chrome_frame/utils.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome_frame/utils.h"
   6
   7 #include <atlsafe.h>
   8 #include <atlsecurity.h>
   9 #include <htiframe.h>
  10 #include <mshtml.h>
  11 #include <shlobj.h>
  12
  13 #include "base/file_util.h"
  14 #include "base/file_version_info.h"
  15 #include "base/lazy_instance.h"
  16 #include "base/logging.h"
  17 #include "base/path_service.h"
  18 #include "base/string_number_conversions.h"
  19 #include "base/string_util.h"
  20 #include "base/stringprintf.h"
  21 #include "base/strings/string_piece.h"
  22 #include "base/strings/string_tokenizer.h"
  23 #include "base/threading/thread_local.h"
  24 #include "base/utf_string_conversions.h"
  25 #include "base/win/registry.h"
  26 #include "base/win/scoped_bstr.h"
  27 #include "base/win/scoped_comptr.h"
  28 #include "base/win/scoped_variant.h"
  29 #include "chrome/common/automation_messages.h"
  30 #include "chrome/common/chrome_paths_internal.h"
  31 #include "chrome/common/url_constants.h"
  32 #include "chrome/installer/util/chrome_frame_distribution.h"
  33 #include "chrome_frame/chrome_tab.h"
  34 #include "chrome_frame/extra_system_apis.h"
  35 #include "chrome_frame/html_utils.h"
  36 #include "chrome_frame/navigation_constraints.h"
  37 #include "chrome_frame/policy_settings.h"
  38 #include "chrome_frame/registry_list_preferences_holder.h"
  39 #include "chrome_frame/simple_resource_loader.h"
  40 #include "extensions/common/constants.h"
  41 #include "googleurl/src/gurl.h"
  42 #include "googleurl/src/url_canon.h"
  43 #include "grit/chromium_strings.h"
  44 #include "net/base/escape.h"
  45 #include "net/http/http_util.h"
  46 #include "ui/base/models/menu_model.h"
  47
  48 using base::win::RegKey;
  49
  50 // Note that these values are all lower case and are compared to
  51 // lower-case-transformed values.
  52 const char kGCFProtocol[] = "gcf";
  53 const wchar_t kBodyTag[] = L"body";
  54 const wchar_t kContentAttribName[] = L"content";
  55 const wchar_t kChromeContentPrefix[] = L"chrome=";
  56 const wchar_t kChromeMimeType[] = L"application/chromepage";
  57 const wchar_t kChromeProtocolPrefix[] = L"gcf:";
  58 const wchar_t kHttpEquivAttribName[] = L"http-equiv";
  59 const wchar_t kIexploreProfileName[] = L"iexplore";
  60 const wchar_t kMetaTag[] = L"meta";
  61 const wchar_t kRundllProfileName[] = L"rundll32";
  62 const wchar_t kXUACompatValue[] = L"x-ua-compatible";
  63
  64 // Registry key and value names related to Chrome Frame configuration options.
  65 const wchar_t kAllowUnsafeURLs[] = L"AllowUnsafeURLs";
  66 const wchar_t kChromeFrameConfigKey[] = L"Software\\Google\\ChromeFrame";
  67 const wchar_t kEnableBuggyBhoIntercept[] = L"EnableBuggyBhoIntercept";
  68 const wchar_t kEnableGCFRendererByDefault[] = L"IsDefaultRenderer";
  69 const wchar_t kExcludeUAFromDomainList[] = L"ExcludeUAFromDomain";
  70 const wchar_t kPatchProtocols[] = L"PatchProtocols";
  71 const wchar_t kRenderInGCFUrlList[] = L"RenderInGcfUrls";
  72 const wchar_t kRenderInHostUrlList[] = L"RenderInHostUrls";
  73
  74 static const wchar_t kChromeFramePersistNPAPIReg[] = L"PersistNPAPIReg";
  75
  76 const char kAttachExternalTabPrefix[] = "attach_external_tab";
  77
  78 // Indicates that we are running in a test environment, where execptions, etc
  79 // are handled by the chrome test crash server.
  80 const wchar_t kChromeFrameHeadlessMode[] = L"ChromeFrameHeadlessMode";
  81
  82 // Indicates that we are running in an environment that expects chrome renderer
  83 // accessibility to be enabled for use in automation tests.
  84 const wchar_t kChromeFrameAccessibleMode[] = L"ChromeFrameAccessibleMode";
  85
  86 // Indicates that we are running in an environment that wishes to avoid
  87 // DLL pinning, such as the perf tests.
  88 const wchar_t kChromeFrameUnpinnedMode[] = L"kChromeFrameUnpinnedMode";
  89
  90 // Controls whether we download subresources, etc on the chrome frame page in
  91 // the background worker thread. Defaults to true.
  92 const wchar_t kUseBackgroundThreadForSubResources[]
  93     = L"BackgroundHTTPWorkerThread";
  94
  95 // {1AF32B6C-A3BA-48B9-B24E-8AA9C41F6ECD}
  96 static const IID IID_IWebBrowserPriv2IE7 = { 0x1AF32B6C, 0xA3BA, 0x48B9,
  97     { 0xB2, 0x4E, 0x8A, 0xA9, 0xC4, 0x1F, 0x6E, 0xCD } };
  98
  99 // {3ED72303-6FFC-4214-BA90-FAF1862DEC8A}
 100 static const IID IID_IWebBrowserPriv2IE8 = { 0x3ED72303, 0x6FFC, 0x4214,
 101     { 0xBA, 0x90, 0xFA, 0xF1, 0x86, 0x2D, 0xEC, 0x8A } };
 102
 103 // {486F6159-9F3F-4827-82D4-283CEF397733}
 104 static const IID IID_IWebBrowserPriv2IE8XP = { 0x486F6159, 0x9F3F, 0x4827,
 105     { 0x82, 0xD4, 0x28, 0x3C, 0xEF, 0x39, 0x77, 0x33 } };
 106
 107 // {38339692-0BC9-46CB-8E5C-4677A5C83DD5}
 108 static const IID IID_IWebBrowserPriv2IE8XPBeta = { 0x38339692, 0x0BC9, 0x46CB,
 109     { 0x8E, 0x5C, 0x46, 0x77, 0xA5, 0xC8, 0x3D, 0xD5 } };
 110
 111 namespace {
 112
 113 // A flag used to signal when an active browser instance on the current thread
 114 // is loading a Chrome Frame document.  There's no reference stored with the
 115 // pointer so it should not be dereferenced and used for comparison against a
 116 // living instance only.
 117 base::LazyInstance<base::ThreadLocalPointer<IBrowserService> >
 118     g_tls_browser_for_cf_navigation = LAZY_INSTANCE_INITIALIZER;
 119
 120 // Holds the cached preferences for the per-url render type settings.
 121 base::LazyInstance<RegistryListPreferencesHolder>::Leaky
 122     g_render_type_for_url_holder;
 123
 124 // Holds the cached preferences for the per-url user agent filter.
