scope.Escape(
 188         v8::Local<v8::Primitive>(v8::Undefined(isolate())));
 189   }
 190
 191   v8::Local<v8::Object> global = v8_context()->Global();
 192   if (!web_frame_)
 193     return handle_scope.Escape(function->Call(global, argc, argv));
 194   return handle_scope.Escape(
 195       v8::Local<v8::Value>(web_frame_->callFunctionEvenIfScriptDisabled(
 196           function, global, argc, argv)));
 197 }
 198
 199 v8::Local<v8::Value> ScriptContext::CallFunction(
 200     const v8::Local<v8::Function>& function) const {
 201   return CallFunction(function, 0, nullptr);
 202 }
 203
 204 Feature::Availability ScriptContext::GetAvailability(
 205     const std::string& api_name) {
 206   // Hack: Hosted apps should have the availability of messaging APIs based on
 207   // the URL of the page (which might have access depending on some extension
 208   // with externally_connectable), not whether the app has access to messaging
 209   // (which it won't).
 210   const Extension* extension = extension_.get();
 211   if (extension && extension->is_hosted_app() &&
 212       (api_name == "runtime.connect" || api_name == "runtime.sendMessage")) {
 213     extension = NULL;
 214   }
 215   return ExtensionAPI::GetSharedInstance()->IsAvailable(
 216       api_name, extension, context_type_, GetURL());
 217 }
 218
 219 void ScriptContext::DispatchEvent(const char* event_name,
 220                                   v8::Local<v8::Array> args) const {
 221   v8::HandleScope handle_scope(isolate());
 222   v8::Context::Scope context_scope(v8_context());
 223
 224   v8::Local<v8::Value> argv[] = {v8::String::NewFromUtf8(isolate(), event_name),
 225                                  args};
 226   module_system_->CallModuleMethod(
 227       kEventBindings, "dispatchEvent", arraysize(argv), argv);
 228 }
 229
 230 void ScriptContext::DispatchOnUnloadEvent() {
 231   v8::HandleScope handle_scope(isolate());
 232   v8::Context::Scope context_scope(v8_context());
 233   module_system_->CallModuleMethod("unload_event", "dispatch");
 234 }
 235
 236 std::string ScriptContext::GetContextTypeDescription() {
 237   return GetContextTypeDescriptionString(context_type_);
 238 }
 239
 240 std::string ScriptContext::GetEffectiveContextTypeDescription() {
 241   return GetContextTypeDescriptionString(effective_context_type_);
 242 }
 243
 244 GURL ScriptContext::GetURL() const {
 245   return url_;
 246 }
 247
 248 bool ScriptContext::IsAnyFeatureAvailableToContext(const Feature& api) {
 249   return ExtensionAPI::GetSharedInstance()->IsAnyFeatureAvailableToContext(
 250       api, extension(), context_type(), GetDataSourceURLForFrame(web_frame()));
 251 }
 252
 253 // static
 254 GURL ScriptContext::GetDataSourceURLForFrame(const blink::WebFrame* frame) {
 255   // Normally we would use frame->document().url() to determine the document's
 256   // URL, but to decide whether to inject a content script, we use the URL from
 257   // the data source. This "quirk" helps prevents content scripts from
 258   // inadvertently adding DOM elements to the compose iframe in Gmail because
 259   // the compose iframe's dataSource URL is about:blank, but the document URL
 260   // changes to match the parent document after Gmail document.writes into
 261   // it to create the editor.
 262   // http://code.google.com/p/chromium/issues/detail?id=86742
 263   blink::WebDataSource* data_source = frame->provisionalDataSource()
 264                                           ? frame->provisionalDataSource()
 265                                           : frame->dataSource();
 266   return data_source ? GURL(data_source->request().url()) : GURL();
 267 }
 268
 269 // static
 270 GURL ScriptContext::GetEffectiveDocumentURL(const blink::WebFrame* frame,
 271                                             const GURL& document_url,
 272                                             bool match_about_blank) {
 273   // Common scenario. If |match_about_blank| is false (as is the case in most
 274   // extensions), or if the frame is not an about:-page, just return
 275   // |document_url| (supposedly the URL of the frame).
 276   if (!match_about_blank || !document_url.SchemeIs(url::kAboutScheme))
 277     return document_url;
 278
 279   // Non-sandboxed about:blank and about:srcdoc pages inherit their security
 280   // origin from their parent frame/window. So, traverse the frame/window
 281   // hierarchy to find the closest non-about:-page and return its URL.
 282   const blink::WebFrame* parent = frame;
 283   do {
 284     parent = parent->parent() ? parent->parent() : parent->opener();
 285   } while (parent != NULL && !parent->document().isNull() &&
 286            GURL(parent->document().url()).SchemeIs(url::kAboutScheme));
 287
 288   if (parent && !parent->document().isNull()) {
 289     // Only return the parent URL if the frame can access it.
