webui_allowlist.h 3.7 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. // Copyright 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef UI_WEBUI_WEBUI_ALLOWLIST_H_
  5. #define UI_WEBUI_WEBUI_ALLOWLIST_H_
  6. #include <initializer_list>
  7. #include <map>
  8. #include "base/memory/raw_ptr.h"
  9. #include "base/memory/ref_counted.h"
  10. #include "base/thread_annotations.h"
  11. #include "base/threading/thread_checker.h"
  12. #include "components/content_settings/core/browser/content_settings_origin_identifier_value_map.h"
  13. #include "components/content_settings/core/browser/content_settings_rule.h"
  14. #include "components/content_settings/core/common/content_settings.h"
  15. #include "components/content_settings/core/common/content_settings_pattern.h"
  16. #include "components/content_settings/core/common/content_settings_types.h"
  17. #include "url/origin.h"
  18. namespace content {
  19. class BrowserContext;
  20. }
  21. class WebUIAllowlistProvider;
  22. // This class is the underlying storage for WebUIAllowlistProvider, it stores a
  23. // list of origins and permissions to be auto-granted to WebUIs. This class is
  24. // created before HostContentSettingsMap is registered and has the same lifetime
  25. // as the profile it's attached to. It outlives WebUIAllowlistProvider.
  26. class WebUIAllowlist : public base::RefCountedThreadSafe<WebUIAllowlist> {
  27. public:
  28. static WebUIAllowlist* GetOrCreate(content::BrowserContext* browser_context);
  29. WebUIAllowlist();
  30. WebUIAllowlist(const WebUIAllowlist&) = delete;
  31. void operator=(const WebUIAllowlist&) = delete;
  32. // Register auto-granted |type| permission for WebUI |origin|. The |origin|
  33. // will have the permission even if it's embedded in a different origin.
  34. //
  35. // WebUIAllowlist comes with no permission by default. Users can deny
  36. // permissions (e.g. Settings > Site Settings) unless they are registered
  37. // here.
  38. //
  39. // Most WebUIs would want to declare these:
  40. // COOKIES: use persistent storage (e.g. localStorage)
  41. // JAVASCRIPT: run JavaScript
  42. // IMAGES: show images
  43. // SOUND: play sounds
  44. void RegisterAutoGrantedPermission(
  45. const url::Origin& origin,
  46. ContentSettingsType type,
  47. ContentSetting setting = CONTENT_SETTING_ALLOW);
  48. // Register auto-granted |types| permissions for |origin|. See comments above.
  49. void RegisterAutoGrantedPermissions(
  50. const url::Origin& origin,
  51. std::initializer_list<ContentSettingsType> types);
  52. // Grant the use of third-party cookies on origins matching
  53. // |third_party_origin_pattern|. The third-party origins must be embedded
  54. // (e.g. an iframe), or being requested (e.g. Fetch API) by the WebUI's
  55. // |top_level_origin|.
  56. //
  57. // See ContentSettingsPattern for how to construct such a pattern.
  58. void RegisterAutoGrantedThirdPartyCookies(
  59. const url::Origin& top_level_origin,
  60. const std::vector<ContentSettingsPattern>& origin_patterns);
  61. // Returns a content_settings::RuleIterator. The iterator keeps this list
  62. // alive while it is alive. This method is thread-safe.
  63. std::unique_ptr<content_settings::RuleIterator> GetRuleIterator(
  64. ContentSettingsType content_type) const;
  65. void SetWebUIAllowlistProvider(WebUIAllowlistProvider* provider);
  66. void ResetWebUIAllowlistProvider();
  67. private:
  68. friend class base::RefCountedThreadSafe<WebUIAllowlist>;
  69. ~WebUIAllowlist();
  70. THREAD_CHECKER(thread_checker_);
  71. mutable base::Lock lock_;
  72. content_settings::OriginIdentifierValueMap value_map_ GUARDED_BY(lock_);
  73. raw_ptr<WebUIAllowlistProvider> provider_
  74. GUARDED_BY_CONTEXT(thread_checker_) = nullptr;
  75. void SetContentSettingsAndNotifyProvider(
  76. const ContentSettingsPattern& primary_pattern,
  77. const ContentSettingsPattern& secondary_pattern,
  78. ContentSettingsType type,
  79. ContentSetting value);
  80. };
  81. #endif // UI_WEBUI_WEBUI_ALLOWLIST_H_