 125 base::LazyInstance<RegistryListPreferencesHolder>::Leaky
 126     g_user_agent_filter_holder;
 127
 128 }  // end anonymous namespace
 129
 130 HRESULT UtilRegisterTypeLib(HINSTANCE tlb_instance,
 131                             LPCOLESTR index,
 132                             bool for_current_user_only) {
 133   CComBSTR path;
 134   CComPtr<ITypeLib> type_lib;
 135   HRESULT hr = AtlLoadTypeLib(tlb_instance, index, &path, &type_lib);
 136   if (SUCCEEDED(hr)) {
 137     hr = UtilRegisterTypeLib(type_lib, path, NULL, for_current_user_only);
 138   }
 139   return hr;
 140 }
 141
 142 HRESULT UtilUnRegisterTypeLib(HINSTANCE tlb_instance,
 143                               LPCOLESTR index,
 144                               bool for_current_user_only) {
 145   CComBSTR path;
 146   CComPtr<ITypeLib> type_lib;
 147   HRESULT hr = AtlLoadTypeLib(tlb_instance, index, &path, &type_lib);
 148   if (SUCCEEDED(hr)) {
 149     hr = UtilUnRegisterTypeLib(type_lib, for_current_user_only);
 150   }
 151   return hr;
 152 }
 153
 154 HRESULT UtilRegisterTypeLib(LPCWSTR typelib_path,
 155                             bool for_current_user_only) {
 156   if (NULL == typelib_path) {
 157     return E_INVALIDARG;
 158   }
 159   CComBSTR path;
 160   CComPtr<ITypeLib> type_lib;
 161   HRESULT hr = ::LoadTypeLib(typelib_path, &type_lib);
 162   if (SUCCEEDED(hr)) {
 163     hr = UtilRegisterTypeLib(type_lib,
 164                              typelib_path,
 165                              NULL,
 166                              for_current_user_only);
 167   }
 168   return hr;
 169 }
 170
 171 HRESULT UtilUnRegisterTypeLib(LPCWSTR typelib_path,
 172                               bool for_current_user_only) {
 173   CComPtr<ITypeLib> type_lib;
 174   HRESULT hr = ::LoadTypeLib(typelib_path, &type_lib);
 175   if (SUCCEEDED(hr)) {
 176     hr = UtilUnRegisterTypeLib(type_lib, for_current_user_only);
 177   }
 178   return hr;
 179 }
 180
 181 HRESULT UtilRegisterTypeLib(ITypeLib* typelib,
 182                             LPCWSTR typelib_path,
 183                             LPCWSTR help_dir,
 184                             bool for_current_user_only) {
 185   typedef HRESULT(WINAPI *RegisterTypeLibPrototype)(ITypeLib FAR* type_lib,
 186                                                     OLECHAR FAR* full_path,
 187                                                     OLECHAR FAR* help_dir);
 188   LPCSTR function_name =
 189       for_current_user_only ? "RegisterTypeLibForUser" : "RegisterTypeLib";
 190   RegisterTypeLibPrototype reg_tlb =
 191       reinterpret_cast<RegisterTypeLibPrototype>(
 192           GetProcAddress(GetModuleHandle(_T("oleaut32.dll")),
 193                                          function_name));
 194   if (NULL == reg_tlb) {
 195     return E_FAIL;
 196   }
 197   return reg_tlb(typelib,
 198                  const_cast<OLECHAR*>(typelib_path),
 199                  const_cast<OLECHAR*>(help_dir));
 200 }
 201
 202 HRESULT UtilUnRegisterTypeLib(ITypeLib* typelib,
 203                               bool for_current_user_only) {
 204   if (NULL == typelib) {
 205     return E_INVALIDARG;
 206   }
 207   typedef HRESULT(WINAPI *UnRegisterTypeLibPrototype)(
 208       REFGUID libID,
 209       unsigned short wVerMajor,  // NOLINT
 210       unsigned short wVerMinor,  // NOLINT
 211       LCID lcid,
 212       SYSKIND syskind);
 213   LPCSTR function_name =
 214     for_current_user_only ? "UnRegisterTypeLibForUser" : "UnRegisterTypeLib";
 215
 216   UnRegisterTypeLibPrototype unreg_tlb =
 217       reinterpret_cast<UnRegisterTypeLibPrototype>(
 218           GetProcAddress(GetModuleHandle(_T("oleaut32.dll")),
 219                                          function_name));
 220   if (NULL == unreg_tlb) {
 221     return E_FAIL;
 222   }
 223   TLIBATTR* tla = NULL;
 224   HRESULT hr = typelib->GetLibAttr(&tla);
 225   if (SUCCEEDED(hr)) {
 226     hr = unreg_tlb(tla->guid,
 227                    tla->wMajorVerNum,
 228                    tla->wMinorVerNum,
 229                    tla->lcid,
 230                    tla->syskind);
 231     typelib->ReleaseTLibAttr(tla);
 232   }
 233   return hr;
 234 }
 235
 236 bool UtilRemovePersistentNPAPIMarker() {
 237   BrowserDistribution* cf_dist = BrowserDistribution::GetDistribution();
 238   std::wstring cf_state_key_path(cf_dist->GetStateKey());
 239   RegKey cf_state_key;
 240
 241   LONG result = cf_state_key.Open(HKEY_LOCAL_MACHINE, cf_state_key_path.c_str(),
 242                                   KEY_SET_VALUE);
 243   if (result == ERROR_SUCCESS)
 244     result = cf_state_key.DeleteValue(kChromeFramePersistNPAPIReg);
 245   return (result == ERROR_SUCCESS || result == ERROR_FILE_NOT_FOUND);
 246 }
 247
 248 HRESULT UtilGetXUACompatContentValue(const std::wstring& html_string,
 249                                      std::wstring* content_value) {
 250   if (!content_value) {
 251     return E_POINTER;
 252   }
 253
 254   // Fail fast if the string X-UA-Compatible isn't in html_string
 255   if (StringToLowerASCII(html_string).find(kXUACompatValue) ==
 256       std::wstring::npos) {
 257     return E_FAIL;
 258   }
 259
 260   HTMLScanner scanner(html_string.c_str());
 261
 262   // Build the list of meta tags that occur before the body tag is hit.
 263   HTMLScanner::StringRangeList tag_list;
 264   scanner.GetTagsByName(kMetaTag, &tag_list, kBodyTag);
 265
 266   // Search the list of meta tags for one with an http-equiv="X-UA-Compatible"
 267   // attribute.
 268   HTMLScanner::StringRange attribute;
 269   std::string search_attribute_ascii(WideToASCII(kXUACompatValue));
 270   HTMLScanner::StringRangeList::const_iterator tag_list_iter(tag_list.begin());
 271   for (; tag_list_iter != tag_list.end(); tag_list_iter++) {
 272     if (!tag_list_iter->GetTagAttribute(kHttpEquivAttribName, &attribute)) {
 273       continue;
 274     }
 275
 276     // We found an http-equiv meta tag, check its value using the ascii
 277     // case-insensitive comparison method.
 278     if (!attribute.LowerCaseEqualsASCII(search_attribute_ascii.c_str())) {
 279       continue;
 280     }
 281
 282     // We found our X-UA-Compatible meta tag so look for and extract
 283     // the value of the content attribute.
 284     if (!tag_list_iter->GetTagAttribute(kContentAttribName, &attribute)) {
 285       continue;
 286     }
 287
 288     // Found the content string, copy and return.
 289     content_value->assign(attribute.Copy());
 290     return S_OK;
 291   }
 292
 293   return E_FAIL;
 294 }
 295
 296 void DisplayVersionMismatchWarning(HWND parent,
 297                                    const std::string& server_version) {
 298   // Obtain the current module version.
 299   scoped_ptr<FileVersionInfo> module_version_info(
 300       FileVersionInfo::CreateFileVersionInfoForCurrentModule());
 301   string16 version_string(module_version_info->file_version());
 302   std::wstring wide_server_version;
 303   if (server_version.empty()) {
 304     wide_server_version = SimpleResourceLoader::Get(IDS_VERSIONUNKNOWN);
 305   } else {
 306     wide_server_version = ASCIIToWide(server_version);
 307   }
 308   std::wstring title = SimpleResourceLoader::Get(IDS_VERSIONMISMATCH_HEADER);
 309   std::wstring message;
 310   base::SStringPrintf(&message,
 311                       SimpleResourceLoader::Get(IDS_VERSIONMISMATCH).c_str(),
 312                       wide_server_version.c_str(),
 313                       version_string.c_str());
 314
 315   ::MessageBox(parent, message.c_str(), title.c_str(), MB_OK);
 316 }
 317
 318 std::string CreateJavascript(const std::string& function_name,
 319                              const std::string args) {
 320   std::string script_string = "javascript:";
 321   script_string += function_name + "(";
 322   if (!args.empty()) {
 323     script_string += "'";
 324     script_string += args;
 325     script_string += "'";
 326   }
 327   script_string += ")";
 328   return script_string;
 329 }
 330
 331 AddRefModule::AddRefModule() {
 332   // TODO(tommi): Override the module's Lock/Unlock methods to call
 333   //  npapi::SetValue(NPPVpluginKeepLibraryInMemory) and keep the dll loaded
 334   //  while the module's refcount is > 0.  Only do this when we're being
 335   //  used as an NPAPI module.
