1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
// Copyright 2021 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "components/pdf/renderer/internal_plugin_renderer_helpers.h"
#include <memory>
#include <utility>
#include "base/check.h"
#include "base/command_line.h"
#include "components/pdf/common/pdf_util.h"
#include "components/pdf/renderer/pdf_view_web_plugin_client.h"
#include "content/public/common/content_switches.h"
#include "content/public/renderer/render_frame.h"
#include "mojo/public/cpp/bindings/associated_remote.h"
#include "pdf/mojom/pdf.mojom.h"
#include "pdf/pdf_view_web_plugin.h"
#include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
#include "third_party/blink/public/platform/web_security_origin.h"
#include "third_party/blink/public/web/web_frame.h"
#include "third_party/blink/public/web/web_local_frame.h"
#include "third_party/blink/public/web/web_plugin.h"
#include "third_party/blink/public/web/web_plugin_params.h"
#include "url/gurl.h"
#include "url/origin.h"
namespace pdf {
bool IsPdfRenderer() {
static const bool has_switch =
base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kPdfRenderer);
return has_switch;
}
blink::WebPlugin* CreateInternalPlugin(
blink::WebPluginParams params,
content::RenderFrame* render_frame,
base::span<const url::Origin> additional_allowed_origins) {
// For a PDF plugin, `params.url` holds the plugin's stream URL. If `params`
// contains an 'original-url' attribute, reset `params.url` with its original
// URL value so that it can be used to determine the plugin's origin.
for (size_t i = 0; i < params.attribute_names.size(); ++i) {
if (params.attribute_names[i] == "original-url") {
params.url = GURL(params.attribute_values[i].Utf16());
break;
}
}
// The in-process plugin should only be created if the parent frame's origin
// was allowed to (externally) embed the internal plugin.
blink::WebFrame* frame = render_frame->GetWebFrame();
blink::WebFrame* parent_frame = frame->Parent();
if (!parent_frame ||
!IsPdfInternalPluginAllowedOrigin(parent_frame->GetSecurityOrigin(),
additional_allowed_origins)) {
return nullptr;
}
// Only create the in-process plugin within a PDF renderer.
CHECK(IsPdfRenderer());
// Origins allowed to embed the internal plugin are trusted (the PDF viewer
// and Print Preview), and should never directly create the in-process plugin.
// Likewise, they should not share a process with this frame.
//
// See crbug.com/1259635 and crbug.com/1261758 for examples of previous bugs.
CHECK(!IsPdfInternalPluginAllowedOrigin(frame->GetSecurityOrigin(),
additional_allowed_origins));
CHECK(parent_frame->IsWebRemoteFrame());
mojo::AssociatedRemote<pdf::mojom::PdfHost> pdf_host;
render_frame->GetRemoteAssociatedInterfaces()->GetInterface(
pdf_host.BindNewEndpointAndPassReceiver());
return new chrome_pdf::PdfViewWebPlugin(
std::make_unique<PdfViewWebPluginClient>(render_frame),
std::move(pdf_host), std::move(params));
}
} // namespace pdf
|
