Block non-sandboxed plugins.

Run Chrome with --block-nonsandboxed-plugins to enable.

BUG=47730
TEST=See bug description for manual test.

Review URL: http://codereview.chromium.org/3040034

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@55041 0039d316-1c4b-4281-b951-d872f2087c98

17 files changed, 243 insertions, 59 deletions

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index b51a7de..d0d7464 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -6503,6 +6503,9 @@ Keep your key file in a safe place. You will need it to create new versions of y
       <message name="IDS_PLUGININSTALLER_PROBLEMSINSTALLING" desc="Infobar text for link to help center">
         Problems installing?
       </message>
+      <message name="IDS_PLUGIN_BLOCKED_PROMPT" desc="Info Bar message when a non-sandboxed plugin was blocked">
+        The <ph name="PLUGIN_NAME">$1<ex>Flash</ex></ph> plug-in was blocked on this site because it could access your computer directly.
+      </message>
       <message name="IDS_PLUGIN_CRASHED_PROMPT" desc="Info Bar message to notify about a crashed plugin">
         The following plug-in has crashed: <ph name="PLUGIN_NAME">$1<ex>Shockwave</ex></ph>
       </message>
diff --git a/chrome/browser/blocked_plugin_manager.cc b/chrome/browser/blocked_plugin_manager.cc
new file mode 100644
index 0000000..e0290c5
--- /dev/null
+++ b/chrome/browser/blocked_plugin_manager.cc
@@ -0,0 +1,61 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/blocked_plugin_manager.h"
+
+#include "app/l10n_util.h"
+#include "app/resource_bundle.h"
+#include "base/utf_string_conversions.h"
+#include "chrome/browser/renderer_host/render_view_host.h"
+#include "chrome/browser/tab_contents/tab_contents.h"
+#include "grit/generated_resources.h"
+#include "grit/theme_resources.h"
+
+BlockedPluginManager::BlockedPluginManager(TabContents* tab_contents)
+    : ConfirmInfoBarDelegate(tab_contents),
+      tab_contents_(tab_contents) { }
+
+void BlockedPluginManager::OnNonSandboxedPluginBlocked(const string16& name) {
+  name_ = name;
+  tab_contents_->AddInfoBar(this);
+}
+
+void BlockedPluginManager::OnBlockedPluginLoaded() {
+  tab_contents_->RemoveInfoBar(this);
+}
+
+int BlockedPluginManager::GetButtons() const {
+  return BUTTON_OK;
+}
+
+std::wstring BlockedPluginManager::GetButtonLabel(InfoBarButton button) const {
+  if (button == BUTTON_OK)
+    return l10n_util::GetString(IDS_PLUGIN_LOAD);
+  return ConfirmInfoBarDelegate::GetButtonLabel(button);
+}
+
+std::wstring BlockedPluginManager::GetMessageText() const {
+  return UTF16ToWide(l10n_util::GetStringFUTF16(IDS_PLUGIN_BLOCKED_PROMPT,
+                                                name_));
+}
+
+std::wstring BlockedPluginManager::GetLinkText() {
+  return l10n_util::GetString(IDS_LEARN_MORE);
+}
+
+SkBitmap* BlockedPluginManager::GetIcon() const {
+  return ResourceBundle::GetSharedInstance().GetBitmapNamed(
+      IDR_INFOBAR_PLUGIN_INSTALL);
+}
+
+bool BlockedPluginManager::Accept() {
+  tab_contents_->render_view_host()->LoadBlockedPlugins();
+  return true;
+}
+
+bool BlockedPluginManager::LinkClicked(WindowOpenDisposition disposition) {
+  // TODO(bauerb): Navigate to a help page explaining why we blocked the plugin,
+  // once we have one.
+  return false;
+}
