Fix <webview> webRequest events going to all instances instead of onl…

…y the one that created it. BUG=763448 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation Change-Id: Ie80eb595ef597618e8b8282c3224e243a9b2f2fe Reviewed-on: https://chromium-review.googlesource.com/658758 Reviewed-by: Fady Samuel <[email protected]> Commit-Queue: John Abd-El-Malek <[email protected]> Cr-Original-Commit-Position: refs/heads/master@{#500969}(cherry picked from commit 9c909e1) Reviewed-on: https://chromium-review.googlesource.com/665677 Reviewed-by: John Abd-El-Malek <[email protected]> Cr-Commit-Position: refs/branch-heads/3202@{crosswalk-project#208} Cr-Branched-From: fa6a5d8-refs/heads/master@{#499098}
tenta-browser · Sep 13, 2017 · 9ea59a6 · 9ea59a6
1 parent 14103a0
commit 9ea59a6
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 8 deletions.
diff --git a/chrome/browser/apps/guest_view/web_view_browsertest.cc b/chrome/browser/apps/guest_view/web_view_browsertest.cc
@@ -1557,6 +1557,11 @@ IN_PROC_BROWSER_TEST_P(WebViewTest, Shim_TestWebRequestAPI) {
   TestHelper("testWebRequestAPI", "web_view/shim", NEEDS_TEST_SERVER);
 }
 
+IN_PROC_BROWSER_TEST_P(WebViewTest, Shim_TestWebRequestAPIOnlyForInstance) {
+  TestHelper("testWebRequestAPIOnlyForInstance", "web_view/shim",
+             NEEDS_TEST_SERVER);
+}
+
 IN_PROC_BROWSER_TEST_P(WebViewTest, Shim_TestWebRequestAPIWithHeaders) {
   TestHelper("testWebRequestAPIWithHeaders",
              "web_view/shim",

diff --git a/chrome/test/data/extensions/platform_apps/web_view/shim/main.js b/chrome/test/data/extensions/platform_apps/web_view/shim/main.js
@@ -1774,6 +1774,15 @@ function testWebRequestAPI() {
   document.body.appendChild(webview);
 }
 
+// Like above, but ensures that a webview doesn't get events for other webviews.
+function testWebRequestAPIOnlyForInstance() {
+  var tempWebview = new WebView();
+  tempWebview.request.onBeforeRequest.addListener(function(e) {
+    embedder.test.fail();
+  }, { urls: ['<all_urls>']}) ;
+  testWebRequestAPI();
+}
+
 // This test verifies that the WebRequest API onBeforeSendHeaders event fires on
 // webview and supports headers. This tests verifies that we can modify HTTP
 // headers via the WebRequest API and those modified headers will be sent to the
@@ -3183,6 +3192,7 @@ embedder.test.testList = {
       testDeclarativeWebRequestAPISendMessageSecondWebView,
   'testDisplayBlock': testDisplayBlock,
   'testWebRequestAPI': testWebRequestAPI,
+  'testWebRequestAPIOnlyForInstance': testWebRequestAPIOnlyForInstance,
   'testWebRequestAPIErrorOccurred': testWebRequestAPIErrorOccurred,
   'testWebRequestAPIWithHeaders': testWebRequestAPIWithHeaders,
   'testWebRequestAPIGoogleProperty': testWebRequestAPIGoogleProperty,

diff --git a/extensions/browser/api/web_request/web_request_api.cc b/extensions/browser/api/web_request/web_request_api.cc
@@ -1438,14 +1438,21 @@ void ExtensionWebRequestEventRouter::GetMatchingListenersImpl(
       continue;
     }
 
-    // If this is a PlzNavigate request, then |navigation_ui_data| will be valid
-    // and the IDs will be -1. We can skip this verification since
-    // |navigation_ui_data| was created and set in the browser so it's trusted.
-    if (is_web_view_guest && !navigation_ui_data &&
-        (listener->id.embedder_process_id !=
-             web_view_info.embedder_process_id ||
-         listener->id.web_view_instance_id != web_view_info.instance_id)) {
-      continue;
+    if (is_web_view_guest) {
+      // If this is a PlzNavigate request, then |navigation_ui_data| will be
+      // valid and the IDs will be -1. We can skip this verification since
+      // |navigation_ui_data| was created and set in the browser so it's
+      // trusted.
+      if (!navigation_ui_data && (listener->id.embedder_process_id !=
+                                  web_view_info.embedder_process_id)) {
+        continue;
+      }
+
+      int instance_id = navigation_ui_data
+                            ? navigation_ui_data->web_view_instance_id()
+                            : web_view_info.instance_id;
+      if (listener->id.web_view_instance_id != instance_id)
+        continue;
     }
 
     // Filter requests from other extensions / apps. This does not work for