| // Copyright 2012 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #ifndef CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_ |
| #define CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_ |
| |
| #include <stddef.h> |
| |
| #include <map> |
| #include <memory> |
| #include <optional> |
| #include <set> |
| #include <string> |
| #include <vector> |
| |
| #include "base/containers/flat_map.h" |
| #include "base/containers/flat_set.h" |
| #include "base/functional/callback_forward.h" |
| #include "base/memory/scoped_refptr.h" |
| #include "base/strings/string_piece.h" |
| #include "base/time/time.h" |
| #include "base/types/strong_alias.h" |
| #include "base/values.h" |
| #include "build/build_config.h" |
| #include "build/buildflag.h" |
| #include "build/chromeos_buildflags.h" |
| #include "components/browsing_topics/common/common_types.h" |
| #include "components/download/public/common/quarantine_connection.h" |
| #include "components/file_access/scoped_file_access.h" |
| #include "content/common/content_export.h" |
| #include "content/public/browser/allow_service_worker_result.h" |
| #include "content/public/browser/certificate_request_result_type.h" |
| #include "content/public/browser/child_process_security_policy.h" |
| #include "content/public/browser/commit_deferring_condition.h" |
| #include "content/public/browser/file_system_access_permission_context.h" |
| #include "content/public/browser/generated_code_cache_settings.h" |
| #include "content/public/browser/interest_group_api_operation.h" |
| #include "content/public/browser/interest_group_manager.h" |
| #include "content/public/browser/legacy_tech_cookie_issue_details.h" |
| #include "content/public/browser/login_delegate.h" |
| #include "content/public/browser/mojo_binder_policy_map.h" |
| #include "content/public/browser/privacy_sandbox_invoking_api.h" |
| #include "content/public/browser/storage_partition_config.h" |
| #include "content/public/common/alternative_error_page_override_info.mojom-forward.h" |
| #include "content/public/common/page_visibility_state.h" |
| #include "content/public/common/window_container_type.mojom-forward.h" |
| #include "device/vr/buildflags/buildflags.h" |
| #include "media/mojo/mojom/media_service.mojom-forward.h" |
| #include "media/mojo/mojom/remoting.mojom-forward.h" |
| #include "mojo/public/cpp/bindings/generic_pending_receiver.h" |
| #include "mojo/public/cpp/bindings/pending_receiver.h" |
| #include "mojo/public/cpp/bindings/pending_remote.h" |
| #include "mojo/public/cpp/bindings/remote.h" |
| #include "mojo/public/cpp/system/message_pipe.h" |
| #include "net/cookies/cookie_setting_override.h" |
| #include "services/cert_verifier/public/mojom/cert_verifier_service_factory.mojom-forward.h" |
| #include "services/metrics/public/cpp/ukm_source_id.h" |
| #include "services/network/public/mojom/ip_address_space.mojom-forward.h" |
| #include "services/network/public/mojom/network_context.mojom-forward.h" |
| #include "services/network/public/mojom/proxy_config.mojom-forward.h" |
| #include "services/network/public/mojom/restricted_cookie_manager.mojom-forward.h" |
| #include "services/network/public/mojom/url_loader_factory.mojom-forward.h" |
| #include "services/network/public/mojom/web_sandbox_flags.mojom-forward.h" |
| #include "services/network/public/mojom/web_transport.mojom-forward.h" |
| #include "services/network/public/mojom/websocket.mojom-forward.h" |
| #include "storage/browser/file_system/file_system_context.h" |
| #include "third_party/abseil-cpp/absl/types/optional.h" |
| #include "third_party/blink/public/common/mediastream/media_devices.h" |
| #include "third_party/blink/public/common/permissions_policy/permissions_policy.h" |
| #include "third_party/blink/public/common/user_agent/user_agent_metadata.h" |
| #include "third_party/blink/public/mojom/browsing_topics/browsing_topics.mojom-forward.h" |
| #include "third_party/blink/public/mojom/file_system_access/file_system_access_cloud_identifier.mojom-forward.h" |
| #include "third_party/blink/public/mojom/file_system_access/file_system_access_error.mojom-forward.h" |
| #include "third_party/blink/public/mojom/manifest/manifest.mojom-forward.h" |
| #include "third_party/blink/public/mojom/origin_trials/origin_trials_settings.mojom-forward.h" |
| #include "ui/accessibility/ax_mode.h" |
| #include "ui/base/page_transition_types.h" |
| #include "ui/base/window_open_disposition.h" |
| |
| #if (BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC)) || BUILDFLAG(IS_FUCHSIA) |
| #include "base/posix/global_descriptors.h" |
| #endif |
| |
| #if BUILDFLAG(IS_POSIX) || BUILDFLAG(IS_FUCHSIA) |
| #include "content/public/browser/posix_file_descriptor_info.h" |
| #endif |
| |
| #if !BUILDFLAG(IS_ANDROID) |
| #include "services/video_capture/public/mojom/video_effects_manager.mojom.h" |
| #endif // !BUILDFLAG(IS_ANDROID) |
| |
| namespace net { |
| class SiteForCookies; |
| class IsolationInfo; |
| } // namespace net |
| |
| class GURL; |
| |
| // TODO(ellyjones): This synonym shouldn't need to exist - call sites should get |
| // the definition from LoginDelegate directly. Migrate all users over, then |
| // delete this. |
| using LoginAuthRequiredCallback = |
| content::LoginDelegate::LoginAuthRequiredCallback; |
| |
| namespace base { |
| class CommandLine; |
| class FilePath; |
| class Location; |
| class SequencedTaskRunner; |
| } // namespace base |
| |
| namespace blink { |
| namespace mojom { |
| class DeviceAPIService; |
| class ManagedConfigurationService; |
| class RendererPreferenceWatcher; |
| class WindowFeatures; |
| enum class WebFeature : int32_t; |
| } // namespace mojom |
| namespace web_pref { |
| struct WebPreferences; |
| } // namespace web_pref |
| class AssociatedInterfaceRegistry; |
| struct NavigationDownloadPolicy; |