 336   _pAtlModule->Lock();
 337 }
 338
 339
 340 AddRefModule::~AddRefModule() {
 341   _pAtlModule->Unlock();
 342 }
 343
 344 bool IsChrome(RendererType renderer_type) {
 345   DCHECK_GE(renderer_type, RENDERER_TYPE_UNDETERMINED);
 346   DCHECK_LE(renderer_type, RENDERER_TYPE_OTHER);
 347   return renderer_type >= RENDERER_TYPE_CHROME_MIN &&
 348     renderer_type <= RENDERER_TYPE_CHROME_MAX;
 349 }
 350
 351 namespace {
 352 const char kIEImageName[] = "iexplore.exe";
 353 }  // namespace
 354
 355 std::wstring GetHostProcessName(bool include_extension) {
 356   base::FilePath exe;
 357   if (PathService::Get(base::FILE_EXE, &exe))
 358     exe = exe.BaseName();
 359   if (!include_extension) {
 360     exe = exe.RemoveExtension();
 361   }
 362   return exe.value();
 363 }
 364
 365 BrowserType GetBrowserType() {
 366   static BrowserType browser_type = BROWSER_INVALID;
 367
 368   if (browser_type == BROWSER_INVALID) {
 369     std::wstring exe(GetHostProcessName(true));
 370     if (!exe.empty()) {
 371       std::wstring::const_iterator begin = exe.begin();
 372       std::wstring::const_iterator end = exe.end();
 373       if (LowerCaseEqualsASCII(begin, end, kIEImageName)) {
 374         browser_type = BROWSER_IE;
 375       } else {
 376         browser_type = BROWSER_UNKNOWN;
 377       }
 378     } else {
 379       NOTREACHED();
 380     }
 381   }
 382
 383   return browser_type;
 384 }
 385
 386 uint32 GetIEMajorVersion() {
 387   static uint32 ie_major_version = UINT_MAX;
 388
 389   if (ie_major_version == UINT_MAX) {
 390     wchar_t exe_path[MAX_PATH];
 391     HMODULE mod = GetModuleHandle(NULL);
 392     GetModuleFileName(mod, exe_path, arraysize(exe_path) - 1);
 393     std::wstring exe_name = base::FilePath(exe_path).BaseName().value();
 394     if (!LowerCaseEqualsASCII(exe_name, kIEImageName)) {
 395       ie_major_version = 0;
 396     } else {
 397       uint32 high = 0;
 398       uint32 low  = 0;
 399       if (GetModuleVersion(mod, &high, &low)) {
 400         ie_major_version = HIWORD(high);
 401       } else {
 402         ie_major_version = 0;
 403       }
 404     }
 405   }
 406
 407   return ie_major_version;
 408 }
 409
 410 IEVersion GetIEVersion() {
 411   static IEVersion ie_version = IE_INVALID;
 412
 413   if (ie_version == IE_INVALID) {
 414     uint32 major_version = GetIEMajorVersion();
 415     switch (major_version) {
 416       case 0:
 417         ie_version = NON_IE;
 418         break;
 419       case 6:
 420         ie_version = IE_6;
 421         break;
 422       case 7:
 423         ie_version = IE_7;
 424         break;
 425       case 8:
 426         ie_version = IE_8;
 427         break;
 428       case 9:
 429         ie_version = IE_9;
 430         break;
 431       default:
 432         ie_version = (major_version >= 10) ? IE_10 : IE_UNSUPPORTED;
 433         break;
 434     }
 435   }
 436
 437   return ie_version;
 438 }
 439
 440 base::FilePath GetIETemporaryFilesFolder() {
 441   LPITEMIDLIST tif_pidl = NULL;
 442   HRESULT hr = SHGetFolderLocation(NULL, CSIDL_INTERNET_CACHE, NULL,
 443                                    SHGFP_TYPE_CURRENT, &tif_pidl);
 444   if (SUCCEEDED(hr) && tif_pidl) {
 445     base::win::ScopedComPtr<IShellFolder> parent_folder;
 446     LPITEMIDLIST relative_pidl = NULL;
 447     hr = SHBindToParent(tif_pidl, IID_IShellFolder,
 448                         reinterpret_cast<void**>(parent_folder.Receive()),
 449                         const_cast<LPCITEMIDLIST*>(&relative_pidl));
 450     if (SUCCEEDED(hr) && relative_pidl) {
 451       STRRET path = {0};
 452       hr = parent_folder->GetDisplayNameOf(relative_pidl,
 453                                            SHGDN_NORMAL | SHGDN_FORPARSING,
 454                                            &path);
 455       DCHECK(SUCCEEDED(hr));
 456       base::win::ScopedBstr temp_internet_files_bstr;
 457       StrRetToBSTR(&path, relative_pidl, temp_internet_files_bstr.Receive());
 458       base::FilePath temp_internet_files(
 459           static_cast<BSTR>(temp_internet_files_bstr));
 460       ILFree(tif_pidl);
 461       return temp_internet_files;
 462     } else {
 463       NOTREACHED() << "SHBindToParent failed with Error:" << hr;
 464       ILFree(tif_pidl);
 465     }
 466   } else {
 467     NOTREACHED() << "SHGetFolderLocation for internet cache failed. Error:"
 468                  << hr;
 469   }
 470   // As a last ditch effort we use the SHGetFolderPath function to retrieve the
 471   // path. This function has a limitation of MAX_PATH.
 472   wchar_t path[MAX_PATH + 1] = {0};
 473   hr = SHGetFolderPath(NULL, CSIDL_INTERNET_CACHE, NULL, SHGFP_TYPE_CURRENT,
 474                        path);
 475   if (SUCCEEDED(hr)) {
 476     return base::FilePath(path);
 477   } else {
 478     NOTREACHED() << "SHGetFolderPath for internet cache failed. Error:"
 479                  << hr;
 480   }
 481   return base::FilePath();
 482 }
 483
 484 bool IsIEInPrivate() {
 485   typedef BOOL (WINAPI* IEIsInPrivateBrowsingPtr)();
 486   bool incognito_mode = false;
 487   HMODULE h = GetModuleHandle(L"ieframe.dll");
 488   if (h) {
 489     IEIsInPrivateBrowsingPtr IsInPrivate =
 490         reinterpret_cast<IEIsInPrivateBrowsingPtr>(GetProcAddress(h,
 491         "IEIsInPrivateBrowsing"));
 492     if (IsInPrivate) {
 493       incognito_mode = !!IsInPrivate();
 494     }
 495   }
 496
 497   return incognito_mode;
 498 }
 499
 500 HRESULT DoFileDownloadInIE(const wchar_t* url) {
 501   DCHECK(url);
 502
 503   HMODULE mod = ::GetModuleHandleA("ieframe.dll");
 504   if (!mod)
 505     mod = ::GetModuleHandleA("shdocvw.dll");
 506
 507   if (!mod) {
 508     NOTREACHED();
 509     return E_UNEXPECTED;
 510   }
 511
 512   typedef HRESULT (WINAPI* DoFileDownloadFn)(const wchar_t*);
 513   DoFileDownloadFn fn = reinterpret_cast<DoFileDownloadFn>(
 514       ::GetProcAddress(mod, "DoFileDownload"));
 515   DCHECK(fn);
 516   return fn ? fn(url) : E_UNEXPECTED;
 517 }
 518
 519 bool GetModuleVersion(HMODULE module, uint32* high, uint32* low) {
 520   DCHECK(module != NULL)
 521       << "Please use GetModuleHandle(NULL) to get the process name";
 522   DCHECK(high);
 523
 524   bool ok = false;
 525
 526   HRSRC res = FindResource(module,
 527       reinterpret_cast<const wchar_t*>(VS_VERSION_INFO), RT_VERSION);
 528   if (res) {
 529     HGLOBAL res_data = LoadResource(module, res);
 530     DWORD version_resource_size = SizeofResource(module, res);
 531     const void* readonly_resource_data = LockResource(res_data);
 532     if (readonly_resource_data && version_resource_size) {
 533       // Copy data as VerQueryValue tries to modify the data. This causes
 534       // exceptions and heap corruption errors if debugger is attached.
 535       scoped_ptr<char[]> data(new char[version_resource_size]);
 536       if (data.get()) {
 537         memcpy(data.get(), readonly_resource_data, version_resource_size);
 538         VS_FIXEDFILEINFO* ver_info = NULL;
 539         UINT info_size = 0;
 540         if (VerQueryValue(data.get(), L"\\",
 541                           reinterpret_cast<void**>(&ver_info), &info_size)) {
 542           *high = ver_info->dwFileVersionMS;
 543           if (low != NULL)
 544             *low = ver_info->dwFileVersionLS;
 545           ok = true;
 546         }
 547
 548         UnlockResource(res_data);
 549       }
 550       FreeResource(res_data);
 551     }
 552   }
 553
 554   return ok;
 555 }
 556
 557 namespace {
 558
 559 const int kMaxSubmenuDepth = 10;
 560
 561 // Builds a Windows menu from the menu model sent from Chrome.  The
 562 // caller is responsible for closing the returned HMENU.  This does
 563 // not currently handle bitmaps (e.g. hbmpChecked, hbmpUnchecked or
 564 // hbmpItem), so checkmarks, radio buttons, and custom icons won't work.
 565 // It also copies over submenus up to a maximum depth of kMaxSubMenuDepth.