diff --git a/chrome/browser/blocked_plugin_manager.h b/chrome/browser/blocked_plugin_manager.h
new file mode 100644
index 0000000..e9f9506
--- /dev/null
+++ b/chrome/browser/blocked_plugin_manager.h
@@ -0,0 +1,36 @@
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_BLOCKED_PLUGIN_MANAGER_H_
+#define CHROME_BROWSER_BLOCKED_PLUGIN_MANAGER_H_
+
+#include "chrome/browser/renderer_host/render_view_host_delegate.h"
+#include "chrome/browser/tab_contents/infobar_delegate.h"
+
+class TabContents;
+
+class BlockedPluginManager : public RenderViewHostDelegate::BlockedPlugin,
+                             public ConfirmInfoBarDelegate {
+ public:
+  explicit BlockedPluginManager(TabContents* tab_contents);
+
+  virtual void OnNonSandboxedPluginBlocked(const string16& name);
+  virtual void OnBlockedPluginLoaded();
+
+  // ConfirmInfoBarDelegate methods
+  virtual int GetButtons() const;
+  virtual std::wstring GetButtonLabel(InfoBarButton button) const;
+  virtual std::wstring GetMessageText() const;
+  virtual std::wstring GetLinkText();
+  virtual SkBitmap* GetIcon() const;
+  virtual bool Accept();
+  virtual bool LinkClicked(WindowOpenDisposition disposition);
+
+ private:
+  // Owns us.
+  TabContents* tab_contents_;
+  string16 name_;
+};
+
+#endif  // CHROME_BROWSER_BLOCKED_PLUGIN_MANAGER_H_
diff --git a/chrome/browser/renderer_host/browser_render_process_host.cc b/chrome/browser/renderer_host/browser_render_process_host.cc
index 36fb005..95cb7d4 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.cc
+++ b/chrome/browser/renderer_host/browser_render_process_host.cc
@@ -573,6 +573,7 @@ void BrowserRenderProcessHost::PropagateBrowserCommandLineToRenderer(
 #endif
     switches::kRemoteShellPort,
     switches::kEnablePepperTesting,
+    switches::kBlockNonSandboxedPlugins,
     switches::kEnableRemoting,
     switches::kEnableClickToPlay,
     switches::kPrelaunchGpuProcess,
diff --git a/chrome/browser/renderer_host/render_view_host.cc b/chrome/browser/renderer_host/render_view_host.cc
index b8a03f4..15f4e43 100644
--- a/chrome/browser/renderer_host/render_view_host.cc
+++ b/chrome/browser/renderer_host/render_view_host.cc
@@ -14,6 +14,7 @@
 #include "base/string_util.h"
 #include "base/time.h"
 #include "base/waitable_event.h"
+#include "chrome/browser/blocked_plugin_manager.h"
 #include "chrome/browser/browser_list.h"
 #include "chrome/browser/child_process_security_policy.h"
 #include "chrome/browser/cross_site_request_manager.h"
@@ -797,6 +798,10 @@ void RenderViewHost::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(ViewHostMsg_UserMetricsRecordAction,
                         OnUserMetricsRecordAction)
     IPC_MESSAGE_HANDLER(ViewHostMsg_MissingPluginStatus, OnMissingPluginStatus);
+    IPC_MESSAGE_HANDLER(ViewHostMsg_NonSandboxedPluginBlocked,
+                        OnNonSandboxedPluginBlocked);
+    IPC_MESSAGE_HANDLER(ViewHostMsg_BlockedPluginLoaded,
+                        OnBlockedPluginLoaded);
     IPC_MESSAGE_HANDLER(ViewHostMsg_CrashedPlugin, OnCrashedPlugin);
     IPC_MESSAGE_HANDLER(ViewHostMsg_SendCurrentPageAllSavableResourceLinks,
                         OnReceivedSavableResourceLinksForCurrentPage);
@@ -1530,6 +1535,22 @@ void RenderViewHost::OnMissingPluginStatus(int status) {
     integration_delegate->OnMissingPluginStatus(status);
 }
 
