commit 977045b5ef2aa28de6b2ff2a77249d52bfc3bf0a
author codefu@google.com <codefu@google.com@8db76d5a-ed1c-0410-87a9-c151d255dfc7> Tue May 31 17:15:12 2011 +0000
committer codefu@google.com <codefu@google.com@8db76d5a-ed1c-0410-87a9-c151d255dfc7> Tue May 31 17:15:12 2011 +0000
tree ae366e9b65757bd1f1b2fecf8504e056d8115729
parent d8207832d9bc4291ca347574fca673f5ea1414d1

Developer Plugin should allow whitelisting of code server hosts
Solution was to whitelist the host/code servers as a pair.  In order to do
this, both common and browser specific code had to be modified.
Common:
  AllowedConnections:
    +Adding static getCodeServerFromUrl() to aid in fetching "gwt.codesvr="
values.
    +Modifying definition of internal Rule class from an stl-pairing of string &
bool
     to a simple class holding the host & code servers as strings and bool
expection
    +Updating matchesRule() to take host and code server as params
    +Update addRule() and initFromAccessList() to handle new pairing:
     [!]host[/code][,[!][host[/code]...]
Browsers:
  FireFox / Chrome:
    +Update UI to show both host/code server



git-svn-id: https://google-web-toolkit.googlecode.com/svn/trunk@10242 8db76d5a-ed1c-0410-87a9-c151d255dfc7

plugins/npapi/ScriptableInstance.cpp

diff --git a/plugins/npapi/ScriptableInstance.cpp b/plugins/npapi/ScriptableInstance.cpp
index 7acbeee..4344a5b 100644
--- a/plugins/npapi/ScriptableInstance.cpp
+++ b/plugins/npapi/ScriptableInstance.cpp
@@ -307,7 +307,13 @@
       }
       bool include = includeVariant.getAsBoolean();
       Debug::log(Debug::Info) << "Adding " << urlString << "(" << (include ? "include" : "exclude") << ")\n";
-      AllowedConnections::addRule(urlString, !include);
+
+      int slash = urlString.find( '/' );
+      if( slash == std::string::npos ) {
+        AllowedConnections::addRule(urlString, "localhost", !include);
+      } else {
+        AllowedConnections::addRule(urlString.substr( 0, slash), urlString.substr(slash+1), !include);
+      }
     }
   } else {
     Debug::log(Debug::Error) << "ScriptableInstance::loadHostEntries called from outside the background page: " <<
@@ -323,9 +329,13 @@
   const NPString url = args[0].value.stringValue;
   const string urlStr = convertToString(url);
   bool allowed = false;
-  bool matches = AllowedConnections::matchesRule(urlStr, &allowed);
-  string retStr;
 
+  Debug::log(Debug::Info) << "getHostPermission() url " << urlStr << Debug::flush;
+  bool matches = AllowedConnections::matchesRule(
+      AllowedConnections::getHostFromUrl(urlStr),
+      AllowedConnections::getCodeServerFromUrl(urlStr),
+      &allowed);
+  string retStr;
   if (!matches) {
     retStr = UNKNOWN_STR;
   } else if (allowed) {
@@ -371,7 +381,10 @@
       << ")" << Debug::flush;
 
   bool allowed = false;
-  AllowedConnections::matchesRule(urlStr, &allowed);
+  AllowedConnections::matchesRule(
+      AllowedConnections::getHostFromUrl(urlStr),
+      AllowedConnections::getCodeServerFromUrl(appUrlStr),
+      &allowed);
   if (!allowed) {
     BOOLEAN_TO_NPVARIANT(false, *result);
     result->type = NPVariantType_Bool;