 566 HMENU BuildContextMenuImpl(const ContextMenuModel* menu_model, int depth) {
 567   if (depth >= kMaxSubmenuDepth)
 568     return NULL;
 569
 570   HMENU menu = CreatePopupMenu();
 571   for (size_t i = 0; i < menu_model->items.size(); i++) {
 572     const ContextMenuModel::Item& item = menu_model->items[i];
 573
 574     MENUITEMINFO item_info = { 0 };
 575     item_info.cbSize = sizeof(MENUITEMINFO);
 576     switch (item.type) {
 577       case ui::MenuModel::TYPE_COMMAND:
 578       case ui::MenuModel::TYPE_CHECK:
 579         item_info.fMask = MIIM_FTYPE | MIIM_ID | MIIM_STRING;
 580         item_info.fType = MFT_STRING;
 581         item_info.wID = item.item_id;
 582         item_info.dwTypeData = const_cast<LPWSTR>(item.label.c_str());
 583         break;
 584       case ui::MenuModel::TYPE_RADIO:
 585         item_info.fMask = MIIM_FTYPE | MIIM_ID | MIIM_STRING;
 586         item_info.fType = MFT_STRING | MFT_RADIOCHECK;
 587         item_info.wID = item.item_id;
 588         item_info.dwTypeData = const_cast<LPWSTR>(item.label.c_str());
 589         break;
 590       case ui::MenuModel::TYPE_SEPARATOR:
 591         item_info.fMask = MIIM_FTYPE;
 592         item_info.fType = MFT_SEPARATOR;
 593         break;
 594       case ui::MenuModel::TYPE_SUBMENU:
 595         item_info.fMask = MIIM_FTYPE | MIIM_ID | MIIM_STRING | MIIM_SUBMENU;
 596         item_info.fType = MFT_STRING;
 597         item_info.wID = item.item_id;
 598         item_info.dwTypeData = const_cast<LPWSTR>(item.label.c_str());
 599         item_info.hSubMenu = BuildContextMenuImpl(item.submenu, depth + 1);
 600         break;
 601       default:
 602         NOTREACHED() << "Unsupported MenuModel::ItemType " << item.type;
 603         break;
 604     }
 605
 606     item_info.fMask |= MIIM_STATE;
 607     item_info.fState =
 608         (item.checked ? MFS_CHECKED : MFS_UNCHECKED) |
 609         (item.enabled ? MFS_ENABLED : (MFS_DISABLED | MFS_GRAYED));
 610
 611     InsertMenuItem(menu, i, TRUE, &item_info);
 612   }
 613
 614   return menu;
 615 }
 616
 617 }  // namespace
 618
 619 HMENU BuildContextMenu(const ContextMenuModel& menu_model) {
 620   return BuildContextMenuImpl(&menu_model, 0);
 621 }
 622
 623 std::string ResolveURL(const std::string& document,
 624                        const std::string& relative) {
 625   if (document.empty()) {
 626     return GURL(relative).spec();
 627   } else {
 628     return GURL(document).Resolve(relative).spec();
 629   }
 630 }
 631
 632 bool HaveSameOrigin(const std::string& url1, const std::string& url2) {
 633   GURL a(url1), b(url2);
 634   bool ret;
 635   if (a.is_valid() != b.is_valid()) {
 636     // Either (but not both) url is invalid, so they can't match.
 637     ret = false;
 638   } else if (!a.is_valid()) {
 639     // Both URLs are invalid (see first check).  Just check if the opaque
 640     // strings match exactly.
 641     ret = url1.compare(url2) == 0;
 642   } else if (a.GetOrigin() != b.GetOrigin()) {
 643     // The origins don't match.
 644     ret = false;
 645   } else {
 646     // we have a match.
 647     ret = true;
 648   }
 649
 650   return ret;
 651 }
 652
 653 int GetConfigInt(int default_value, const wchar_t* value_name) {
 654   int ret = default_value;
 655   RegKey config_key;
 656   if (config_key.Open(HKEY_CURRENT_USER, kChromeFrameConfigKey,
 657                       KEY_QUERY_VALUE) == ERROR_SUCCESS) {
 658     config_key.ReadValueDW(value_name, reinterpret_cast<DWORD*>(&ret));
 659   }
 660
 661   return ret;
 662 }
 663
 664 bool GetConfigBool(bool default_value, const wchar_t* value_name) {
 665   DWORD value = GetConfigInt(default_value, value_name);
 666   return (value != FALSE);
 667 }
 668
 669 bool SetConfigInt(const wchar_t* value_name, int value) {
 670   RegKey config_key;
 671   if (config_key.Create(HKEY_CURRENT_USER, kChromeFrameConfigKey,
 672                         KEY_SET_VALUE) == ERROR_SUCCESS) {
 673     if (config_key.WriteValue(value_name, value) == ERROR_SUCCESS) {
 674       return true;
 675     }
 676   }
 677
 678   return false;
 679 }
 680
 681 bool SetConfigBool(const wchar_t* value_name, bool value) {
 682   return SetConfigInt(value_name, value);
 683 }
 684
 685 bool DeleteConfigValue(const wchar_t* value_name) {
 686   RegKey config_key;
 687   if (config_key.Open(HKEY_CURRENT_USER, kChromeFrameConfigKey,
 688                       KEY_WRITE) == ERROR_SUCCESS) {
 689     if (config_key.DeleteValue(value_name) == ERROR_SUCCESS) {
 690       return true;
 691     }
 692   }
 693   return false;
 694 }
 695
 696 bool IsGcfDefaultRenderer() {
 697   DWORD is_default = 0;  // NOLINT
 698
 699   // First check policy settings
 700   PolicySettings::RendererForUrl renderer =
 701       PolicySettings::GetInstance()->default_renderer();
 702   if (renderer != PolicySettings::RENDERER_NOT_SPECIFIED) {
 703     is_default = (renderer == PolicySettings::RENDER_IN_CHROME_FRAME);
 704   } else {
 705     // TODO(tommi): Implement caching for this config value as it gets
 706     // checked frequently.
 707     RegKey config_key;
 708     if (config_key.Open(HKEY_CURRENT_USER, kChromeFrameConfigKey,
 709                         KEY_READ) == ERROR_SUCCESS) {
 710       config_key.ReadValueDW(kEnableGCFRendererByDefault, &is_default);
 711     }
 712   }
 713
 714   return is_default != 0;
 715 }
 716
 717 RendererType RendererTypeForUrl(const std::wstring& url) {
 718   // First check if the default renderer settings are specified by policy.
 719   // If so, then that overrides the user settings.
 720   PolicySettings::RendererForUrl renderer =
 721       PolicySettings::GetInstance()->GetRendererForUrl(url.c_str());
 722   if (renderer != PolicySettings::RENDERER_NOT_SPECIFIED) {
 723     // We may know at this point that policy says do NOT render in Chrome Frame.
 724     // To maintain consistency, we return RENDERER_TYPE_UNDETERMINED so that
 725     // content sniffing, etc. still take place.
 726     // TODO(tommi): Clarify the intent here.
 727     return (renderer == PolicySettings::RENDER_IN_CHROME_FRAME) ?
 728         RENDERER_TYPE_CHROME_OPT_IN_URL : RENDERER_TYPE_UNDETERMINED;
 729   }
 730
 731   // TODO(robertshield): Move this into a holder-type class that listens
 732   // for reg change events as well.
 733   static int render_in_cf_by_default = FALSE;
 734
 735   RegistryListPreferencesHolder& render_type_for_url_holder =
 736       g_render_type_for_url_holder.Get();
 737   if (!render_type_for_url_holder.Valid()) {
 738     const wchar_t* url_list_name = kRenderInGCFUrlList;
 739     if (IsGcfDefaultRenderer()) {
 740       url_list_name = kRenderInHostUrlList;
 741       render_in_cf_by_default = TRUE;
 742     } else {
 743       render_in_cf_by_default = FALSE;
 744     }
 745
 746     render_type_for_url_holder.Init(HKEY_CURRENT_USER,
 747                                     kChromeFrameConfigKey,
 748                                     url_list_name);
 749   }
 750   DCHECK(render_type_for_url_holder.Valid());
 751
 752   RendererType renderer_type =
 753       render_in_cf_by_default ? RENDERER_TYPE_CHROME_DEFAULT_RENDERER :
 754                                 RENDERER_TYPE_UNDETERMINED;
 755
 756   if (render_type_for_url_holder.ListMatches(url)) {
 757     renderer_type = render_in_cf_by_default ?
 758       RENDERER_TYPE_UNDETERMINED :
 759       RENDERER_TYPE_CHROME_OPT_IN_URL;
 760   }
 761
 762   return renderer_type;
 763 }
 764
 765 bool ShouldRemoveUAForUrl(const string16& url) {
 766   // TODO(robertshield): Wire up the stuff in PolicySettings here so the value
 767   // can be specified via group policy.
 768   // TODO(robertshield): Add a default list of exclusions here for site with
 769   // known bad UA parsing.
 770   RegistryListPreferencesHolder& user_agent_filter_holder =
 771       g_user_agent_filter_holder.Get();
 772   if (!user_agent_filter_holder.Valid()) {
 773     user_agent_filter_holder.Init(HKEY_CURRENT_USER,
 774                                   kChromeFrameConfigKey,
 775                                   kExcludeUAFromDomainList);
 776   }
 777   DCHECK(user_agent_filter_holder.Valid());
 778
 779   return user_agent_filter_holder.ListMatches(url);
 780 }
 781
 782 RegistryListPreferencesHolder& GetRendererTypePreferencesHolderForTesting() {
 783   return g_render_type_for_url_holder.Get();
 784 }
 785
 786 RegistryListPreferencesHolder& GetUserAgentPreferencesHolderForTesting() {
 787   return g_user_agent_filter_holder.Get();
 788 }
 789
 790 HRESULT NavigateBrowserToMoniker(IUnknown* browser, IMoniker* moniker,
 791                                  const wchar_t* headers, IBindCtx* bind_ctx,
 792                                  const wchar_t* fragment, IStream* post_data,
 793                                  VARIANT* flags) {
 794   DCHECK(browser);
 795   DCHECK(moniker);
 796   DCHECK(bind_ctx);
 797
 798   base::win::ScopedComPtr<IWebBrowser2> web_browser2;
 799   HRESULT hr = DoQueryService(SID_SWebBrowserApp, browser,
 800                               web_browser2.Receive());
 801   DCHECK(web_browser2);
 802   DLOG_IF(WARNING, FAILED(hr)) << base::StringPrintf(L"SWebBrowserApp 0x%08X",
 803                                                      hr);
 804   if (FAILED(hr))
 805     return hr;
 806
 807   // If the data to be downloaded was received in response to a post request
 808   // then we need to reissue the post request.