+void RenderViewHost::OnNonSandboxedPluginBlocked(const string16& name) {
+  RenderViewHostDelegate::BlockedPlugin* blocked_plugin_delegate =
+      delegate_->GetBlockedPluginDelegate();
+  if (blocked_plugin_delegate) {
+    blocked_plugin_delegate->OnNonSandboxedPluginBlocked(name);
+  }
+}
+
+void RenderViewHost::OnBlockedPluginLoaded() {
+  RenderViewHostDelegate::BlockedPlugin* blocked_plugin_delegate =
+      delegate_->GetBlockedPluginDelegate();
+  if (blocked_plugin_delegate) {
+    blocked_plugin_delegate->OnBlockedPluginLoaded();
+  }
+}
+
 void RenderViewHost::OnCrashedPlugin(const FilePath& plugin_path) {
   RenderViewHostDelegate::BrowserIntegration* integration_delegate =
       delegate_->GetBrowserIntegrationDelegate();
diff --git a/chrome/browser/renderer_host/render_view_host.h b/chrome/browser/renderer_host/render_view_host.h
index 0fda85e..0dbb82e 100644
--- a/chrome/browser/renderer_host/render_view_host.h
+++ b/chrome/browser/renderer_host/render_view_host.h
@@ -597,6 +597,8 @@ class RenderViewHost : public RenderWidgetHost {
 
   void OnUserMetricsRecordAction(const std::string& action);
   void OnMissingPluginStatus(int status);
+  void OnNonSandboxedPluginBlocked(const string16& name);
+  void OnBlockedPluginLoaded();
   void OnCrashedPlugin(const FilePath& plugin_path);
 
   void OnReceivedSavableResourceLinksForCurrentPage(
diff --git a/chrome/browser/renderer_host/render_view_host_delegate.cc b/chrome/browser/renderer_host/render_view_host_delegate.cc
index 1396368..f6eca0d 100644
--- a/chrome/browser/renderer_host/render_view_host_delegate.cc
+++ b/chrome/browser/renderer_host/render_view_host_delegate.cc
@@ -68,6 +68,11 @@ RenderViewHostDelegate::GetBookmarkDragDelegate() {
   return NULL;
 }
 
+RenderViewHostDelegate::BlockedPlugin*
+RenderViewHostDelegate::GetBlockedPluginDelegate() {
+  return NULL;
+}
+
 RenderViewHostDelegate::SSL*
 RenderViewHostDelegate::GetSSLDelegate() {
   return NULL;
diff --git a/chrome/browser/renderer_host/render_view_host_delegate.h b/chrome/browser/renderer_host/render_view_host_delegate.h
index 1ed62ed..a1fb979 100644
--- a/chrome/browser/renderer_host/render_view_host_delegate.h
+++ b/chrome/browser/renderer_host/render_view_host_delegate.h
@@ -530,6 +530,12 @@ class RenderViewHostDelegate {
     virtual ~BookmarkDrag() {}
   };
 
+  class BlockedPlugin {
+   public:
+    virtual void OnNonSandboxedPluginBlocked(const string16& name) = 0;
+    virtual void OnBlockedPluginLoaded() = 0;
+  };
+
   // SSL -----------------------------------------------------------------------
   // Interface for UI and other RenderViewHost-specific interactions with SSL.
 
@@ -586,6 +592,7 @@ class RenderViewHostDelegate {
   virtual Autocomplete* GetAutocompleteDelegate();
   virtual AutoFill* GetAutoFillDelegate();
   virtual BookmarkDrag* GetBookmarkDragDelegate();
+  virtual BlockedPlugin* GetBlockedPluginDelegate();
   virtual SSL* GetSSLDelegate();
 
   // Return the delegate for registering RenderViewHosts for automation resource
diff --git a/chrome/browser/tab_contents/tab_contents.cc b/chrome/browser/tab_contents/tab_contents.cc
index f551248..7f3e7aa 100644
--- a/chrome/browser/tab_contents/tab_contents.cc
+++ b/chrome/browser/tab_contents/tab_contents.cc
@@ -21,6 +21,7 @@
 #include "base/time.h"
 #include "chrome/browser/autocomplete_history_manager.h"
 #include "chrome/browser/autofill/autofill_manager.h"
+#include "chrome/browser/blocked_plugin_manager.h"
 #include "chrome/browser/blocked_popup_container.h"
 #include "chrome/browser/bookmarks/bookmark_model.h"
 #include "chrome/browser/browser.h"
@@ -2182,6 +2183,12 @@ RenderViewHostDelegate::AutoFill* TabContents::GetAutoFillDelegate() {
   return GetAutoFillManager();
 }
 