| struct RendererPreferences; |
| class StorageKey; |
| class URLLoaderThrottle; |
| } // namespace blink |
| |
| namespace device { |
| class GeolocationManager; |
| class LocationProvider; |
| } // namespace device |
| |
| namespace gfx { |
| class ImageSkia; |
| } // namespace gfx |
| |
| namespace media { |
| class AudioLogFactory; |
| class AudioManager; |
| class ScreenEnumerator; |
| } // namespace media |
| |
| namespace mojo { |
| template <typename> |
| class BinderMapWithContext; |
| } // namespace mojo |
| |
| namespace network { |
| class SharedURLLoaderFactory; |
| namespace mojom { |
| class TrustedHeaderClient; |
| class URLLoader; |
| class URLLoaderClient; |
| } // namespace mojom |
| } // namespace network |
| |
| namespace service_manager { |
| template <typename...> |
| class BinderRegistryWithArgs; |
| using BinderRegistry = BinderRegistryWithArgs<>; |
| } // namespace service_manager |
| |
| namespace net { |
| class AuthChallengeInfo; |
| class ClientCertIdentity; |
| using ClientCertIdentityList = std::vector<std::unique_ptr<ClientCertIdentity>>; |
| class ClientCertStore; |
| class HttpResponseHeaders; |
| class SSLCertRequestInfo; |
| class SSLInfo; |
| class URLRequest; |
| } // namespace net |
| |
| namespace network { |
| namespace mojom { |
| class NetworkContext; |
| class NetworkService; |
| class TrustedURLLoaderHeaderClient; |
| } // namespace mojom |
| struct ResourceRequest; |
| } // namespace network |
| |
| namespace sandbox { |
| class SandboxCompiler; |
| class TargetConfig; |
| namespace mojom { |
| enum class Sandbox; |
| } // namespace mojom |
| } // namespace sandbox |
| |
| namespace ui { |
| class SelectFilePolicy; |
| class ClipboardFormatType; |
| } // namespace ui |
| |
| namespace ukm { |
| class UkmService; |
| } // namespace ukm |
| |
| namespace url { |
| class Origin; |
| } // namespace url |
| |
| namespace storage { |
| class FileSystemBackend; |
| } // namespace storage |
| |
| namespace content { |
| enum class SiteIsolationMode; |
| enum class SmsFetchFailureType; |
| class AnchorElementPreconnectDelegate; |
| class AuthenticatorRequestClientDelegate; |
| class BluetoothDelegate; |
| class BrowserChildProcessHost; |
| class BrowserContext; |
| class BrowserMainParts; |
| class BrowserPpapiHost; |
| class BrowserURLHandler; |
| class ClientCertificateDelegate; |
| class ControllerPresentationServiceDelegate; |
| class DevToolsManagerDelegate; |
| class DirectSocketsDelegate; |
| class FeatureObserverClient; |
| class FontAccessDelegate; |
| class HidDelegate; |
| class IdentityRequestDialogController; |
| class LoginDelegate; |
| class DigitalCredentialProvider; |
| class MediaObserver; |
| class NavigationHandle; |
| class NavigationThrottle; |
| class NavigationUIData; |
| class PrefetchServiceDelegate; |
| class PrerenderWebContentsDelegate; |
| class PresentationObserver; |
| class PrivacySandboxAttestationsObserver; |
| class PrivateNetworkDeviceDelegate; |
| class ReceiverPresentationServiceDelegate; |
| class RenderFrameHost; |
| class RenderProcessHost; |
| class ResponsivenessCalculatorDelegate; |
| class SerialDelegate; |
| class SiteInstance; |
| class SpeculationHostDelegate; |
| class SpeechRecognitionManagerDelegate; |
| class StoragePartition; |
| class TracingDelegate; |
| class TtsPlatform; |
| class URLLoaderRequestInterceptor; |
| class UsbDelegate; |
| class VideoOverlayWindow; |
| class VideoPictureInPictureWindowController; |
| class VpnServiceProxy; |
| class WebAuthenticationDelegate; |
| class WebContents; |
| class WebContentsViewDelegate; |
| class WebUIBrowserInterfaceBrokerRegistry; |
| class XrIntegrationClient; |
| struct GlobalRenderFrameHostId; |
| struct GlobalRequestID; |
| struct OpenURLParams; |
| struct Referrer; |
| struct ServiceWorkerVersionBaseInfo; |
| struct SocketPermissionRequest; |
| |
| #if BUILDFLAG(IS_ANDROID) |
| class TtsEnvironmentAndroid; |
| #endif |
| |
| #if BUILDFLAG(IS_CHROMEOS_ASH) |
| class TtsControllerDelegate; |
| #endif |
| |
| #if BUILDFLAG(IS_CHROMEOS) |
| class SmartCardDelegate; |
| #endif |
| |
| // Structure of data pasted from clipboard. |
| struct CONTENT_EXPORT ClipboardPasteData { |
| ClipboardPasteData(std::string text, |
| std::string image, |
| std::vector<base::FilePath> file_paths); |
| ClipboardPasteData(); |
| ClipboardPasteData(const ClipboardPasteData&); |
| ClipboardPasteData(ClipboardPasteData&&); |
| ClipboardPasteData& operator=(ClipboardPasteData&&); |
| bool isEmpty(); |
| ~ClipboardPasteData(); |
| |
| // UTF-8 encoded text data to scan, such as plain text, URLs, HTML, etc. |
| std::string text; |
| |
| // Binary image data to scan, such as png (here we assume the data |
| // struct holds one image only). |
| std::string image; |
| |
| // A list of full file paths to scan. |
| std::vector<base::FilePath> file_paths; |
| }; |
| |
| // Embedder API (or SPI) for participating in browser logic, to be implemented |
| // by the client of the content browser. See ChromeContentBrowserClient for the |
| // principal implementation. The methods are assumed to be called on the UI |
| // thread unless otherwise specified. Use this "escape hatch" sparingly, to |
| // avoid the embedder interface ballooning and becoming very specific to Chrome. |
| // (Often, the call out to the client can happen in a different part of the code |
| // that either already has a hook out to the embedder, or calls out to one of |
| // the observer interfaces.) |
| class CONTENT_EXPORT ContentBrowserClient { |
| public: |
| // Callback used with IsClipboardPasteContentAllowed() method. If the paste |
| // is not allowed, nullopt is passed to the callback. Otherwise, the data |
| // that should be pasted is passed in. |
| using IsClipboardPasteContentAllowedCallback = base::OnceCallback<void( |
