1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef CHROME_COMMON_EXTENSIONS_PERMISSIONS_PERMISSIONS_DATA_H_ 6 #define CHROME_COMMON_EXTENSIONS_PERMISSIONS_PERMISSIONS_DATA_H_ 7 8 #include <map> 9 #include <vector> 10 11 #include "base/memory/ref_counted.h" 12 #include "base/memory/scoped_ptr.h" 13 #include "base/strings/string16.h" 14 #include "base/synchronization/lock.h" 15 #include "chrome/common/extensions/permissions/api_permission.h" 16 #include "chrome/common/extensions/permissions/permission_message.h" 17 18 class GURL; 19 20 namespace extensions { 21 22 class PermissionSet; 23 class APIPermissionSet; 24 class Extension; 25 class URLPatternSet; 26 class UserScript; 27 28 // A container for the permissions data of the extension; also responsible for 29 // parsing the "permissions" and "optional_permissions" manifest keys. This 30 // class also contains the active (runtime) permissions for the extension. 31 class PermissionsData { 32 public: 33 PermissionsData(); 34 ~PermissionsData(); 35 36 // Delegate class to allow different contexts (e.g. browser vs renderer) to 37 // have control over policy decisions. 38 class PolicyDelegate { 39 public: 40 virtual ~PolicyDelegate() {} 41 42 // Returns false if script access should be blocked on this page. 43 // Otherwise, default policy should decide. 44 virtual bool CanExecuteScriptOnPage(const Extension* extension, 45 const GURL& document_url, 46 const GURL& top_document_url, 47 int tab_id, 48 const UserScript* script, 49 int process_id, 50 std::string* error) = 0; 51 }; 52 53 static void SetPolicyDelegate(PolicyDelegate* delegate); 54 55 // Return the optional or required permission set for the given |extension|. 56 static const PermissionSet* GetOptionalPermissions( 57 const Extension* extension); 58 static const PermissionSet* GetRequiredPermissions( 59 const Extension* extension); 60 61 // Return the temporary API permission set which is used during extension 62 // initialization. Once initialization completes, this is NULL. 63 static const APIPermissionSet* GetInitialAPIPermissions( 64 const Extension* extension); 65 static APIPermissionSet* GetInitialAPIPermissions(Extension* extension); 66 67 // Set the scriptable hosts for the given |extension| during initialization. 68 static void SetInitialScriptableHosts(Extension* extension, 69 const URLPatternSet& scriptable_hosts); 70 71 // Return the active (runtime) permissions for the given |extension|. 72 static scoped_refptr<const PermissionSet> GetActivePermissions( 73 const Extension* extension); 74 // Sets the runtime permissions of the given |extension| to |permissions|. 75 static void SetActivePermissions(const Extension* extension, 76 const PermissionSet* active); 77 78 // Gets the tab-specific host permissions of |tab_id|, or NULL if there 79 // aren't any. 80 static scoped_refptr<const PermissionSet> GetTabSpecificPermissions( 81 const Extension* extension, 82 int tab_id); 83 // Updates the tab-specific permissions of |tab_id| to include those from 84 // |permissions|. 85 static void UpdateTabSpecificPermissions( 86 const Extension* extension, 87 int tab_id, 88 scoped_refptr<const PermissionSet> permissions); 89 // Clears the tab-specific permissions of |tab_id|. 90 static void ClearTabSpecificPermissions(const Extension* extension, 91 int tab_id); 92 93 // Returns true if the |extension| has the given |permission|. Prefer 94 // IsExtensionWithPermissionOrSuggestInConsole when developers may be using an 95 // api that requires a permission they didn't know about, e.g. open web apis. 96 // Note this does not include APIs with no corresponding permission, like 97 // "runtime" or "browserAction". 98 // TODO(mpcomplete): drop the "API" from these names, it's confusing. 99 static bool HasAPIPermission(const Extension* extension, 100 APIPermission::ID permission); 101 static bool HasAPIPermission(const Extension* extension, 102 const std::string& permission_name); 103 static bool HasAPIPermissionForTab(const Extension* extension, 104 int tab_id, 105 APIPermission::ID permission); 106 107 static bool CheckAPIPermissionWithParam( 108 const Extension* extension, 109 APIPermission::ID permission, 110 const APIPermission::CheckParam* param); 111 112 static const URLPatternSet& GetEffectiveHostPermissions( 113 const Extension* extension); 114 115 // Returns true if the |extension| can silently increase its permission level. 