+RenderViewHostDelegate::BlockedPlugin* TabContents::GetBlockedPluginDelegate() {
+  if (blocked_plugin_manager_.get() == NULL)
+    blocked_plugin_manager_.reset(new BlockedPluginManager(this));
+  return blocked_plugin_manager_.get();
+}
+
 RenderViewHostDelegate::SSL* TabContents::GetSSLDelegate() {
   return GetSSLHelper();
 }
diff --git a/chrome/browser/tab_contents/tab_contents.h b/chrome/browser/tab_contents/tab_contents.h
index 7e37c1a..1b1b6c6 100644
--- a/chrome/browser/tab_contents/tab_contents.h
+++ b/chrome/browser/tab_contents/tab_contents.h
@@ -71,6 +71,7 @@ struct PasswordForm;
 
 class AutocompleteHistoryManager;
 class AutoFillManager;
+class BlockedPluginManager;
 class BlockedPopupContainer;
 class DOMUI;
 class DownloadItem;
@@ -897,6 +898,7 @@ class TabContents : public PageNavigator,
   virtual RenderViewHostDelegate::FavIcon* GetFavIconDelegate();
   virtual RenderViewHostDelegate::Autocomplete* GetAutocompleteDelegate();
   virtual RenderViewHostDelegate::AutoFill* GetAutoFillDelegate();
+  virtual RenderViewHostDelegate::BlockedPlugin* GetBlockedPluginDelegate();
   virtual RenderViewHostDelegate::SSL* GetSSLDelegate();
   virtual AutomationResourceRoutingDelegate*
       GetAutomationResourceRoutingDelegate();
@@ -1076,6 +1078,9 @@ class TabContents : public PageNavigator,
   // TabContentsSSLHelper, lazily created.
   scoped_ptr<TabContentsSSLHelper> ssl_helper_;
 
+  // BlockedPluginManager, lazily created.
+  scoped_ptr<BlockedPluginManager> blocked_plugin_manager_;
+
   // Handles drag and drop event forwarding to extensions.
   BookmarkDrag* bookmark_drag_;
 
diff --git a/chrome/chrome_browser.gypi b/chrome/chrome_browser.gypi
index d721e8a..86073f2 100644
--- a/chrome/chrome_browser.gypi
+++ b/chrome/chrome_browser.gypi
@@ -231,6 +231,8 @@
         'browser/back_forward_menu_model.h',
         'browser/background_contents_service.h',
         'browser/background_contents_service.cc',
+        'browser/blocked_plugin_manager.cc',
+        'browser/blocked_plugin_manager.h',
         'browser/blocked_popup_container.cc',
         'browser/blocked_popup_container.h',
         'browser/bookmarks/bookmark_codec.cc',
diff --git a/chrome/common/chrome_switches.cc b/chrome/common/chrome_switches.cc
index 943e56b..c12e9a1 100644
--- a/chrome/common/chrome_switches.cc
+++ b/chrome/common/chrome_switches.cc
@@ -64,6 +64,9 @@ const char kAuthServerWhitelist[]           = "auth-server-whitelist";
 // automation-related messages on IPC channel with the given ID.
 const char kAutomationClientChannelID[]     = "automation-channel";
 