| absl::optional<ClipboardPasteData> clipboard_paste_data)>; |
| |
| virtual ~ContentBrowserClient() = default; |
| |
| // Allows the embedder to set any number of custom BrowserMainParts |
| // implementations for the browser startup code. See comments in |
| // browser_main_parts.h. |
| // |is_integration_test| is true iff MainFunctionParams::ui_task was set and |
| // will thus intercept MainMessageLoopRun (i.e. in integration tests -- ref. |
| // BrowserMainParts::ShouldInterceptMainMessageLoopRun for additional control |
| // the embedder has over that). |
| virtual std::unique_ptr<BrowserMainParts> CreateBrowserMainParts( |
| bool is_integration_test); |
| |
| // Queues `task` until after the startup phase (for whatever definition of |
| // "startup" the embedder has in mind). This may be called on any thread. |
| // Note: prefer to simply post a task with BEST_EFFORT priority. This will |
| // delay the task until higher priority tasks are finished, which includes |
| // critical startup tasks. The BrowserThread::PostBestEffortTask() helper can |
| // post a BEST_EFFORT task to an arbitrary task runner. |
| virtual void PostAfterStartupTask( |
| const base::Location& from_here, |
| const scoped_refptr<base::SequencedTaskRunner>& task_runner, |
| base::OnceClosure task); |
| |
| // Allows the embedder to indicate whether it considers startup to be |
| // complete. May be called on any thread. This should be called on a one-off |
| // basis; if you need to poll this function constantly, use the above |
| // PostAfterStartupTask() API instead. |
| virtual bool IsBrowserStartupComplete(); |
| |
| // Allows the embedder to handle a request from unit tests running in the |
| // content layer to consider startup complete (for the sake of |
| // PostAfterStartupTask()). |
| virtual void SetBrowserStartupIsCompleteForTesting(); |
| |
| // Returns true if the embedder is in the process of shutting down, whether |
| // because of the user closing the browser or the OS is shutting down. |
| virtual bool IsShuttingDown(); |
| |
| // If content creates the WebContentsView implementation, it will ask the |
| // embedder to return an (optional) delegate to customize it. |
| virtual std::unique_ptr<WebContentsViewDelegate> GetWebContentsViewDelegate( |
| WebContents* web_contents); |
| |
| // Allow embedder control GPU process launch retry on failure behavior. |
| virtual bool AllowGpuLaunchRetryOnIOThread(); |
| |
| // Called when GPU process is not used for compositing. Allow embedder to |
| // control whether to shut down the GPU process to save memory, at the cost |
| // of slower start up the next time GPU process is needed. |
| // Note this only ensures the GPU process is not used for compositing. It is |
| // the embedder's responsibility to ensure there are no other services hosted |
| // by the GPU process being used; examples include accelerated media decoders |
| // and encoders. |
| virtual bool CanShutdownGpuProcessNowOnIOThread(); |
| |
| // Notifies that a render process will be created. This is called before |
| // the content layer adds its own BrowserMessageFilters, so that the |
| // embedder's IPC filters have priority. |
| // |
| // If the client provides a service request, the content layer will ask the |
| // corresponding embedder renderer-side component to bind it to an |
| // implementation at the appropriate moment during initialization. |
| virtual void RenderProcessWillLaunch(RenderProcessHost* host) {} |
| |
| // Notifies that a BrowserChildProcessHost has been created. |
| virtual void BrowserChildProcessHostCreated(BrowserChildProcessHost* host) {} |
| |
| // Get the effective URL for the given actual URL, to allow an embedder to |
| // group different url schemes in the same SiteInstance. |
| virtual GURL GetEffectiveURL(BrowserContext* browser_context, |
| const GURL& url); |
| |
| // Returns true if effective URLs should be compared when choosing a |
| // SiteInstance for a navigation to |destination_url|. |
| // |is_outermost_main_frame| is true if the navigation will take place in an |
| // outermost main frame. |
| virtual bool ShouldCompareEffectiveURLsForSiteInstanceSelection( |
| BrowserContext* browser_context, |
| content::SiteInstance* candidate_site_instance, |
| bool is_outermost_main_frame, |
| const GURL& candidate_url, |
| const GURL& destination_url); |
| |
| // Returns true if the user intentionally initiated the navigation. This is |
| // used to determine whether we should process debug URLs like chrome://crash. |
| // The default implementation checks whether the transition was initiated via |
| // the address bar (rather than whether it was typed) to permit the pasting of |
| // debug URLs. |
| virtual bool IsExplicitNavigation(ui::PageTransition transition); |
| |
| // Returns whether all instances of the specified site URL should be |
| // rendered by the same process, rather than using process-per-site-instance. |
| virtual bool ShouldUseProcessPerSite(BrowserContext* browser_context, |
| const GURL& site_url); |
| |
| // Returns whether a spare RenderProcessHost should be used for navigating to |
| // the specified site URL. |
| // |
| // Using the spare RenderProcessHost is advisable, because it can improve |
| // performance of a navigation that requires a new process. On the other |
| // hand, sometimes the spare RenderProcessHost cannot be used - for example |
| // some embedders might override |
| // ContentBrowserClient::AppendExtraCommandLineSwitches and add some cmdline |
| // switches at navigation time (and this won't work for the spare, because the |
| // spare RenderProcessHost is launched ahead of time). |
| virtual bool ShouldUseSpareRenderProcessHost(BrowserContext* browser_context, |
| const GURL& site_url); |
| |
| // Returns true if site isolation should be enabled for |effective_site_url|. |