116 // Users must approve permissions for unpacked and packed extensions in the 117 // following situations: 118 // - when installing or upgrading packed extensions 119 // - when installing unpacked extensions that have NPAPI plugins 120 // - when either type of extension requests optional permissions 121 static bool CanSilentlyIncreasePermissions(const Extension* extension); 122 123 // Returns true if the extension does not require permission warnings 124 // to be displayed at install time. 125 static bool ShouldSkipPermissionWarnings(const Extension* extension); 126 127 // Whether the |extension| has access to the given |url|. 128 static bool HasHostPermission(const Extension* extension, const GURL& url); 129 130 // Whether the |extension| has effective access to all hosts. This is true if 131 // there is a content script that matches all hosts, if there is a host 132 // permission grants access to all hosts (like <all_urls>) or an api 133 // permission that effectively grants access to all hosts (e.g. proxy, 134 // network, etc.) 135 static bool HasEffectiveAccessToAllHosts(const Extension* extension); 136 137 // Returns the full list of permission messages that the given |extension| 138 // should display at install time. 139 static PermissionMessages GetPermissionMessages(const Extension* extension); 140 // Returns the full list of permission messages that the given |extension| 141 // should display at install time. The messages are returned as strings 142 // for convenience. 143 static std::vector<string16> GetPermissionMessageStrings( 144 const Extension* extension); 145 146 // Returns the full list of permission details for messages that the given 147 // |extension| should display at install time. The messages are returned as 148 // strings for convenience. 149 static std::vector<string16> GetPermissionMessageDetailsStrings( 150 const Extension* extension); 151 152 // Returns true if the given |extension| can execute script on a page. If a 153 // UserScript object is passed, permission to run that specific script is 154 // checked (using its matches list). Otherwise, permission to execute script 155 // programmatically is checked (using the extension's host permission). 156 // 157 // This method is also aware of certain special pages that extensions are 158 // usually not allowed to run script on. 159 static bool CanExecuteScriptOnPage(const Extension* extension, 160 const GURL& document_url, 161 const GURL& top_document_url, 162 int tab_id, 163 const UserScript* script, 164 int process_id, 165 std::string* error); 166 167 // Returns true if the given |extension| is a COMPONENT extension, or if it is 168 // on the whitelist of extensions that can script all pages. 169 static bool CanExecuteScriptEverywhere(const Extension* extension); 170 171 // Returns true if the |extension| is allowed to obtain the contents of a 172 // page as an image. Since a page may contain sensitive information, this 173 // is restricted to the extension's host permissions as well as the 174 // extension page itself. 175 static bool CanCaptureVisiblePage(const Extension* extension, 176 const GURL& page_url, 177 int tab_id, 178 std::string* error); 179 180 // Parse the permissions of a given extension in the initialization process. 181 bool ParsePermissions(Extension* extension, string16* error); 182 183 // Finalize permissions after the initialization process completes. 184 void FinalizePermissions(Extension* extension); 185 186 private: 187 struct InitialPermissions; 188 typedef std::map<int, scoped_refptr<const PermissionSet> > TabPermissionsMap; 189 190 // Temporary permissions during the initialization process; NULL after 191 // initialization completes. 192 scoped_ptr<InitialPermissions> initial_required_permissions_; 193 scoped_ptr<InitialPermissions> initial_optional_permissions_; 194 195 // The set of permissions the extension can request at runtime. 196 scoped_refptr<const PermissionSet> optional_permission_set_; 197 198 // The extension's required / default set of permissions. 199 scoped_refptr<const PermissionSet> required_permission_set_; 200 201 mutable base::Lock runtime_lock_; 202 203 // The permission's which are currently active on the extension during 204 // runtime. 205 mutable scoped_refptr<const PermissionSet> active_permissions_; 206 207 mutable TabPermissionsMap tab_specific_permissions_; 208 209 DISALLOW_COPY_AND_ASSIGN(PermissionsData); 210 }; 211 212 } // namespace extensions 213 214 #endif // CHROME_COMMON_EXTENSIONS_PERMISSIONS_PERMISSIONS_DATA_H_ 215
