Skip to content
This repository has been archived by the owner on Jan 4, 2019. It is now read-only.

Block filesystem access when cookies are blocked #42

Merged
merged 1 commit into from
Aug 22, 2016
Merged

Block filesystem access when cookies are blocked #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions atom/renderer/content_settings_client.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,36 @@ bool ContentSettingsClient::allowDatabase(const WebString& name,
return allow;
}


void ContentSettingsClient::requestFileSystemAccessAsync(
const WebContentSettingCallbacks& callbacks) {
WebFrame* frame = render_frame()->GetWebFrame();
WebContentSettingCallbacks permissionCallbacks(callbacks);
if (frame->getSecurityOrigin().isUnique() ||
frame->top()->getSecurityOrigin().isUnique()) {
permissionCallbacks.doDeny();
return;
}

bool allow = true;
GURL secondary_url(
blink::WebStringToGURL(frame->getSecurityOrigin().toString()));
if (content_settings_manager_->content_settings()) {
allow =
content_settings_manager_->GetSetting(
GetOriginOrURL(frame),
secondary_url,
"cookies",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we really want this to always be tied to cookies in electron or just tie the two settings together in browser-laptop? Seems like the latter would give us more flexibility

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i don't have a strong preference, but database and localstorage are tied to cookies, so this seems like it should be consistent with those

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, didn't think this was as closely related because Chrome handles it separately, but that's fine if it always makes sense together

allow) != CONTENT_SETTING_BLOCK;
}
if (!allow) {
DidBlockContentType("filesystem", secondary_url.spec());
permissionCallbacks.doDeny();
} else {
permissionCallbacks.doAllow();
}
}

bool ContentSettingsClient::allowImage(bool enabled_per_settings,
const WebURL& image_url) {
if (enabled_per_settings && IsWhitelistedForContentSettings())
Expand Down
4 changes: 2 additions & 2 deletions atom/renderer/content_settings_client.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,8 +58,8 @@ class ContentSettingsClient
bool allowDatabase(const blink::WebString& name,
const blink::WebString& display_name,
unsigned long estimated_size) override; // NOLINT
// void requestFileSystemAccessAsync(
// const blink::WebContentSettingCallbacks& callbacks) override;
void requestFileSystemAccessAsync(
const blink::WebContentSettingCallbacks& callbacks) override;
bool allowImage(bool enabled_per_settings,
const blink::WebURL& image_url) override;
bool allowIndexedDB(const blink::WebString& name,
Expand Down