| // This call allows the embedder to supplement the site isolation policy |
| // enforced by the content layer. Will only be called if the content layer |
| // didn't decide to isolate |effective_site_url| according to its internal |
| // policy (e.g. because of --site-per-process). |
| virtual bool DoesSiteRequireDedicatedProcess(BrowserContext* browser_context, |
| const GURL& effective_site_url); |
| |
| // Returns true if sandboxed documents with `precursor` as the opaque origin's |
| // precursor are allowed to be put into a separate process, if the |
| // IsolateSandboxedIframes feature is enabled. Defaults to true, but allows |
| // embedders to skip isolated sandboxed frames for certain cases. |
| // TODO(https://crbug.com/1501910): Remove this once we have an implementation |
| // that allows sandboxed iframes access to extension resources without giving |
| // them access to extension APIs. |
| virtual bool ShouldAllowCrossProcessSandboxedFrameForPrecursor( |
| BrowserContext* browser_context, |
| const GURL& precursor); |
| |
| // Returns true unless the effective URL is part of a site that cannot live in |
| // a process restricted to just that site. This is only called if site |
| // isolation is enabled for this URL. |
| virtual bool ShouldLockProcessToSite(BrowserContext* browser_context, |
| const GURL& effective_url); |
| |
| // Returns a boolean indicating whether the WebUI |url| requires its process |
| // to be locked to the WebUI origin. Note: This method can be called from |
| // multiple threads. It is not safe to assume it runs only on the UI thread. |
| // |
| // TODO(crbug.com/566091): Remove this exception once most visited tiles can |
| // load in OOPIFs on the NTP. Ideally, all WebUI urls should load in locked |
| // processes. |
| virtual bool DoesWebUIUrlRequireProcessLock(const GURL& url); |
| |
| // Returns true if everything embedded inside a document with given scheme |
| // should be treated as first-party content. |scheme| will be in canonical |
| // (lowercased) form. |is_embedded_origin_secure| refers to whether the origin |
| // that is embedded in a document with the given scheme is secure. |
| // |
| // See also WebSecurityPolicy::RegisterURLSchemeAsFirstPartyWhenTopLevel() in |
| // the renderer, and the network::mojom::CookieManagerParams fields: |
| // 1. third_party_cookies_allowed_schemes (corresponding to schemes where |
| // this returns true regardless of |is_embedded_origin_secure|), and |
| // 2. secure_origins_cookies_allowed_schemes (corresponding to schemes where |
| // this returns true if |is_embedded_origin_secure| is true), |
| // which should both be synchronized with the output of this function. |
| // |
| // TODO(chlily): This doesn't take into account the |
| // matching_scheme_cookies_allowed_schemes, but maybe we should remove that |
| // anyway. |
| virtual bool ShouldTreatURLSchemeAsFirstPartyWhenTopLevel( |
| base::StringPiece scheme, |
| bool is_embedded_origin_secure); |
| |
| // Similar to the above. Returns whether SameSite cookie restrictions should |
| // be ignored when the site_for_cookies's scheme is |scheme|. |
| // |is_embedded_origin_secure| refers to whether the origin that is embedded |
| // in a document with the given scheme is secure. |
| // This is a separate function from the above because the allowed schemes can |
| // be different, as SameSite restrictions and third-party cookie blocking are |
| // related but have different semantics. |
| virtual bool ShouldIgnoreSameSiteCookieRestrictionsWhenTopLevel( |
| base::StringPiece scheme, |
| bool is_embedded_origin_secure); |
| |
| // Gets a user friendly display name for a given |site_url| to be used in the |
| // CDM process name. |
| virtual std::string GetSiteDisplayNameForCdmProcess( |
| BrowserContext* browser_context, |
| const GURL& site_url); |
| |
| // This method allows the //content embedder to override |factory_params| with |
| // |origin|-specific properties (e.g. with relaxed Cross-Origin Read Blocking |
| // enforcement as needed by some extensions, or with extension-specific CORS |
| // exclusions). |
| // |
| // This method may be called in the following cases: |
| // - The default factory to be used by a frame or worker. In this case both |
| // the |origin| and |request_initiator_origin_lock| are the origin of the |
| // frame or worker (or the origin that is being committed in the frame). |
| // - An isolated-world-specific factory for origins covered via |
| // RenderFrameHost::MarkIsolatedWorldAsRequiringSeparateURLLoaderFactory. |
| // In this case |origin| is the origin of the isolated world and the |
| // |request_initiator_origin_lock| is the origin committed in the frame. |
| virtual void OverrideURLLoaderFactoryParams( |
| BrowserContext* browser_context, |
| const url::Origin& origin, |
| bool is_for_isolated_world, |
| network::mojom::URLLoaderFactoryParams* factory_params); |
| |
| // Returns a list of additional WebUI schemes, if any. These additional |
| // schemes act as aliases to the chrome: scheme. The additional schemes may |
| // or may not serve specific WebUI pages depending on the particular |
| // URLDataSource and its override of URLDataSource::ShouldServiceRequest. |
| virtual void GetAdditionalWebUISchemes( |
| std::vector<std::string>* additional_schemes) {} |
| |
| // Returns a list of additional schemes allowed for view-source. Defaults to |
| // the list of WebUI schemes returned by GetAdditionalWebUISchemes. |
| virtual void GetAdditionalViewSourceSchemes( |
| std::vector<std::string>* additional_schemes); |
| |
| // Computes the IPAddressSpace of the given URL with embedder knowledge. |
| // This is used to assign values to special schemes recognized only by the |
| // embedders of content/. Returns kUnknown if no such scheme was found. |
