diff options
| author | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-05-25 18:46:05 +0000 |
|---|---|---|
| committer | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-05-25 18:46:05 +0000 |
| commit | c5d73596cfae7dd57d237f7d4cb64112511b2300 (patch) | |
| tree | 2c2424e083a9bffa0f0d6adc0181e908d644ce17 /content/browser | |
| parent | 853c0a8c6c4c04277cd85a6a7f99b2fed22b7f35 (diff) | |
| download | chromium_src-c5d73596cfae7dd57d237f7d4cb64112511b2300.zip chromium_src-c5d73596cfae7dd57d237f7d4cb64112511b2300.tar.gz chromium_src-c5d73596cfae7dd57d237f7d4cb64112511b2300.tar.bz2 | |
Restrict WebUI calls to the chrome:// origins.
BUG=129288
Review URL: https://chromiumcodereview.appspot.com/10332305
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@139085 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'content/browser')
| -rw-r--r-- | content/browser/webui/web_ui_impl.cc | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/content/browser/webui/web_ui_impl.cc b/content/browser/webui/web_ui_impl.cc index 43f8086..493bb31 100644 --- a/content/browser/webui/web_ui_impl.cc +++ b/content/browser/webui/web_ui_impl.cc @@ -13,10 +13,14 @@ #include "content/browser/renderer_host/render_view_host_impl.h" #include "content/browser/web_contents/web_contents_impl.h" #include "content/common/view_messages.h" +#include "content/public/browser/content_browser_client.h" +#include "content/public/browser/web_contents_delegate.h" #include "content/public/browser/web_contents_view.h" #include "content/public/browser/web_ui_controller.h" +#include "content/public/browser/web_ui_controller_factory.h" #include "content/public/browser/web_ui_message_handler.h" #include "content/public/common/bindings_policy.h" +#include "content/public/common/content_client.h" #include "ui/base/layout.h" using content::RenderViewHostImpl; @@ -78,8 +82,15 @@ bool WebUIImpl::OnMessageReceived(const IPC::Message& message) { void WebUIImpl::OnWebUISend(const GURL& source_url, const std::string& message, const ListValue& args) { + bool data_urls_allowed = + web_contents_->GetDelegate()->CanLoadDataURLsInWebUI(); + content::WebUIControllerFactory* factory = + content::GetContentClient()->browser()->GetWebUIControllerFactory(); if (!ChildProcessSecurityPolicyImpl::GetInstance()-> - HasWebUIBindings(web_contents_->GetRenderProcessHost()->GetID())) { + HasWebUIBindings(web_contents_->GetRenderProcessHost()->GetID()) || + !factory->IsURLAcceptableForWebUI(web_contents_->GetBrowserContext(), + source_url, + data_urls_allowed)) { NOTREACHED() << "Blocked unauthorized use of WebUIBindings."; return; } |