+// Block non-sandboxed plugins.
+const char kBlockNonSandboxedPlugins[]      = "block-nonsandboxed-plugins";
+
 // Causes the browser process to throw an assertion on startup.
 const char kBrowserAssertTest[]             = "assert-test";
 
diff --git a/chrome/common/chrome_switches.h b/chrome/common/chrome_switches.h
index a5bcb91..b34fbb4 100644
--- a/chrome/common/chrome_switches.h
+++ b/chrome/common/chrome_switches.h
@@ -34,6 +34,7 @@ extern const char kAppsGalleryURL[];
 extern const char kAppsNoThrob[];
 extern const char kAuthServerWhitelist[];
 extern const char kAutomationClientChannelID[];
+extern const char kBlockNonSandboxedPlugins[];
 extern const char kBrowserAssertTest[];
 extern const char kBrowserCrashTest[];
 extern const char kBrowserSubprocessPath[];
diff --git a/chrome/common/render_messages_internal.h b/chrome/common/render_messages_internal.h
index 66ce013..ce787dd 100644
--- a/chrome/common/render_messages_internal.h
+++ b/chrome/common/render_messages_internal.h
@@ -1684,6 +1684,13 @@ IPC_BEGIN_MESSAGES(ViewHost)
   IPC_MESSAGE_ROUTED1(ViewHostMsg_MissingPluginStatus,
                       int /* status */)
 
+  // Notifies when a non-sandboxed plugin was blocked.
+  IPC_MESSAGE_ROUTED1(ViewHostMsg_NonSandboxedPluginBlocked,
+                      string16 /* name */)
+
+  // Notifies when a blocked plugin was loaded via click-to-load.
+  IPC_MESSAGE_ROUTED0(ViewHostMsg_BlockedPluginLoaded)
+
   // Sent by the renderer process to indicate that a plugin instance has
   // crashed.
   IPC_MESSAGE_ROUTED1(ViewHostMsg_CrashedPlugin,
diff --git a/chrome/renderer/blocked_plugin.cc b/chrome/renderer/blocked_plugin.cc
index 906726f7..b5d280d 100644
--- a/chrome/renderer/blocked_plugin.cc
+++ b/chrome/renderer/blocked_plugin.cc
@@ -10,6 +10,7 @@
 #include "base/string_piece.h"
 #include "chrome/common/jstemplate_builder.h"
 #include "chrome/common/notification_service.h"
+#include "chrome/common/render_messages.h"
 #include "chrome/renderer/render_view.h"
 #include "grit/generated_resources.h"
 #include "grit/renderer_resources.h"
@@ -91,15 +92,15 @@ void BlockedPlugin::LoadPlugin() {
   CHECK(plugin_);
   WebPluginContainer* container = plugin_->container();
   WebPlugin* new_plugin =
-      render_view_->CreatePluginInternal(frame_,
-                                         plugin_params_,
-                                         NULL,
-                                         std::string());
+      render_view_->CreatePluginNoCheck(frame_,
+                                        plugin_params_);
   if (new_plugin && new_plugin->initialize(container)) {
     container->setPlugin(new_plugin);
     plugin_->ReplayReceivedData(new_plugin);
     container->invalidate();
     container->reportGeometry();
     plugin_->destroy();
+    render_view_->Send(
+        new ViewHostMsg_BlockedPluginLoaded(render_view_->routing_id()));
   }
 }
diff --git a/chrome/renderer/render_view.cc b/chrome/renderer/render_view.cc
index 9d97ee2..6a8f8e8 100644
--- a/chrome/renderer/render_view.cc
+++ b/chrome/renderer/render_view.cc
@@ -200,8 +200,8 @@ using WebKit::WebPageSerializer;
 using WebKit::WebPageSerializerClient;
 using WebKit::WebPlugin;
 using WebKit::WebPluginContainer;
-using WebKit::WebPluginParams;
 using WebKit::WebPluginDocument;
+using WebKit::WebPluginParams;
 using WebKit::WebPoint;
 using WebKit::WebPopupMenuInfo;
 using WebKit::WebRange;
@@ -549,6 +549,24 @@ void RenderView::PluginCrashed(const FilePath& plugin_path) {
   Send(new ViewHostMsg_CrashedPlugin(routing_id_, plugin_path));
 }
 
