From 189d4fd8fad9e3c776873be51938cd31a42b6177 Mon Sep 17 00:00:00 2001 From: Allan Sandfeld Jensen Date: Thu, 20 May 2021 09:47:09 +0200 Subject: BASELINE: Update Chromium to 90.0.4430.221 Change-Id: Iff4d9d18d2fcf1a576f3b1f453010f744a232920 Reviewed-by: Allan Sandfeld Jensen --- chromium/docs/webui_explainer.md | 84 +++++++++++++++++++++------------------- 1 file changed, 45 insertions(+), 39 deletions(-) (limited to 'chromium/docs/webui_explainer.md') diff --git a/chromium/docs/webui_explainer.md b/chromium/docs/webui_explainer.md index f62e208a4c7..fbbb482b1aa 100644 --- a/chromium/docs/webui_explainer.md +++ b/chromium/docs/webui_explainer.md @@ -258,8 +258,10 @@ So, the given C++ code: ```c++ void OvenHandler::RegisterMessages() { - web_ui()->RegisterMessageHandler("bakeDonuts", - base::Bind(&OvenHandler::HandleBakeDonuts, base::Unretained(this))); + web_ui()->RegisterMessageCallback( + "bakeDonuts", + base::BindRepeating(&OvenHandler::HandleBakeDonuts, + base::Unretained(this))); } void OvenHandler::HandleBakeDonuts(const base::ListValue* args) { @@ -359,11 +361,11 @@ chrome/browser/ui/webui/webui\_util.\* contains a number of methods to simplify common configuration tasks. -### webui::AddLocalizedStringsBulk() +### WebUIDataSource::AddLocalizedStrings() Many Web UI data sources need to be set up with a large number of localized strings. Instead of repeatedly calling AddLocalizedString(), create -an array of all the strings and use AddLocalizedStringsBulk(): +an array of all the strings and use AddLocalizedStrings(): ```c++ static constexpr webui::LocalizedString kStrings[] = { @@ -372,16 +374,15 @@ an array of all the strings and use AddLocalizedStringsBulk(): {"ariaRoleDescription", IDS_HISTORY_ARIA_ROLE_DESCRIPTION}, {"bookmarked", IDS_HISTORY_ENTRY_BOOKMARKED}, }; - AddLocalizedStringsBulk(source, kStrings); + source->AddLocalizedStrings(kStrings); ``` - -### webui::AddResourcePathsBulk() + +### WebUIDataSource::AddResourcePaths() Similar to the localized strings, many Web UIs need to add a large number of -resource paths. In this case, use AddResourcePathsBulk() to -replace repeated calls to AddResourcePath(). There are two -versions. One works almost identically to the strings case: +resource paths. In this case, use AddResourcePaths() to +replace repeated calls to AddResourcePath(). ```c++ static constexpr webui::ResourcePath kPdfResources[] = { @@ -389,20 +390,18 @@ versions. One works almost identically to the strings case: {"pdf/constants.js", IDR_PDF_CONSTANTS_JS}, {"pdf/controller.js", IDR_PDF_CONTROLLER_JS}, }; - webui::AddResourcePathsBulk(source, kStrings); + source->AddResourcePaths(kStrings); ``` -The second version instead accepts a span of GritResourceMap so -that it can directly use constants defined by autogenerated grit resources map -header files. For example, the autogenerated print\_preview\_resources\_map.h -header defines a GritResourceMap named -kPrintPreviewResources and a -size\_t kPrintPreviewResourcesSize. All the resources in this +The same method can be leveraged for cases that directly use constants defined +by autogenerated grit resources map header files. For example, the autogenerated +print\_preview\_resources\_map.h header defines a +webui::ResourcePath array named kPrintPreviewResources +and a size\_t kPrintPreviewResourcesSize. All the resources in this resource map can be added as follows: ```c++ - webui::AddResourcePathsBulk( - source, + source->AddResourcePaths( base::make_span(kPrintPreviewResources, kPrintPreviewResourcesSize)); ``` @@ -727,7 +726,8 @@ renderer: v8::Local chrome = GetOrCreateChromeObject(isolate, context); chrome->Set(gin::StringToSymbol(isolate, "send"), gin::CreateFunctionTemplate( - isolate, base::Bind(&WebUIExtension::Send))->GetFunction()); + isolate, + base::BindRepeating(&WebUIExtension::Send))->GetFunction()); ``` The `chrome.send()` method takes a message name and argument list. @@ -883,28 +883,34 @@ since taking control of a WebUI page can sometimes be sufficient to escape Chrome's sandbox. To make sure that the special powers granted to WebUI pages are safe, WebUI pages are restricted in what they can do: -* WebUI pages cannot embed http/https resources or frames +* WebUI pages cannot embed http/https resources * WebUI pages cannot issue http/https fetches In the rare case that a WebUI page really needs to include web content, the safe -way to do this is by using a `` tag. Using a `` tag is more -secure than using an iframe for multiple reasons, even if Site Isolation and -out-of-process iframes keep the web content out of the privileged WebUI process. - -First, the content inside the `` tag has a much reduced attack surface, -since it does not have a window reference to its embedder or any other frames. -Only postMessage channel is supported, and this needs to be initiated by the -embedder, not the guest. - -Second, the content inside the `` tag is hosted in a separate -StoragePartition. Thus, cookies and other persistent storage for both the WebUI -page and other browser tabs are inaccessible to it. - -This greater level of isolation makes it safer to load possibly untrustworthy or -compromised web content, reducing the risk of sandbox escapes. - -For an example of switching from iframe to webview tag see -https://crrev.com/c/710738. +way to do this is by using an `