| // See https://wicg.github.io/private-network-access/ for details on what |
| // the IPAddressSpace represents. |
| virtual network::mojom::IPAddressSpace DetermineAddressSpaceFromURL( |
| const GURL& url); |
| |
| // Called when WebUI objects are created to get aggregate usage data (i.e. is |
| // chrome://downloads used more than chrome://bookmarks?). Only internal (e.g. |
| // chrome://) URLs are logged. Returns whether the URL was actually logged. |
| virtual bool LogWebUIUrl(const GURL& web_ui_url); |
| |
| // http://crbug.com/829412 |
| // Renderers with WebUI bindings shouldn't make http(s) requests for security |
| // reasons (e.g. to avoid malicious responses being able to run code in |
| // priviliged renderers). Fix these webui's to make requests through C++ |
| // code instead. |
| virtual bool IsWebUIAllowedToMakeNetworkRequests(const url::Origin& origin); |
| |
| // Returns whether a specified URL is handled by the embedder's internal |
| // protocol handlers. |
| virtual bool IsHandledURL(const GURL& url); |
| |
| // Returns whether a custom handler is registered for the scheme of the |
| // specified URL scheme. |
| // https://html.spec.whatwg.org/multipage/system-state.html#custom-handlers |
| // TODO(crbug.com/1139176) Move custom protocol handler code to content. |
| virtual bool HasCustomSchemeHandler(content::BrowserContext* browser_context, |
| const std::string& scheme); |
| |
| // Returns whether the given process is allowed to commit |url|. This is a |
| // more conservative check than IsSuitableHost, since it is used after a |
| // navigation has committed to ensure that the process did not exceed its |
| // authority. |
| // This is called on the UI thread. |
| virtual bool CanCommitURL(RenderProcessHost* process_host, const GURL& url); |
| |
| // Allows the embedder to override parameters when navigating. Called for both |
| // opening new URLs and when transferring URLs across processes. |
| // If the initiator of the navigation is set, `source_process_site_url` is |
| // the site URL that the initiator's process is locked to. Generally the |
| // initiator is set on renderer-initiated navigations, but not on |
| // browser-initiated navigations. |
| virtual void OverrideNavigationParams( |
| absl::optional<GURL> source_process_site_url, |
| ui::PageTransition* transition, |
| bool* is_renderer_initiated, |
| content::Referrer* referrer, |
| absl::optional<url::Origin>* initiator_origin) {} |
| |
| // Temporary hack to determine whether to skip OOPIFs on the new tab page. |
| // TODO(creis): Remove when https://crbug.com/566091 is fixed. |
| virtual bool ShouldStayInParentProcessForNTP(const GURL& url, |
| const GURL& parent_site_url); |
| |
| // Returns whether a new view for a given |site_url| can be launched in a |
| // given |process_host|. |
| virtual bool IsSuitableHost(RenderProcessHost* process_host, |
| const GURL& site_url); |
| |
| // Returns whether a new view for a new site instance can be added to a |
| // given |process_host|. |
| virtual bool MayReuseHost(RenderProcessHost* process_host); |
| |
| // Returns a number of processes to ignore when deciding whether to reuse |
| // processes when over the process limit. This is useful for embedders that |
| // may want to partly delay when normal pages start reusing processes (e.g., |
| // if another process type has a large number of processes). Defaults to 0. |
| // Must be less than or equal to the total number of RenderProcessHosts. |
| virtual size_t GetProcessCountToIgnoreForLimit(); |
| |
| // Returns the base permissions policy that is declared in an isolated app's |
| // Web App Manifest. The embedder might choose to return an absl::nullopt in |
| // specific cases -- then the default non-isolated permissions policy will be |
| // applied. |
| virtual absl::optional<blink::ParsedPermissionsPolicy> |
| GetPermissionsPolicyForIsolatedWebApp( |
| content::BrowserContext* browser_context, |
| const url::Origin& app_origin); |
| |
| // Returns whether a new process should be created or an existing one should |
| // be reused based on the URL we want to load. This should return false, |
| // unless there is a good reason otherwise. |
| virtual bool ShouldTryToUseExistingProcessHost( |
| BrowserContext* browser_context, |
| const GURL& url); |
| |
| // Returns whether or not embedded frames (subframes or embedded main frames) |
| // of |outermost_main_frame| should try to aggressively reuse existing |
| // processes, even when below process limit. This gets called when navigating |
| // a subframe to a URL that requires a dedicated process and defaults to true, |
| // which minimizes the process count. The embedder can choose to override |
| // this if there is a reason to avoid the reuse. |
| virtual bool ShouldEmbeddedFramesTryToReuseExistingProcess( |
| RenderFrameHost* outermost_main_frame); |
| |
| // Returns whether a process that no longer has active RenderFrameHosts (or |
| // other reasons to be kept alive) can safely exit. This should return true, |
| // unless the embedder cannot easily handle a process exit in non-live frames. |
| virtual bool ShouldAllowNoLongerUsedProcessToExit(); |
| |
| // Called when a site instance is first associated with a process. |
| virtual void SiteInstanceGotProcess(SiteInstance* site_instance) {} |
| |
| // Returns true if for the navigation from |current_effective_url| to |
| // |destination_effective_url| in |site_instance|, a new SiteInstance and |
| // BrowsingInstance should be created (even if we are in a process model that |
| // doesn't usually swap.) This forces a process swap and severs script |
| // connections with existing tabs. |
| virtual bool ShouldSwapBrowsingInstancesForNavigation( |
| SiteInstance* site_instance, |
| const GURL& current_effective_url, |