 290     const blink::WebDocument& parent_document = parent->document();
 291     if (frame->document().securityOrigin().canAccess(
 292             parent_document.securityOrigin()))
 293       return parent_document.url();
 294   }
 295   return document_url;
 296 }
 297
 298 ScriptContext* ScriptContext::GetContext() { return this; }
 299
 300 void ScriptContext::OnResponseReceived(const std::string& name,
 301                                        int request_id,
 302                                        bool success,
 303                                        const base::ListValue& response,
 304                                        const std::string& error) {
 305   v8::HandleScope handle_scope(isolate());
 306
 307   scoped_ptr<V8ValueConverter> converter(V8ValueConverter::create());
 308   v8::Local<v8::Value> argv[] = {
 309       v8::Integer::New(isolate(), request_id),
 310       v8::String::NewFromUtf8(isolate(), name.c_str()),
 311       v8::Boolean::New(isolate(), success),
 312       converter->ToV8Value(&response,
 313                            v8::Local<v8::Context>::New(isolate(), v8_context_)),
 314       v8::String::NewFromUtf8(isolate(), error.c_str())};
 315
 316   v8::Local<v8::Value> retval = module_system()->CallModuleMethod(
 317       "sendRequest", "handleResponse", arraysize(argv), argv);
 318
 319   // In debug, the js will validate the callback parameters and return a
 320   // string if a validation error has occured.
 321   DCHECK(retval.IsEmpty() || retval->IsUndefined())
 322       << *v8::String::Utf8Value(retval);
 323 }
 324
 325 void ScriptContext::SetContentCapabilities(
 326     const APIPermissionSet& permissions) {
 327   content_capabilities_ = permissions;
 328 }
 329
 330 bool ScriptContext::HasAPIPermission(APIPermission::ID permission) const {
 331   if (effective_extension_.get()) {
 332     return effective_extension_->permissions_data()->HasAPIPermission(
 333         permission);
 334   } else if (context_type() == Feature::WEB_PAGE_CONTEXT) {
 335     // Only web page contexts may be granted content capabilities. Other
 336     // contexts are either privileged WebUI or extensions with their own set of
 337     // permissions.
 338     if (content_capabilities_.find(permission) != content_capabilities_.end())
 339       return true;
 340   }
 341   return false;
 342 }
 343
 344 bool ScriptContext::HasAccessOrThrowError(const std::string& name) {
 345   // Theoretically[1] we could end up with bindings being injected into
 346   // sandboxed frames, for example content scripts. Don't let them execute API
 347   // functions.
 348   //
 349   // In any case, this check is silly. The frame's document's security origin
 350   // already tells us if it's sandboxed. The only problem is that until
 351   // crbug.com/466373 is fixed, we don't know the security origin up-front and
 352   // may not know it here, either.
 353   //
 354   // [1] citation needed. This ScriptContext should already be in a state that
 355   // doesn't allow this, from ScriptContextSet::ClassifyJavaScriptContext.
 356   if (extension() &&
 357       SandboxedPageInfo::IsSandboxedPage(extension(), url_.path())) {
 358     static const char kMessage[] =
 359         "%s cannot be used within a sandboxed frame.";
 360     std::string error_msg = base::StringPrintf(kMessage, name.c_str());
 361     isolate()->ThrowException(v8::Exception::Error(
 362         v8::String::NewFromUtf8(isolate(), error_msg.c_str())));
 363     return false;
 364   }
 365
 366   Feature::Availability availability = GetAvailability(name);
 367   if (!availability.is_available()) {
 368     isolate()->ThrowException(v8::Exception::Error(
 369         v8::String::NewFromUtf8(isolate(), availability.message().c_str())));
 370     return false;
 371   }
 372
 373   return true;
 374 }
 375
 376 ScriptContext::Runner::Runner(ScriptContext* context) : context_(context) {
 377 }
 378
 379 void ScriptContext::Runner::Run(const std::string& source,
 380                                 const std::string& resource_name) {
 381   context_->module_system()->RunString(source, resource_name);
 382 }
 383
 384 v8::Local<v8::Value> ScriptContext::Runner::Call(
 385     v8::Local<v8::Function> function,
 386     v8::Local<v8::Value> receiver,
 387     int argc,
 388     v8::Local<v8::Value> argv[]) {
 389   return context_->CallFunction(function, argc, argv);
 390 }
 391
 392 gin::ContextHolder* ScriptContext::Runner::GetContextHolder() {
 393   v8::HandleScope handle_scope(context_->isolate());
 394   return gin::PerContextData::From(context_->v8_context())->context_holder();
 395 }
 396
 397 }  // namespace extensions