 809   base::win::ScopedVariant post_data_variant;
 810   if (post_data) {
 811     RewindStream(post_data);
 812
 813     CComSafeArray<uint8> safe_array_post;
 814
 815     STATSTG stat;
 816     post_data->Stat(&stat, STATFLAG_NONAME);
 817
 818     if (stat.cbSize.LowPart > 0) {
 819       std::string data;
 820
 821       HRESULT hr = E_FAIL;
 822       while ((hr = ReadStream(post_data, 0xffff, &data)) == S_OK) {
 823         safe_array_post.Add(
 824             data.size(),
 825             reinterpret_cast<unsigned char*>(const_cast<char*>(data.data())));
 826         data.clear();
 827       }
 828     } else {
 829       // If we get here it means that the navigation is being reissued for a
 830       // POST request with no data. To ensure that the new window used as a
 831       // target to handle the new navigation issues a POST request
 832       // we need valid POST data. In this case we create a dummy 1 byte array.
 833       // May not work as expected with some web sites.
 834       DLOG(WARNING) << "Reissuing navigation with empty POST data. May not"
 835                     << " work as expected";
 836       safe_array_post.Create(1);
 837     }
 838     post_data_variant.Set(safe_array_post.Detach());
 839   }
 840   // Create a new bind context that's not associated with our callback.
 841   // Calling RevokeBindStatusCallback doesn't disassociate the callback with
 842   // the bind context in IE7.  The returned bind context has the same
 843   // implementation of GetRunningObjectTable as the bind context we held which
 844   // basically delegates to ole32's GetRunningObjectTable.  The object table
 845   // is then used to determine if the moniker is already running and via
 846   // that mechanism is associated with the same internet request as has already
 847   // been issued.
 848
 849   // TODO(tommi): See if we can get HlinkSimpleNavigateToMoniker to work
 850   // instead.  Looks like we'll need to support IHTMLDocument2 (get_URL in
 851   // particular), access to IWebBrowser2 etc.
 852   // HlinkSimpleNavigateToMoniker(moniker, url, NULL, host, bind_context,
 853   //                              NULL, 0, 0);
 854
 855   base::win::ScopedComPtr<IUriContainer> uri_container;
 856   hr = uri_container.QueryFrom(moniker);
 857
 858   base::win::ScopedVariant headers_var;
 859   if (headers && headers[0])
 860     headers_var.Set(headers);
 861
 862   if (uri_container) {
 863     // IE7 and IE8.
 864     const IID* interface_ids[] = {
 865       &IID_IWebBrowserPriv2IE7,
 866       &IID_IWebBrowserPriv2IE8,
 867       &IID_IWebBrowserPriv2IE8XP,
 868       &IID_IWebBrowserPriv2IE8XPBeta,
 869     };
 870
 871     base::win::ScopedComPtr<IWebBrowserPriv2Common, NULL> browser_priv2;
 872     for (int i = 0; i < arraysize(interface_ids) && browser_priv2 == NULL;
 873          ++i) {
 874       hr = web_browser2.QueryInterface(*interface_ids[i],
 875           reinterpret_cast<void**>(browser_priv2.Receive()));
 876     }
 877
 878     DCHECK(browser_priv2);
 879
 880     if (browser_priv2) {
 881       base::win::ScopedComPtr<IUri> uri_obj;
 882       uri_container->GetIUri(uri_obj.Receive());
 883       DCHECK(uri_obj);
 884
 885       if (GetIEVersion() < IE_9) {
 886         hr = browser_priv2->NavigateWithBindCtx2(
 887                 uri_obj, flags, NULL, post_data_variant.AsInput(),
 888                 headers_var.AsInput(), bind_ctx,
 889                 const_cast<wchar_t*>(fragment));
 890       } else {
 891         IWebBrowserPriv2CommonIE9* browser_priv2_ie9 =
 892             reinterpret_cast<IWebBrowserPriv2CommonIE9*>(browser_priv2.get());
 893         hr = browser_priv2_ie9->NavigateWithBindCtx2(
 894                 uri_obj, flags, NULL, post_data_variant.AsInput(),
 895                 headers_var.AsInput(), bind_ctx,
 896                 const_cast<wchar_t*>(fragment), 0);
 897       }
 898       DLOG_IF(WARNING, FAILED(hr))
 899           << base::StringPrintf(L"NavigateWithBindCtx2 0x%08X", hr);
 900     }
 901   } else {
 902     // IE6
 903     LPOLESTR url = NULL;
 904     if (SUCCEEDED(hr = moniker->GetDisplayName(bind_ctx, NULL, &url))) {
 905       DVLOG(1) << __FUNCTION__ << " " << url;
 906       base::win::ScopedComPtr<IWebBrowserPriv> browser_priv;
 907       if (SUCCEEDED(hr = browser_priv.QueryFrom(web_browser2))) {
 908         GURL target_url(url);
 909         // On IE6 if the original URL has a fragment then the navigation
 910         // attempt is ignored. To workaround this we strip the fragment from
 911         // the url and initiate the navigation. When the active document loads
 912         // we retrieve the original url with the fragment from the Navigation
 913         // manager and use it.
 914         if (target_url.has_ref()) {
 915           url_parse::Component comp;
 916           GURL::Replacements replacements;
 917           replacements.SetRef("", comp);
 918
 919           target_url = target_url.ReplaceComponents(replacements);
 920           fragment = NULL;
 921         }
 922
 923         base::win::ScopedVariant var_url(UTF8ToWide(target_url.spec()).c_str());
 924         hr = browser_priv->NavigateWithBindCtx(var_url.AsInput(), flags, NULL,
 925                                                post_data_variant.AsInput(),
 926                                                headers_var.AsInput(), bind_ctx,
 927                                                const_cast<wchar_t*>(fragment));
 928         DLOG_IF(WARNING, FAILED(hr))
 929             << base::StringPrintf(L"NavigateWithBindCtx 0x%08X", hr);
 930       } else {
 931         NOTREACHED();
 932       }
 933       ::CoTaskMemFree(url);
 934     } else {
 935       DLOG(ERROR) << base::StringPrintf("GetDisplayName: 0x%08X", hr);
 936     }
 937   }
 938
 939   return hr;
 940 }
 941
 942 void MarkBrowserOnThreadForCFNavigation(IBrowserService* browser) {
 943   DCHECK(browser != NULL);
 944   DCHECK(g_tls_browser_for_cf_navigation.Pointer()->Get() == NULL ||
 945          g_tls_browser_for_cf_navigation.Pointer()->Get() == browser);
 946   g_tls_browser_for_cf_navigation.Pointer()->Set(browser);
 947 }
 948
 949 bool CheckForCFNavigation(IBrowserService* browser, bool clear_flag) {
 950   DCHECK(browser);
 951   bool ret = (g_tls_browser_for_cf_navigation.Pointer()->Get() == browser);
 952   if (ret && clear_flag)
 953     g_tls_browser_for_cf_navigation.Pointer()->Set(NULL);
 954   return ret;
 955 }
 956
 957 bool IsValidUrlScheme(const GURL& url, bool is_privileged) {
 958   if (url.is_empty())
 959     return false;
 960
 961   if (url.SchemeIs(chrome::kHttpScheme) ||
 962       url.SchemeIs(chrome::kHttpsScheme) ||
 963       url.SchemeIs(chrome::kAboutScheme))
 964     return true;
 965
 966   // Additional checking for view-source. Allow only http and https
 967   // URLs in view source.
 968   if (url.SchemeIs(chrome::kViewSourceScheme)) {
 969     GURL sub_url(url.path());
 970     if (sub_url.SchemeIs(chrome::kHttpScheme) ||
 971         sub_url.SchemeIs(chrome::kHttpsScheme))
 972       return true;
 973     else
 974       return false;
 975   }
 976
 977   if (is_privileged &&
 978       (url.SchemeIs(chrome::kDataScheme) ||
 979        url.SchemeIs(extensions::kExtensionScheme)))
 980     return true;
 981
 982   return false;
 983 }
 984
 985 std::string GetRawHttpHeaders(IWinInetHttpInfo* info) {
 986   DCHECK(info);
 987
 988   std::string buffer;
 989
 990   DWORD size = 0;
 991   DWORD flags = 0;
 992   DWORD reserved = 0;
 993   HRESULT hr = info->QueryInfo(HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &size,
 994                                &flags, &reserved);
 995   if (!size) {
 996     DLOG(WARNING) << "Failed to query HTTP headers size. Error: " << hr;
 997   } else {
 998     buffer.resize(size + 1);
 999     hr = info->QueryInfo(HTTP_QUERY_RAW_HEADERS_CRLF, &buffer[0],
1000                          &size, &flags, &reserved);
1001     if (FAILED(hr)) {
1002       DLOG(WARNING) << "Failed to query HTTP headers. Error: " << hr;
1003     }
1004   }
1005
1006   return buffer;
1007 }
1008
1009 bool IsSubFrameRequest(IUnknown* service_provider) {
1010   DCHECK(service_provider);
1011
1012   // We need to be able to get at an IWebBrowser2 if we are to decide whether
1013   // this request originates from a non-top-level frame.