| const GURL& destination_effective_url); |
| |
| // Returns true if error page should be isolated in its own process. |
| virtual bool ShouldIsolateErrorPage(bool in_main_frame); |
| |
| // Allows the embedder to programmatically provide some origins that should be |
| // opted into --isolate-origins mode of Site Isolation. |
| virtual std::vector<url::Origin> GetOriginsRequiringDedicatedProcess(); |
| |
| // Allows the embedder to programmatically control whether the |
| // --site-per-process mode of Site Isolation should be used. Note that |
| // returning true here will only take effect if ShouldDisableSiteIsolation() |
| // below returns false. |
| // |
| // Note that for correctness, the same value should be consistently returned. |
| // See also https://crbug.com/825369 |
| virtual bool ShouldEnableStrictSiteIsolation(); |
| |
| // Allows the embedder to programmatically control whether Site Isolation |
| // should be disabled. Note that this takes precedence over |
| // ShouldEnableStrictSiteIsolation() if both return true. |
| // `site_isolation_mode` specifies the site isolation mode to check; this |
| // allows strict site isolation and partial site isolation to be disabled |
| // according to different policies (e.g., different memory thresholds) on |
| // Android. |
| // |
| // Note that for correctness, the same value should be consistently returned. |
| virtual bool ShouldDisableSiteIsolation( |
| SiteIsolationMode site_isolation_mode); |
| |
| // Retrieves names of any additional site isolation modes from the embedder. |
| virtual std::vector<std::string> GetAdditionalSiteIsolationModes(); |
| |
| // Called when a new dynamic isolated origin was added in |context|, and the |
| // origin desires to be persisted across restarts, to give the embedder an |
| // opportunity to save this isolated origin to disk. |
| virtual void PersistIsolatedOrigin( |
| BrowserContext* context, |
| const url::Origin& origin, |
| ChildProcessSecurityPolicy::IsolatedOriginSource source) {} |
| |
| // Returns true if the given URL needs be loaded with the "isolated |
| // application" isolation level. COOP/COEP headers must also be properly set |
| // in order to enable the application isolation level. |
| virtual bool ShouldUrlUseApplicationIsolationLevel( |
| BrowserContext* browser_context, |
| const GURL& url); |
| |
| // Allows the embedder to enable access to Isolated Context Web APIs for the |
| // given |lock_url| -- the URL to which the renderer process is locked. |
| // See [IsolatedContext] IDL attribute for more details. |
| virtual bool IsIsolatedContextAllowedForUrl(BrowserContext* browser_context, |
| const GURL& lock_url); |
| |
| // Check if applications whose origin is |origin| are allowed to perform |
| // all-screens-auto-selection, which allows automatic capturing of all |
| // screens with the getAllScreensMedia API. |
| virtual bool IsGetAllScreensMediaAllowed(content::BrowserContext* context, |
| const url::Origin& origin); |
| |
| // Allow the embedder to control the maximum renderer process count. Only |
| // applies if it is set to a non-zero value. Once this limit is exceeded, |
| // existing processes will be reused whenever possible, see |
| // `ShouldTryToUseExistingProcessHost()`. |
| virtual size_t GetMaxRendererProcessCountOverride(); |
| |
| // Indicates whether a file path should be accessible via file URL given a |
| // request from a browser context which lives within |profile_path|. |
| // |
| // On POSIX platforms, |absolute_path| is the path after resolving all |
| // symboling links. On Windows, if the file URL is a shortcut, |
| // IsFileAccessAllowed will be called twice: Once for the shortcut, which is |
| // treated like a redirect, and once for the destination path after following |
| // the shortcut, assuming access to the shortcut path was allowed. |
| virtual bool IsFileAccessAllowed(const base::FilePath& path, |
| const base::FilePath& absolute_path, |
| const base::FilePath& profile_path); |
| |
| // Indicates whether to force the MIME sniffer to sniff file URLs for HTML. |
| // By default, disabled. May be called on either the UI or IO threads. |
| // See https://crbug.com/777737 |
| virtual bool ForceSniffingFileUrlsForHtml(); |
| |
| // Allows the embedder to pass extra command line flags. |
| // switches::kProcessType will already be set at this point. |
| virtual void AppendExtraCommandLineSwitches(base::CommandLine* command_line, |
| int child_process_id) {} |
| |
| // Returns a client GUID used for virus scanning. |
| virtual std::string GetApplicationClientGUIDForQuarantineCheck(); |
| |
| // Gets a callback which can connect to a Quarantine Service instance if |
| // available. |
| virtual download::QuarantineConnectionCallback |
| GetQuarantineConnectionCallback(); |
| |
| // Returns the locale used by the application. |
| // This is called on the UI and IO threads. |
| virtual std::string GetApplicationLocale(); |
| |
| // Returns a comma-separate list of language codes, in order of preference. |
| // The legacy "accept-language" header is not affected by this setting (see |
| // |ConfigureNetworkContextParams()| below). |
| // (Not called GetAcceptLanguages so it doesn't clash with win32). |
| virtual std::string GetAcceptLangs(BrowserContext* context); |
| |
| // Returns the default favicon. |
| virtual gfx::ImageSkia GetDefaultFavicon(); |
| |
| // Returns the fully qualified path to the log file name, or an empty path. |
| // This function is used by the sandbox to allow write access to the log. |
| virtual base::FilePath GetLoggingFileName( |
| const base::CommandLine& command_line); |
| |
| // Allows the embedder to control if a service worker is allowed at the given |
| // `scope` and can be accessed from `site_for_cookies` and `top_frame_origin`. |