+WebPlugin* RenderView::CreatePluginNoCheck(WebFrame* frame,
+                                           const WebPluginParams& params) {
+  WebPluginInfo info;
+  bool found;
+  std::string mime_type;
+  Send(new ViewHostMsg_GetPluginInfo(
+      params.url, frame->top()->url(), params.mimeType.utf8(), &found,
+      &info, &mime_type));
+  if (!found || !info.enabled)
+    return NULL;
+  scoped_refptr<pepper::PluginModule> pepper_module =
+      PepperPluginRegistry::GetInstance()->GetModule(info.path);
+  if (pepper_module)
+    return CreatePepperPlugin(frame, params, info.path, pepper_module.get());
+  else
+    return CreateNPAPIPlugin(frame, params, info.path, mime_type);
+}
+
 #if defined(OS_MACOSX)
 void RenderView::RegisterPluginDelegate(WebPluginDelegateProxy* delegate) {
   plugin_delegates_.insert(delegate);
@@ -2210,26 +2228,35 @@ WebPlugin* RenderView::createPlugin(WebFrame* frame,
   bool found = false;
   WebPluginInfo info;
   GURL url(params.url);
-  std::string mime_type(params.mimeType.utf8());
   std::string actual_mime_type;
   Send(new ViewHostMsg_GetPluginInfo(url,
                                      frame->top()->url(),
-                                     mime_type,
+                                     params.mimeType.utf8(),
                                      &found,
                                      &info,
-      &actual_mime_type));
+                                     &actual_mime_type));
 
   if (!found || !info.enabled)
     return NULL;
 
-  if (!AllowContentType(CONTENT_SETTINGS_TYPE_PLUGINS) &&
-      info.path.value() != kDefaultPluginLibraryName) {
-    DCHECK(CommandLine::ForCurrentProcess()->HasSwitch(
-        switches::kEnableClickToPlay));
-    didNotAllowPlugins(frame);
-    return CreatePluginPlaceholder(frame, params);
+  if (info.path.value() != kDefaultPluginLibraryName) {
+    if (!AllowContentType(CONTENT_SETTINGS_TYPE_PLUGINS)) {
+      DCHECK(CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableClickToPlay));
+      didNotAllowPlugins(frame);
+      return CreatePluginPlaceholder(frame, params);
+    }
+    scoped_refptr<pepper::PluginModule> pepper_module =
+        PepperPluginRegistry::GetInstance()->GetModule(info.path);
+    if (pepper_module)
+      return CreatePepperPlugin(frame, params, info.path, pepper_module.get());
+    if (CommandLine::ForCurrentProcess()->HasSwitch(
+            switches::kBlockNonSandboxedPlugins)) {
+      Send(new ViewHostMsg_NonSandboxedPluginBlocked(routing_id_, info.name));
+      return CreatePluginPlaceholder(frame, params);
+    }
   }
-  return CreatePluginInternal(frame, params, &info, actual_mime_type);
+  return CreateNPAPIPlugin(frame, params, info.path, actual_mime_type);
 }
 
 WebWorker* RenderView::createWorker(WebFrame* frame, WebWorkerClient* client) {
@@ -3686,49 +3713,35 @@ void RenderView::ClearBlockedContentSettings() {
     content_blocked_[i] = false;
 }
 
-WebPlugin* RenderView::CreatePluginInternal(WebFrame* frame,
-                                            const WebPluginParams& params,
-                                            WebPluginInfo* plugin_info,
-                                            const std::string& mime_type) {
-  std::string actual_mime_type(mime_type);
-  WebPluginInfo info;
-  if (plugin_info != NULL) {
-    info = *plugin_info;
-  } else {
-    bool found;
-    std::string actual_mime_type(mime_type);
-    Send(new ViewHostMsg_GetPluginInfo(
-        params.url, frame->top()->url(), params.mimeType.utf8(), &found,
-        &info, &actual_mime_type));
-    if (!found)
-      info.enabled = false;
-  }
-  if (!info.enabled)
-    return NULL;
+WebPlugin* RenderView::CreatePepperPlugin(WebFrame* frame,
+                                          const WebPluginParams& params,
+                                          const FilePath& path,
+                                          pepper::PluginModule* pepper_module) {
+  WebPlugin* plugin = new pepper::WebPluginImpl(pepper_module, params,
+                                                pepper_delegate_.AsWeakPtr());
+  if (plugin && !frame->parent() && frame->document().isPluginDocument()) {
+    // If this is a full-page plugin hosting the internal PDF plugin, we want
+    // to notify the browser so that it can treat things like zooming
+    // differently.
+    // TODO(sanjeevr): Use a Pepper interface to determine this rather than
+    // hardcode this for the PDF plugin path.
+    FilePath pdf_path;
+    PathService::Get(chrome::FILE_PDF_PLUGIN, &pdf_path);
+    if (path == pdf_path)
+      Send(new ViewHostMsg_SetDisplayingPDFContent(routing_id_));
+  }
+  return plugin;
+}
 