1014   base::win::ScopedComPtr<IWebBrowser2> web_browser;
1015   HRESULT hr = DoQueryService(IID_ITargetFrame2, service_provider,
1016                               web_browser.Receive());
1017
1018   bool is_sub_frame_request = false;
1019   if (web_browser) {
1020     // Now check to see if we are in a sub-frame.
1021     base::win::ScopedComPtr<IHTMLWindow2> current_frame, parent_frame;
1022     hr = DoQueryService(IID_IHTMLWindow2, service_provider,
1023                         current_frame.Receive());
1024     if (current_frame) {
1025       // Only the top level window will return self when get_parent is called.
1026       current_frame->get_parent(parent_frame.Receive());
1027       if (parent_frame != current_frame) {
1028         DVLOG(1) << "Sub frame detected";
1029         is_sub_frame_request = true;
1030       }
1031     }
1032   } else {
1033     DVLOG(1) << "IsSubFrameRequest - no IWebBrowser2";
1034     is_sub_frame_request = true;
1035   }
1036
1037   return is_sub_frame_request;
1038 }
1039
1040 bool IsHeadlessMode() {
1041   bool headless = GetConfigBool(false, kChromeFrameHeadlessMode);
1042   return headless;
1043 }
1044
1045 bool IsAccessibleMode() {
1046   bool accessible = GetConfigBool(false, kChromeFrameAccessibleMode);
1047   return accessible;
1048 }
1049
1050 bool IsUnpinnedMode() {
1051   // We only check this value once and then cache it since changing the registry
1052   // once we've pinned the DLL won't have any effect.
1053   static bool unpinned = GetConfigBool(false, kChromeFrameUnpinnedMode);
1054   return unpinned;
1055 }
1056
1057 std::wstring GetActualUrlFromMoniker(IMoniker* moniker,
1058                                      IBindCtx* bind_context,
1059                                      const std::wstring& bho_url) {
1060   CComHeapPtr<WCHAR> display_name;
1061   moniker->GetDisplayName(bind_context, NULL, &display_name);
1062   std::wstring moniker_url = display_name;
1063
1064   GURL parsed_url(WideToUTF8(bho_url));
1065   if (!parsed_url.has_ref())
1066     return moniker_url;
1067
1068   if (StartsWith(bho_url, moniker_url, false) &&
1069       bho_url[moniker_url.length()] == L'#')
1070     return bho_url;
1071
1072   return moniker_url;
1073 }
1074
1075 bool IsTopLevelWindow(HWND window) {
1076   long style = GetWindowLong(window, GWL_STYLE);  // NOLINT
1077   if (!(style & WS_CHILD))
1078     return true;
1079
1080   HWND parent = GetParent(window);
1081   return !parent || (parent == GetDesktopWindow());
1082 }
1083
1084 HRESULT RewindStream(IStream* stream) {
1085   HRESULT hr = E_POINTER;
1086   if (stream) {
1087     LARGE_INTEGER zero = {0};
1088     ULARGE_INTEGER new_pos = {0};
1089     hr = stream->Seek(zero, STREAM_SEEK_SET, &new_pos);
1090   }
1091
1092   return hr;
1093 }
1094
1095 std::wstring GuidToString(const GUID& guid) {
1096   std::wstring ret;
1097   ::StringFromGUID2(guid, WriteInto(&ret, 39), 39);
1098   return ret;
1099 }
1100
1101 int32 MapCookieStateToCookieAction(InternetCookieState cookie_state) {
1102   int32 cookie_action = COOKIEACTION_NONE;
1103
1104   switch (cookie_state) {
1105     case COOKIE_STATE_UNKNOWN:
1106       cookie_action = COOKIEACTION_NONE;
1107       break;
1108     case COOKIE_STATE_ACCEPT:
1109       cookie_action = COOKIEACTION_ACCEPT;
1110       break;
1111     case COOKIE_STATE_LEASH:
1112       cookie_action = COOKIEACTION_LEASH;
1113       break;
1114     case COOKIE_STATE_DOWNGRADE:
1115       cookie_action = COOKIEACTION_DOWNGRADE;
1116       break;
1117     case COOKIE_STATE_REJECT:
1118       cookie_action = COOKIEACTION_REJECT;
1119       break;
1120     default:
1121       cookie_action = COOKIEACTION_REJECT;
1122       break;
1123   }
1124   return cookie_action;
1125 }
1126
1127 GURL GetUrlWithoutFragment(const wchar_t* url) {
1128   GURL parsed_url(url);
1129
1130   if (parsed_url.has_ref()) {
1131     url_parse::Component comp;
1132     GURL::Replacements replacements;
1133     replacements.SetRef("", comp);
1134
1135     parsed_url = parsed_url.ReplaceComponents(replacements);
1136   }
1137   return parsed_url;
1138 }
1139
1140 bool CompareUrlsWithoutFragment(const wchar_t* url1, const wchar_t* url2) {
1141   GURL parsed_url1 = GetUrlWithoutFragment(url1);
1142   GURL parsed_url2 = GetUrlWithoutFragment(url2);
1143   return parsed_url1 == parsed_url2;
1144 }
1145
1146 std::string FindReferrerFromHeaders(const wchar_t* headers,
1147                                      const wchar_t* additional_headers) {
1148   std::string referrer;
1149
1150   const wchar_t* both_headers[] = { headers, additional_headers };
1151   for (int i = 0; referrer.empty() && i < arraysize(both_headers); ++i) {
1152     if (!both_headers[i])
1153       continue;
1154     std::string raw_headers_utf8 = WideToUTF8(both_headers[i]);
1155     net::HttpUtil::HeadersIterator it(raw_headers_utf8.begin(),
1156                                       raw_headers_utf8.end(), "\r\n");
1157     while (it.GetNext()) {
1158       if (LowerCaseEqualsASCII(it.name(), "referer")) {
1159         referrer = it.values();
1160         break;
1161       }
1162     }
1163   }
1164
1165   return referrer;
1166 }
1167
1168 std::string GetHttpHeadersFromBinding(IBinding* binding) {
1169   if (binding == NULL) {
1170     DLOG(WARNING) << "GetHttpResponseStatus - no binding_";
1171     return std::string();
1172   }
1173
1174   base::win::ScopedComPtr<IWinInetHttpInfo> info;
1175   if (FAILED(info.QueryFrom(binding))) {
1176     DLOG(WARNING) << "Failed to QI for IWinInetHttpInfo";
1177     return std::string();
1178   }
1179
1180   return GetRawHttpHeaders(info);
1181 }
1182
1183 int GetHttpResponseStatusFromBinding(IBinding* binding) {
1184   DVLOG(1) << __FUNCTION__;
1185   if (binding == NULL) {
1186     DLOG(WARNING) << "GetHttpResponseStatus - no binding_";
1187     return 0;
1188   }
1189
1190   int http_status = 0;
1191
1192   base::win::ScopedComPtr<IWinInetHttpInfo> info;
1193   if (SUCCEEDED(info.QueryFrom(binding))) {
1194     char status[10] = {0};
1195     DWORD buf_size = sizeof(status);
1196     DWORD flags = 0;
1197     DWORD reserved = 0;
1198     if (SUCCEEDED(info->QueryInfo(HTTP_QUERY_STATUS_CODE, status, &buf_size,
1199                                   &flags, &reserved))) {
1200       base::StringToInt(status, &http_status);
1201     } else {
1202       NOTREACHED() << "Failed to get HTTP status";
1203     }
1204   } else {
1205     NOTREACHED() << "failed to get IWinInetHttpInfo from binding_";
1206   }
1207
1208   return http_status;
1209 }
1210
1211 CLIPFORMAT GetTextHtmlClipboardFormat() {
1212   static const CLIPFORMAT text_html = RegisterClipboardFormat(CFSTR_MIME_HTML);