| // `site_for_cookies` is used to determine whether the request is done in a |
| // third-party context. `top_frame_origin` is used to check if any |
| // content_setting affects this request. Only calls that are made within the |
| // context of a tab can provide a proper `top_frame_origin`, otherwise the |
| // scope of the service worker is used. |
| // This function is called whenever an attempt is made to create or access the |
| // persistent state of the registration, or to start the service worker. |
| // |
| // If non-empty, `script_url` is the script of the service worker that is |
| // attempted to be registered or started. If it's empty, an attempt is being |
| // made to access the registration but there is no specific service worker in |
| // the registration being acted on. |
| // |
| // This is called on the UI thread. |
| virtual AllowServiceWorkerResult AllowServiceWorker( |
| const GURL& scope, |
| const net::SiteForCookies& site_for_cookies, |
| const absl::optional<url::Origin>& top_frame_origin, |
| const GURL& script_url, |
| BrowserContext* context); |
| |
| // Returns true if the service worker associated with the given `scope` may be |
| // deleted. This can return false if the service worker is tied to another |
| // service that fundamentally should not be allowed to be removed (today, this |
| // is limited to extensions). |
| virtual bool MayDeleteServiceWorkerRegistration( |
| const GURL& scope, |
| BrowserContext* browser_context); |
| |
| // Returns true if the content layer should attempt to update the service |
| // worker associated with the given `scope`. This can return false if the |
| // service worker is tied to another service that handles the update flow |
| // (today, this is limited to extensions). |
| virtual bool ShouldTryToUpdateServiceWorkerRegistration( |
| const GURL& scope, |
| BrowserContext* browser_context); |
| |
| // Allows the embedder to enable process-wide blink features before starting a |
| // service worker. This is similar to |
| // `blink.mojom.CommitNavigationParams.force_enabled_origin_trials` but for |
| // RuntimeFeatures instead of Origin Trials. |
| // |
| // This method is only called when the process that will run the Service |
| // Worker is isolated. These features can be highly privileged, so the |
| // renderer process with such features enabled shouldn't be used for other |
| // sites. |
| virtual void UpdateEnabledBlinkRuntimeFeaturesInIsolatedWorker( |
| BrowserContext* context, |
| const GURL& script_url, |
| std::vector<std::string>& out_forced_enabled_runtime_features); |
| |
| // Allow the embedder to control if a Shared Worker can be connected from a |
| // given tab. |
| // This is called on the UI thread. |
| virtual bool AllowSharedWorker( |
| const GURL& worker_url, |
| const net::SiteForCookies& site_for_cookies, |
| const absl::optional<url::Origin>& top_frame_origin, |
| const std::string& name, |
| const blink::StorageKey& storage_key, |
| BrowserContext* context, |
| int render_process_id, |
| int render_frame_id); |
| |
| // Allow the embedder to control if a page/worker with |scheme| URL can create |
| // a cross-origin shared workers. |
| virtual bool DoesSchemeAllowCrossOriginSharedWorker( |
| const std::string& scheme); |
| |
| // Allows the embedder to control whether Signed HTTP Exchanges (SXG) can be |
| // loaded. This is called on the UI thread. |
| virtual bool AllowSignedExchange(BrowserContext* context); |
| |
| // Allows the embedder to control whether Compression Dictionary Transport |
| // feature can be used. This is called on the UI thread. |
| virtual bool AllowCompressionDictionaryTransport(BrowserContext* context); |
| |
| virtual bool IsDataSaverEnabled(BrowserContext* context); |
| |
| // Updates the given prefs for Service Worker and Shared Worker. The prefs |
| // are to be sent to the renderer process when a worker is created. Note that |
| // We don't use this method for Dedicated Workers as they inherit preferences |
| // from their closest ancestor frame. |
| virtual void UpdateRendererPreferencesForWorker( |
| BrowserContext* browser_context, |
| blink::RendererPreferences* out_prefs); |
| |
| // Requests access to |files| in order to be sent to |destination_url|. |
| // |continuation_callback| is called with a token that should be held until |
| // `open()` operation on the files is finished. |
| virtual void RequestFilesAccess( |
| const std::vector<base::FilePath>& files, |
| const GURL& destination_url, |
| base::OnceCallback<void(file_access::ScopedFileAccess)> |
| continuation_callback); |
| |
| // Allow the embedder to control if access to file system by a shared worker |
| // is allowed. |
| virtual void AllowWorkerFileSystem( |
| const GURL& url, |
| BrowserContext* browser_context, |
| const std::vector<GlobalRenderFrameHostId>& render_frames, |
| base::OnceCallback<void(bool)> callback); |
| |
| // Allow the embedder to control if access to IndexedDB by a shared worker |
| // is allowed. |
| virtual bool AllowWorkerIndexedDB( |
| const GURL& url, |
| BrowserContext* browser_context, |
| const std::vector<GlobalRenderFrameHostId>& render_frames); |
| |
| // Allow the embedder to control if access to Web Locks by a shared worker |
| // is allowed. |
| virtual bool AllowWorkerWebLocks( |
| const GURL& url, |
| BrowserContext* browser_context, |
| const std::vector<GlobalRenderFrameHostId>& render_frames); |
| |
| // Allow the embedder to control if access to CacheStorage by a shared worker |
| // is allowed. |
| virtual bool AllowWorkerCacheStorage( |
| const GURL& url, |
| BrowserContext* browser_context, |
| const std::vector<GlobalRenderFrameHostId>& render_frames); |
| |
| // Allow the embedder to control whether we can use Web Bluetooth. |
| // TODO(crbug.com/589228): Replace this with a use of the permission system. |
