Home | History | Annotate | Download | only in renderer 
      1 // Copyright 2014 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "extensions/renderer/script_injection.h"
      6 
      7 #include <map>
      8 
      9 #include "base/lazy_instance.h"
     10 #include "base/metrics/histogram.h"
     11 #include "base/timer/elapsed_timer.h"
     12 #include "base/values.h"
     13 #include "content/public/renderer/render_view.h"
     14 #include "content/public/renderer/v8_value_converter.h"
     15 #include "extensions/common/extension.h"
     16 #include "extensions/common/extension_messages.h"
     17 #include "extensions/common/feature_switch.h"
     18 #include "extensions/common/manifest_handlers/csp_info.h"
     19 #include "extensions/renderer/dom_activity_logger.h"
     20 #include "extensions/renderer/extension_groups.h"
     21 #include "extensions/renderer/extensions_renderer_client.h"
     22 #include "third_party/WebKit/public/platform/WebString.h"
     23 #include "third_party/WebKit/public/web/WebDocument.h"
     24 #include "third_party/WebKit/public/web/WebLocalFrame.h"
     25 #include "third_party/WebKit/public/web/WebScopedUserGesture.h"
     26 #include "third_party/WebKit/public/web/WebScriptSource.h"
     27 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
     28 #include "url/gurl.h"
     29 
     30 namespace extensions {
     31 
     32 namespace {
     33 
     34 typedef std::map<std::string, int> IsolatedWorldMap;
     35 base::LazyInstance<IsolatedWorldMap> g_isolated_worlds =
     36     LAZY_INSTANCE_INITIALIZER;
     37 
     38 const int64 kInvalidRequestId = -1;
     39 
     40 // The id of the next pending injection.
     41 int64 g_next_pending_id = 0;
     42 
     43 bool ShouldNotifyBrowserOfInjections() {
     44   return !FeatureSwitch::scripts_require_action()->IsEnabled();
     45 }
     46 
     47 // Append all the child frames of |parent_frame| to |frames_vector|.
     48 void AppendAllChildFrames(blink::WebFrame* parent_frame,
     49                           std::vector<blink::WebFrame*>* frames_vector) {
     50   DCHECK(parent_frame);
     51   for (blink::WebFrame* child_frame = parent_frame->firstChild(); child_frame;
     52        child_frame = child_frame->nextSibling()) {
     53     frames_vector->push_back(child_frame);
     54     AppendAllChildFrames(child_frame, frames_vector);
     55   }
     56 }
     57 
     58 // Gets the isolated world ID to use for the given |extension| in the given
     59 // |frame|. If no isolated world has been created for that extension,
     60 // one will be created and initialized.
     61 int GetIsolatedWorldIdForExtension(const Extension* extension,
     62                                    blink::WebLocalFrame* frame) {
     63   static int g_next_isolated_world_id =
     64       ExtensionsRendererClient::Get()->GetLowestIsolatedWorldId();
     65 
     66   IsolatedWorldMap& isolated_worlds = g_isolated_worlds.Get();
     67 
     68   int id = 0;
     69   IsolatedWorldMap::iterator iter = isolated_worlds.find(extension->id());
     70   if (iter != isolated_worlds.end()) {
     71     id = iter->second;
     72   } else {
     73     id = g_next_isolated_world_id++;
     74     // This map will tend to pile up over time, but realistically, you're never
     75     // going to have enough extensions for it to matter.
     76     isolated_worlds[extension->id()] = id;
     77   }
     78 
     79   // We need to set the isolated world origin and CSP even if it's not a new
     80   // world since these are stored per frame, and we might not have used this
     81   // isolated world in this frame before.