1213   return text_html;
1214 }
1215
1216 bool IsTextHtmlMimeType(const wchar_t* mime_type) {
1217   return IsTextHtmlClipFormat(RegisterClipboardFormatW(mime_type));
1218 }
1219
1220 bool IsTextHtmlClipFormat(CLIPFORMAT cf) {
1221   return cf == GetTextHtmlClipboardFormat();
1222 }
1223
1224 bool IsSystemProcess() {
1225   bool is_system = false;
1226   CAccessToken process_token;
1227   if (process_token.GetProcessToken(TOKEN_QUERY, GetCurrentProcess())) {
1228     CSid logon_sid;
1229     if (process_token.GetUser(&logon_sid)) {
1230       is_system = logon_sid == Sids::System();
1231     }
1232   }
1233   return is_system;
1234 }
1235
1236
1237 std::string BindStatus2Str(ULONG bind_status) {
1238   std::string s;
1239   static const char* const bindstatus_txt[] = {
1240     "BINDSTATUS_FINDINGRESOURCE",
1241     "BINDSTATUS_CONNECTING",
1242     "BINDSTATUS_REDIRECTING",
1243     "BINDSTATUS_BEGINDOWNLOADDATA",
1244     "BINDSTATUS_DOWNLOADINGDATA",
1245     "BINDSTATUS_ENDDOWNLOADDATA",
1246     "BINDSTATUS_BEGINDOWNLOADCOMPONENTS",
1247     "BINDSTATUS_INSTALLINGCOMPONENTS",
1248     "BINDSTATUS_ENDDOWNLOADCOMPONENTS",
1249     "BINDSTATUS_USINGCACHEDCOPY",
1250     "BINDSTATUS_SENDINGREQUEST",
1251     "BINDSTATUS_CLASSIDAVAILABLE",
1252     "BINDSTATUS_MIMETYPEAVAILABLE",
1253     "BINDSTATUS_CACHEFILENAMEAVAILABLE",
1254     "BINDSTATUS_BEGINSYNCOPERATION",
1255     "BINDSTATUS_ENDSYNCOPERATION",
1256     "BINDSTATUS_BEGINUPLOADDATA",
1257     "BINDSTATUS_UPLOADINGDATA",
1258     "BINDSTATUS_ENDUPLOADINGDATA",
1259     "BINDSTATUS_PROTOCOLCLASSID",
1260     "BINDSTATUS_ENCODING",
1261     "BINDSTATUS_VERFIEDMIMETYPEAVAILABLE",
1262     "BINDSTATUS_CLASSINSTALLLOCATION",
1263     "BINDSTATUS_DECODING",
1264     "BINDSTATUS_LOADINGMIMEHANDLER",
1265     "BINDSTATUS_CONTENTDISPOSITIONATTACH",
1266     "BINDSTATUS_FILTERREPORTMIMETYPE",
1267     "BINDSTATUS_CLSIDCANINSTANTIATE",
1268     "BINDSTATUS_IUNKNOWNAVAILABLE",
1269     "BINDSTATUS_DIRECTBIND",
1270     "BINDSTATUS_RAWMIMETYPE",
1271     "BINDSTATUS_PROXYDETECTING",
1272     "BINDSTATUS_ACCEPTRANGES",
1273     "BINDSTATUS_COOKIE_SENT",
1274     "BINDSTATUS_COMPACT_POLICY_RECEIVED",
1275     "BINDSTATUS_COOKIE_SUPPRESSED",
1276     "BINDSTATUS_COOKIE_STATE_UNKNOWN",
1277     "BINDSTATUS_COOKIE_STATE_ACCEPT",
1278     "BINDSTATUS_COOKIE_STATE_REJECT",
1279     "BINDSTATUS_COOKIE_STATE_PROMPT",
1280     "BINDSTATUS_COOKIE_STATE_LEASH",
1281     "BINDSTATUS_COOKIE_STATE_DOWNGRADE",
1282     "BINDSTATUS_POLICY_HREF",
1283     "BINDSTATUS_P3P_HEADER",
1284     "BINDSTATUS_SESSION_COOKIE_RECEIVED",
1285     "BINDSTATUS_PERSISTENT_COOKIE_RECEIVED",
1286     "BINDSTATUS_SESSION_COOKIES_ALLOWED",
1287     "BINDSTATUS_CACHECONTROL",
1288     "BINDSTATUS_CONTENTDISPOSITIONFILENAME",
1289     "BINDSTATUS_MIMETEXTPLAINMISMATCH",
1290     "BINDSTATUS_PUBLISHERAVAILABLE",
1291     "BINDSTATUS_DISPLAYNAMEAVAILABLE",
1292     "BINDSTATUS_SSLUX_NAVBLOCKED",
1293     "BINDSTATUS_SERVER_MIMETYPEAVAILABLE",
1294     "BINDSTATUS_SNIFFED_CLASSIDAVAILABLE",
1295     "BINDSTATUS_64BIT_PROGRESS"
1296   };
1297   if (bind_status >= 1 && bind_status <= BINDSTATUS_64BIT_PROGRESS)
1298     s = bindstatus_txt[bind_status - 1];
1299   else
1300     s = base::StringPrintf("UnDoc[%#x]", bind_status);
1301   return s;
1302 }
1303
1304 std::string PiFlags2Str(DWORD flags) {
1305 #define ADD_PI_FLAG(x)  \
1306   if (flags & x) { \
1307     s.append(#x ## " "); \
1308     flags &= ~x; \
1309   }
1310
1311   std::string s = " flags ";
1312   ADD_PI_FLAG(PI_PARSE_URL);
1313   ADD_PI_FLAG(PI_FILTER_MODE);
1314   ADD_PI_FLAG(PI_FORCE_ASYNC);
1315   ADD_PI_FLAG(PI_USE_WORKERTHREAD);
1316   ADD_PI_FLAG(PI_MIMEVERIFICATION);
1317   ADD_PI_FLAG(PI_CLSIDLOOKUP);
1318   ADD_PI_FLAG(PI_DATAPROGRESS);
1319   ADD_PI_FLAG(PI_SYNCHRONOUS);
1320   ADD_PI_FLAG(PI_APARTMENTTHREADED);
1321   ADD_PI_FLAG(PI_CLASSINSTALL);
1322   ADD_PI_FLAG(PI_PASSONBINDCTX);
1323   ADD_PI_FLAG(PI_NOMIMEHANDLER);
1324   ADD_PI_FLAG(PI_LOADAPPDIRECT);
1325   ADD_PI_FLAG(PD_FORCE_SWITCH);
1326   ADD_PI_FLAG(PI_PREFERDEFAULTHANDLER);
1327
1328   if (flags)
1329     s += base::StringPrintf("+UnDoc[%#x]", flags);
1330   return s;
1331 #undef ADD_PI_FLAG
1332 }
1333
1334 std::string Bscf2Str(DWORD flags) {
1335 #define ADD_BSCF_FLAG(x)  \
1336   if (flags & x) {\
1337     s.append(#x ## " "); \
1338     flags &= ~x; \
1339   }
1340
1341   std::string s = " flags ";
1342   ADD_BSCF_FLAG(BSCF_FIRSTDATANOTIFICATION)
1343   ADD_BSCF_FLAG(BSCF_INTERMEDIATEDATANOTIFICATION)
1344   ADD_BSCF_FLAG(BSCF_LASTDATANOTIFICATION)
1345   ADD_BSCF_FLAG(BSCF_DATAFULLYAVAILABLE)
1346   ADD_BSCF_FLAG(BSCF_AVAILABLEDATASIZEUNKNOWN)
1347   ADD_BSCF_FLAG(BSCF_SKIPDRAINDATAFORFILEURLS)
1348   ADD_BSCF_FLAG(BSCF_64BITLENGTHDOWNLOAD)
1349
1350   if (flags)
1351     s += base::StringPrintf("+UnDoc[%#x]", flags);
1352   return s;
1353 #undef ADD_BSCF_FLAG
1354 }
1355
1356 // Reads data from a stream into a string.
1357 HRESULT ReadStream(IStream* stream, size_t size, std::string* data) {
1358   DCHECK(stream);
1359   DCHECK_GT(size, 0u);
1360   DCHECK(data);
1361
1362   DWORD read = 0;
1363   HRESULT hr = stream->Read(WriteInto(data, size + 1), size, &read);
1364   DCHECK(hr == S_OK || hr == S_FALSE || hr == E_PENDING);
1365   if (read) {
1366     data->erase(read);
1367     DCHECK_EQ(read, data->length());
1368   } else {
1369     data->clear();
1370     // Return S_FALSE if the underlying stream returned S_OK and zero bytes.
1371     if (hr == S_OK)
1372       hr = S_FALSE;
1373   }
1374
1375   return hr;
1376 }
1377
1378 ChromeFrameUrl::ChromeFrameUrl() {
1379   Reset();
1380 }
1381
1382 bool ChromeFrameUrl::Parse(const std::wstring& url) {
1383   Reset();
1384   parsed_url_ = GURL(url);
1385
1386   if (parsed_url_.is_empty())
1387     return false;
1388
1389   is_chrome_protocol_ = parsed_url_.SchemeIs(kGCFProtocol);
1390   if (is_chrome_protocol_) {
1391     parsed_url_ = GURL(url.c_str() + lstrlen(kChromeProtocolPrefix));
1392     return true;
1393   }
1394
1395   return ParseAttachExternalTabUrl();
1396 }
1397
1398 bool ChromeFrameUrl::ParseAttachExternalTabUrl() {
1399   std::string query = parsed_url_.query();
1400   if (!StartsWithASCII(query, kAttachExternalTabPrefix, false)) {
1401     return parsed_url_.is_valid();
1402   }
1403
1404   attach_to_external_tab_ = true;
1405   base::StringTokenizer tokenizer(query, "&");
1406   // Skip over kChromeAttachExternalTabPrefix
1407   tokenizer.GetNext();
1408   // Read the following items in order.
1409   // 1. cookie
1410   // 2. disposition
1411   // 3. dimension.x
1412   // 4. dimension.y
1413   // 5. dimension.width
1414   // 6. dimension.height.