+WebPlugin* RenderView::CreateNPAPIPlugin(WebFrame* frame,
+                                         const WebPluginParams& params,
+                                         const FilePath& path,
+                                         const std::string& mime_type) {
+  std::string actual_mime_type(mime_type);
   if (actual_mime_type.empty())
     actual_mime_type = params.mimeType.utf8();
 
-  scoped_refptr<pepper::PluginModule> pepper_module =
-      PepperPluginRegistry::GetInstance()->GetModule(info.path);
-  if (pepper_module) {
-    WebPlugin* plugin = new pepper::WebPluginImpl(pepper_module, params,
-                                                  pepper_delegate_.AsWeakPtr());
-    if (plugin && !frame->parent() && frame->document().isPluginDocument()) {
-      // If this is a full-page plugin hosting the internal PDF plugin, we want
-      // to notify the browser so that it can treat things like zooming
-      // differently.
-      // TODO(sanjeevr): Use a Pepper interface to determine this rather than
-      // hardcode this for the PDF plugin path.
-      FilePath pdf_path;
-      PathService::Get(chrome::FILE_PDF_PLUGIN, &pdf_path);
-      if (info.path == pdf_path)
-        Send(new ViewHostMsg_SetDisplayingPDFContent(routing_id_));
-    }
-    return plugin;
-  }
-
-  return new webkit_glue::WebPluginImpl(frame, params, info.path,
+  return new webkit_glue::WebPluginImpl(frame, params, path,
                                         actual_mime_type, AsWeakPtr());
 }
 
diff --git a/chrome/renderer/render_view.h b/chrome/renderer/render_view.h
index 18f5fe2..1834ba1 100644
--- a/chrome/renderer/render_view.h
+++ b/chrome/renderer/render_view.h
@@ -275,11 +275,8 @@ class RenderView : public RenderWidget,
   void OnPepperPluginDestroy(WebPluginDelegatePepper* pepper_plugin);
 
   // Create a new plugin without checking the content settings.
-  WebKit::WebPlugin* CreatePluginInternal(
-      WebKit::WebFrame* frame,
-      const WebKit::WebPluginParams& params,
-      WebPluginInfo* plugin_info,
-      const std::string& mime_type);
+  WebKit::WebPlugin* CreatePluginNoCheck(WebKit::WebFrame* frame,
+                                         const WebKit::WebPluginParams& params);
 
   // Asks the browser for the CPBrowsingContext associated with this renderer.
   // This is an opaque identifier associated with the renderer for sending
@@ -856,6 +853,18 @@ class RenderView : public RenderWidget,
   // UI that is going to be hosted by this RenderView.
   void CreateDevToolsClient();
 
+  // Create a new NPAPI plugin.
+  WebKit::WebPlugin* CreateNPAPIPlugin(WebKit::WebFrame* frame,
+                                       const WebKit::WebPluginParams& params,
+                                       const FilePath& path,
+                                       const std::string& mime_type);
+
+  // Create a new Pepper plugin.
+  WebKit::WebPlugin* CreatePepperPlugin(WebKit::WebFrame* frame,
+                                        const WebKit::WebPluginParams& params,
+                                        const FilePath& path,
+                                        pepper::PluginModule* pepper_module);
+
   // Create a new placeholder for a blocked plugin.
   WebKit::WebPlugin* CreatePluginPlaceholder(
       WebKit::WebFrame* frame,