     82   frame->setIsolatedWorldSecurityOrigin(
     83       id, blink::WebSecurityOrigin::create(extension->url()));
     84   frame->setIsolatedWorldContentSecurityPolicy(
     85       id,
     86       blink::WebString::fromUTF8(CSPInfo::GetContentSecurityPolicy(extension)));
     87   frame->setIsolatedWorldHumanReadableName(
     88       id,
     89       blink::WebString::fromUTF8(extension->name()));
     90 
     91   return id;
     92 }
     93 
     94 }  // namespace
     95 
     96 // static
     97 std::string ScriptInjection::GetExtensionIdForIsolatedWorld(
     98     int isolated_world_id) {
     99   IsolatedWorldMap& isolated_worlds = g_isolated_worlds.Get();
    100 
    101   for (IsolatedWorldMap::iterator iter = isolated_worlds.begin();
    102        iter != isolated_worlds.end();
    103        ++iter) {
    104     if (iter->second == isolated_world_id)
    105       return iter->first;
    106   }
    107   return std::string();
    108 }
    109 
    110 // static
    111 void ScriptInjection::RemoveIsolatedWorld(const std::string& extension_id) {
    112   g_isolated_worlds.Get().erase(extension_id);
    113 }
    114 
    115 ScriptInjection::ScriptInjection(
    116     scoped_ptr<ScriptInjector> injector,
    117     blink::WebLocalFrame* web_frame,
    118     const std::string& extension_id,
    119     UserScript::RunLocation run_location,
    120     int tab_id)
    121     : injector_(injector.Pass()),
    122       web_frame_(web_frame),
    123       extension_id_(extension_id),
    124       run_location_(run_location),
    125       tab_id_(tab_id),
    126       request_id_(kInvalidRequestId),
    127       complete_(false) {
    128 }
    129 
    130 ScriptInjection::~ScriptInjection() {
    131   if (!complete_)
    132     injector_->OnWillNotInject(ScriptInjector::WONT_INJECT);
    133 }
    134 
    135 bool ScriptInjection::TryToInject(UserScript::RunLocation current_location,
    136                                   const Extension* extension,
    137                                   ScriptsRunInfo* scripts_run_info) {
    138   if (current_location < run_location_)
    139     return false;  // Wait for the right location.
    140 
    141   if (request_id_ != kInvalidRequestId)
    142     return false;  // We're waiting for permission right now, try again later.
    143 
    144   if (!extension) {
    145     NotifyWillNotInject(ScriptInjector::EXTENSION_REMOVED);
    146     return true;  // We're done.
    147   }
    148 
    149   switch (injector_->CanExecuteOnFrame(
    150       extension, web_frame_, tab_id_, web_frame_->top()->document().url())) {
    151     case PermissionsData::ACCESS_DENIED:
    152       NotifyWillNotInject(ScriptInjector::NOT_ALLOWED);
    153       return true;  // We're done.
    154     case PermissionsData::ACCESS_WITHHELD:
    155       RequestPermission();
    156       return false;  // Wait around for permission.
    157     case PermissionsData::ACCESS_ALLOWED:
    158       Inject(extension, scripts_run_info);
    159       return true;  // We're done!
    160   }
    161 
    162   // Some compilers don't realize that we always return from the switch() above.
    163   // Make them happy.
    164   return false;
    165 }
    166 
    167 bool ScriptInjection::OnPermissionGranted(const Extension* extension,
    168                                           ScriptsRunInfo* scripts_run_info) {
    169   if (!extension) {
    170     NotifyWillNotInject(ScriptInjector::EXTENSION_REMOVED);
    171     return false;
    172   }
    173 
    174   Inject(extension, scripts_run_info);
    175   return true;
    176 }
    177 
    178 void ScriptInjection::RequestPermission() {
    179   content::RenderView* render_view =
    180       content::RenderView::FromWebView(web_frame()->top()->view());
    181 
    182   // If we are just notifying the browser of the injection, then send an
    183   // invalid request (which is treated like a notification).
    184   request_id_ = ShouldNotifyBrowserOfInjections() ? kInvalidRequestId
    185                                                   : g_next_pending_id++;
    186   render_view->Send(new ExtensionHostMsg_RequestScriptInjectionPermission(
    187       render_view->GetRoutingID(),
    188       extension_id_,
    189       injector_->script_type(),
    190       request_id_));
    191 }
    192 
    193 void ScriptInjection::NotifyWillNotInject(
    194     ScriptInjector::InjectFailureReason reason) {
    195   complete_ = true;
    196   injector_->OnWillNotInject(reason);
    197 }
    198 
    199 void ScriptInjection::Inject(const Extension* extension,
    200                              ScriptsRunInfo* scripts_run_info) {
    201   DCHECK(extension);
    202   DCHECK(scripts_run_info);
    203   DCHECK(!complete_);
    204 
    205   if (ShouldNotifyBrowserOfInjections())
    206     RequestPermission();
    207 
    208   std::vector<blink::WebFrame*> frame_vector;
    209   frame_vector.push_back(web_frame_);
    210   if (injector_->ShouldExecuteInChildFrames())
    211     AppendAllChildFrames(web_frame_, &frame_vector);
    212 
    213   scoped_ptr<blink::WebScopedUserGesture> gesture;
    214   if (injector_->IsUserGesture())
    215     gesture.reset(new blink::WebScopedUserGesture());
    216 
    217   bool inject_js = injector_->ShouldInjectJs(run_location_);
    218   bool inject_css = injector_->ShouldInjectCss(run_location_);
    219   DCHECK(inject_js || inject_css);
    220 
    221   scoped_ptr<base::ListValue> execution_results(new base::ListValue());
    222   GURL top_url = web_frame_->top()->document().url();
    223   for (std::vector<blink::WebFrame*>::iterator iter = frame_vector.begin();
    224        iter != frame_vector.end();
    225        ++iter) {
    226     // TODO(dcheng): Unfortunately, the code as written won't work in an OOPI
    227     // world. This is just a temporary hack to make things compile.