1415   if (tokenizer.GetNext()) {
1416     char* end_ptr = 0;
1417     cookie_ = _strtoui64(tokenizer.token().c_str(), &end_ptr, 10);
1418   } else {
1419     return false;
1420   }
1421
1422   if (tokenizer.GetNext()) {
1423     disposition_ = atoi(tokenizer.token().c_str());
1424   } else {
1425     return false;
1426   }
1427
1428   if (tokenizer.GetNext()) {
1429     dimensions_.set_x(atoi(tokenizer.token().c_str()));
1430   } else {
1431     return false;
1432   }
1433
1434   if (tokenizer.GetNext()) {
1435     dimensions_.set_y(atoi(tokenizer.token().c_str()));
1436   } else {
1437     return false;
1438   }
1439
1440   if (tokenizer.GetNext()) {
1441     dimensions_.set_width(atoi(tokenizer.token().c_str()));
1442   } else {
1443     return false;
1444   }
1445
1446   if (tokenizer.GetNext()) {
1447     dimensions_.set_height(atoi(tokenizer.token().c_str()));
1448   } else {
1449     return false;
1450   }
1451
1452   if (tokenizer.GetNext()) {
1453     profile_name_ = tokenizer.token();
1454     // Escape out special characters like %20, etc.
1455     profile_name_ = net::UnescapeURLComponent(profile_name_,
1456         net::UnescapeRule::SPACES | net::UnescapeRule::URL_SPECIAL_CHARS);
1457   } else {
1458     return false;
1459   }
1460
1461   return true;
1462 }
1463
1464 void ChromeFrameUrl::Reset() {
1465   attach_to_external_tab_ = false;
1466   is_chrome_protocol_ = false;
1467   cookie_ = 0;
1468   dimensions_.SetRect(0, 0, 0, 0);
1469   disposition_ = 0;
1470   profile_name_.clear();
1471 }
1472
1473 bool CanNavigate(const GURL& url,
1474                  NavigationConstraints* navigation_constraints) {
1475   if (!url.is_valid()) {
1476     DLOG(ERROR) << "Invalid URL passed to InitiateNavigation: " << url;
1477     return false;
1478   }
1479
1480   if (!navigation_constraints) {
1481     NOTREACHED() << "Invalid NavigationConstraints passed in";
1482     return false;
1483   }
1484
1485   // No sanity checks if unsafe URLs are allowed
1486   if (navigation_constraints->AllowUnsafeUrls())
1487     return true;
1488
1489   if (!navigation_constraints->IsSchemeAllowed(url)) {
1490     DLOG(WARNING) << __FUNCTION__ << " Disallowing navigation to url: " << url;
1491     return false;
1492   }
1493
1494   if (!navigation_constraints->IsZoneAllowed(url)) {
1495     DLOG(WARNING) << __FUNCTION__
1496                   << " Disallowing navigation to restricted url: " << url;
1497     return false;
1498   }
1499   return true;
1500 }
1501
1502 void WaitWithMessageLoop(HANDLE* handles, int count, DWORD timeout) {
1503   base::Time now = base::Time::Now();
1504   base::Time wait_until = now + base::TimeDelta::FromMilliseconds(timeout);
1505
1506   while (wait_until >= now) {
1507     base::TimeDelta wait_time = wait_until - now;
1508     DWORD wait = MsgWaitForMultipleObjects(
1509         count, handles, FALSE, static_cast<DWORD>(wait_time.InMilliseconds()),
1510         QS_ALLINPUT);
1511     switch (wait) {
1512       case WAIT_OBJECT_0:
1513       case WAIT_TIMEOUT:
1514        return;
1515
1516       case WAIT_OBJECT_0 + 1: {
1517         MSG msg = {0};
1518         while (PeekMessage(&msg, NULL, 0, 0, PM_REMOVE)) {
1519           TranslateMessage(&msg);
1520           DispatchMessage(&msg);
1521         }
1522         break;
1523       }
1524
1525       default: {
1526         NOTREACHED() << "Unexpected return from MsgWaitForMultipleObjects :"
1527                      << wait;
1528         return;
1529       }
1530     }
1531     now = base::Time::Now();
1532   }
1533 }
1534
1535 // Returns -1 if no directive is found, std::numeric_limits<int>::max() if the
1536 // directive matches all IE versions ('Chrome=1') or the maximum IE version
1537 // matched ('Chrome=IE7' => 7)
1538 int GetXUaCompatibleDirective(const std::string& directive, char delimiter) {
1539   net::HttpUtil::NameValuePairsIterator name_value_pairs(directive.begin(),
1540                                                          directive.end(),
1541                                                          delimiter);
1542
1543   // Loop through the values until a valid 'Chrome=<FILTER>' entry is found
1544   while (name_value_pairs.GetNext()) {
1545     if (!LowerCaseEqualsASCII(name_value_pairs.name_begin(),
1546                              name_value_pairs.name_end(),
1547                              "chrome")) {
1548       continue;
1549     }
1550     std::string::const_iterator filter_begin = name_value_pairs.value_begin();
1551     std::string::const_iterator filter_end = name_value_pairs.value_end();
1552
1553     size_t filter_length = filter_end - filter_begin;
1554
1555     if (filter_length == 1 && *filter_begin == '1') {
1556       return std::numeric_limits<int>::max();
1557     }
1558
1559     if (filter_length < 3 ||
1560         !LowerCaseEqualsASCII(filter_begin, filter_begin + 2, "ie") ||
1561         !isdigit(*(filter_begin + 2))) {  // ensure no leading +/-
1562       continue;
1563     }
1564
1565     int header_ie_version = 0;
1566     if (!base::StringToInt(base::StringPiece(filter_begin + 2,
1567                                              filter_end),
1568                            &header_ie_version) ||
1569         header_ie_version == 0) {  // ensure it's not a sequence of 0's
1570       continue;
1571     }
1572
1573     // The first valid directive we find wins, whether it matches or not
1574     return header_ie_version;
1575   }
1576   return -1;
1577 }
1578
1579 bool CheckXUaCompatibleDirective(const std::string& directive,
1580                                  int ie_major_version) {
1581   int header_ie_version = GetXUaCompatibleDirective(directive, ';');
1582   if (header_ie_version == -1) {
1583     header_ie_version = GetXUaCompatibleDirective(directive, ',');
1584   }
1585   return header_ie_version >= ie_major_version;
1586 }
1587
1588 void EnumerateKeyValues(HKEY parent_key, const wchar_t* sub_key_name,
1589                         std::vector<std::wstring>* values) {
1590   DCHECK(values);
1591   base::win::RegistryValueIterator url_list(parent_key, sub_key_name);
1592   while (url_list.Valid()) {
1593     values->push_back(url_list.Value());
1594     ++url_list;
1595   }
1596 }
1597
1598 std::wstring GetCurrentModuleVersion() {
1599   scoped_ptr<FileVersionInfo> module_version_info(
1600       FileVersionInfo::CreateFileVersionInfoForCurrentModule());
1601   DCHECK(module_version_info.get() != NULL);
1602   return module_version_info->file_version();
1603 }
1604
1605 bool IsChromeFrameDocument(IWebBrowser2* web_browser) {
1606   if (!web_browser)
1607     return false;
1608
1609   base::win::ScopedComPtr<IDispatch> doc;
1610   web_browser->get_Document(doc.Receive());
1611   if (doc) {
1612     // Detect if CF is rendering based on whether the document is a
1613     // ChromeActiveDocument. Detecting based on hwnd is problematic as
1614     // the CF Active Document window may not have been created yet.
1615     base::win::ScopedComPtr<IChromeFrame> chrome_frame;
1616     chrome_frame.QueryFrom(doc);
1617     return chrome_frame.get() != NULL;
1618   }
1619   return false;
1620 }
1621
1622 bool IncreaseWinInetConnections(DWORD connections) {
1623   static bool wininet_connection_count_updated = false;
1624   if (wininet_connection_count_updated) {
1625     return true;
1626   }
1627
1628   static int connection_options[] = {
1629     INTERNET_OPTION_MAX_CONNS_PER_SERVER,
1630     INTERNET_OPTION_MAX_CONNS_PER_1_0_SERVER,
1631   };
1632
1633   BOOL ret = FALSE;
1634
1635   for (int option_index = 0; option_index < arraysize(connection_options);
1636        ++option_index) {
1637     DWORD connection_value_size = sizeof(DWORD);
1638     DWORD current_connection_limit = 0;
1639     InternetQueryOption(NULL, connection_options[option_index],
1640                         &current_connection_limit, &connection_value_size);
1641     if (current_connection_limit > connections) {
1642       continue;
1643     }
1644
1645     ret = InternetSetOption(NULL, connection_options[option_index],
1646                             &connections, connection_value_size);
1647     if (!ret) {
1648       return false;
1649     }
1650   }
1651   wininet_connection_count_updated = true;
1652   return true;
1653 }
1654
1655 void GetChromeFrameProfilePath(const string16& profile_name,
1656                                base::FilePath* profile_path) {
1657   chrome::GetChromeFrameUserDataDirectory(profile_path);
1658   *profile_path = profile_path->Append(profile_name);
1659   DVLOG(1) << __FUNCTION__ << ": " << profile_path->value();
1660 }