    228     blink::WebLocalFrame* frame = (*iter)->toWebLocalFrame();
    229 
    230     // We recheck access here in the renderer for extra safety against races
    231     // with navigation, but different frames can have different URLs, and the
    232     // extension might only have access to a subset of them.
    233     // For child frames, we just skip ones the extension doesn't have access
    234     // to and carry on.
    235     // Note: we don't consider ACCESS_WITHHELD because there is nowhere to
    236     // surface a request for a child frame.
    237     // TODO(rdevlin.cronin): We should ask for permission somehow.
    238     if (injector_->CanExecuteOnFrame(extension, frame, tab_id_, top_url) ==
    239         PermissionsData::ACCESS_DENIED) {
    240       DCHECK(frame->parent());
    241       continue;
    242     }
    243     if (inject_js)
    244       InjectJs(extension, frame, execution_results.get());
    245     if (inject_css)
    246       InjectCss(frame);
    247   }
    248 
    249   complete_ = true;
    250   injector_->OnInjectionComplete(execution_results.Pass(),
    251                                  scripts_run_info,
    252                                  run_location_);
    253 }
    254 
    255 void ScriptInjection::InjectJs(const Extension* extension,
    256                                blink::WebLocalFrame* frame,
    257                                base::ListValue* execution_results) {
    258   std::vector<blink::WebScriptSource> sources =
    259       injector_->GetJsSources(run_location_);
    260   bool in_main_world = injector_->ShouldExecuteInMainWorld();
    261   int world_id = in_main_world
    262                      ? DOMActivityLogger::kMainWorldId
    263                      : GetIsolatedWorldIdForExtension(extension, frame);
    264   bool expects_results = injector_->ExpectsResults();
    265 
    266   base::ElapsedTimer exec_timer;
    267   DOMActivityLogger::AttachToWorld(world_id, extension->id());
    268   v8::HandleScope scope(v8::Isolate::GetCurrent());
    269   v8::Local<v8::Value> script_value;
    270   if (in_main_world) {
    271     // We only inject in the main world for javascript: urls.
    272     DCHECK_EQ(1u, sources.size());
    273 
    274     const blink::WebScriptSource& source = sources.front();
    275     if (expects_results)
    276       script_value = frame->executeScriptAndReturnValue(source);
    277     else
    278       frame->executeScript(source);
    279   } else {  // in isolated world
    280     scoped_ptr<blink::WebVector<v8::Local<v8::Value> > > results;
    281     if (expects_results)
    282       results.reset(new blink::WebVector<v8::Local<v8::Value> >());
    283     frame->executeScriptInIsolatedWorld(world_id,
    284                                         &sources.front(),
    285                                         sources.size(),
    286                                         EXTENSION_GROUP_CONTENT_SCRIPTS,
    287                                         results.get());
    288     if (expects_results && !results->isEmpty())
    289       script_value = (*results)[0];
    290   }
    291 
    292   UMA_HISTOGRAM_TIMES("Extensions.InjectScriptTime", exec_timer.Elapsed());
    293 
    294   if (expects_results) {
    295     // Right now, we only support returning single results (per frame).
    296     scoped_ptr<content::V8ValueConverter> v8_converter(
    297         content::V8ValueConverter::create());
    298     // It's safe to always use the main world context when converting
    299     // here. V8ValueConverterImpl shouldn't actually care about the
    300     // context scope, and it switches to v8::Object's creation context
    301     // when encountered.
    302     v8::Local<v8::Context> context = frame->mainWorldScriptContext();
    303     scoped_ptr<base::Value> result(
    304         v8_converter->FromV8Value(script_value, context));
    305     // Always append an execution result (i.e. no result == null result)
    306     // so that |execution_results| lines up with the frames.
    307     execution_results->Append(result.get() ? result.release()
    308                                            : base::Value::CreateNullValue());
    309   }
    310 }
    311 
    312 void ScriptInjection::InjectCss(blink::WebLocalFrame* frame) {
    313   std::vector<std::string> css_sources =
    314       injector_->GetCssSources(run_location_);
    315   for (std::vector<std::string>::const_iterator iter = css_sources.begin();
    316        iter != css_sources.end();
    317        ++iter) {
    318     frame->document().insertStyleSheet(blink::WebString::fromUTF8(*iter));
    319   }
    320 }
    321 
    322 }  // namespace extensions
    323