| enum class AllowWebBluetoothResult { |
| ALLOW, |
| BLOCK_POLICY, |
| BLOCK_GLOBALLY_DISABLED, |
| }; |
| virtual AllowWebBluetoothResult AllowWebBluetooth( |
| content::BrowserContext* browser_context, |
| const url::Origin& requesting_origin, |
| const url::Origin& embedding_origin); |
| |
| // Returns a blocklist of UUIDs that have restrictions when accessed |
| // via Web Bluetooth. Parsed by BluetoothBlocklist::Add(). |
| // |
| // The blocklist string must be a comma-separated list of UUID:exclusion |
| // pairs. The pairs may be separated by whitespace. Pair components are |
| // colon-separated and must not have whitespace around the colon. |
| // |
| // UUIDs are a string that BluetoothUUID can parse (See BluetoothUUID |
| // constructor comment). Exclusion values are a single lower case character |
| // string "e", "r", or "w" for EXCLUDE, EXCLUDE_READS, or EXCLUDE_WRITES. |
| // |
| // Example: |
| // "1812:e, 00001800-0000-1000-8000-00805f9b34fb:w, ignored:1, alsoignored." |
| virtual std::string GetWebBluetoothBlocklist(); |
| |
| using InterestGroupApiOperation = content::InterestGroupApiOperation; |
| |
| // Returns whether |api_origin| on |top_frame_origin| can perform |
| // |operation| within the interest group API. |
| virtual bool IsInterestGroupAPIAllowed( |
| content::RenderFrameHost* render_frame_host, |
| InterestGroupApiOperation operation, |
| const url::Origin& top_frame_origin, |
| const url::Origin& api_origin); |
| |
| // Returns whether |destination_origin| can receive beacons sent through |
| // window.fence.reportEvent() or automatic beacons. |
| // Before M120: The reporting destination is required to be attested for its |
| // invoking API only. |
| // M120 and afterwards: If this is a post-impression reporting beacon invoked |
| // by Protected Audience API, the destination is required to be attested for |
| // either Protected Audience or Attribution Reporting, instead of Protected |
| // Audience only. This is because there are use cases that an adtech may need |
| // to measure Protected Audience ads, but not using any of the ads |
| // personalization or targeting features of Protected Audience. The adtech |
| // should be allowed to receive post-impression beacons if it is attested for |
| // Attribution Reporting. |
| virtual bool IsPrivacySandboxReportingDestinationAttested( |
| content::BrowserContext* browser_context, |
| const url::Origin& destination_origin, |
| content::PrivacySandboxInvokingAPI invoking_api, |
| bool post_impression_reporting); |
| |
| virtual void OnAuctionComplete( |
| RenderFrameHost* render_frame_host, |
| InterestGroupManager::InterestGroupDataKey data_key); |
| |
| // These values are persisted to logs. Entries should not be renumbered and |
| // numeric values should never be reused. |
| enum class AttributionReportingOsApiState { |
| kDisabled = 0, |
| kEnabled = 1, |
| kMaxValue = kEnabled, |
| }; |
| |
| // Allows the embedder to control the type of attribution reporting allowed. |
| // Web, Os, both or none |
| virtual network::mojom::AttributionSupport GetAttributionSupport( |
| AttributionReportingOsApiState state, |
| content::WebContents* web_contents); |
| |
| enum class AttributionReportingOperation { |
| kSource, |
| kTrigger, |
| kReport, |
| kSourceVerboseDebugReport, |
| kTriggerVerboseDebugReport, |
| kOsSource, |
| kOsTrigger, |
| kOsSourceVerboseDebugReport, |
| kOsTriggerVerboseDebugReport, |
| kSourceTransitionalDebugReporting, |
| kTriggerTransitionalDebugReporting, |
| kOsSourceTransitionalDebugReporting, |
| kOsTriggerTransitionalDebugReporting, |
| kAny, |
| }; |
| |
| // Allows the embedder to control if Attribution Reporting API operations can |
| // happen in a given context. Origins must be provided for a given operation |
| // as follows: |
| // - `kSource`, `kOsSource`, `kSourceTransitionalDebugReporting` and |
| // `kOsSourceTransitionalDebugReporting` must provide a non-null |
| // `source_origin` and `reporting_origin` |
| // - `kTrigger`, `kOsTrigger`, `kTriggerTransitionalDebugReporting` and |
| // `kOsTriggerTransitionalDebugReporting` must provide a non-null |
| // `destination_origin` and `reporting_origin` |
| // - `kReport` must provide all non-null origins |
| // - `kAny` may provide all null origins. It checks whether conversion |
| // measurement is allowed anywhere in `browser_context`, returning false if |
| // Attribution Reporting is not allowed by default on any origin. |
| // `can_bypass` is an out parameter that is used for transitional debug |
| // reporting to indicate whether the result can be bypassed if disallowed. |
| // `can_bypass` is required to be non-null for |
| // `kSourceTransitionalDebugReporting`, `kOsSourceTransitionalDebugReporting`, |
| // `kTriggerTransitionalDebugReporting` and |
| // `kOsTriggerTransitionalDebugReporting`. |
| // |
| // TODO(https://crbug.com/1501357): Clean up `can_bypass` after the cookie |
| // deprecation experiment. |
| virtual bool IsAttributionReportingOperationAllowed( |
| content::BrowserContext* browser_context, |
| AttributionReportingOperation operation, |
| content::RenderFrameHost* rfh, |
| const url::Origin* source_origin, |
| const url::Origin* destination_origin, |
| const url::Origin* reporting_origin, |
| bool* can_bypass); |
| |
| // Allows the embedder to control if an OS source event should register as |
| // a Web OS or OS (App) source. |
| virtual bool ShouldUseOsWebSourceAttributionReporting( |
| content::RenderFrameHost* rfh); |
| |
| // Allows the embedder to control if an OS trigger event should register as |
| // a Web OS or OS (App) trigger. |
| virtual bool ShouldUseOsWebTriggerAttributionReporting( |
| content::RenderFrameHost* rfh); |
| |
| // Allows the embedder to control if Shared Storage API operations can happen |
| // in a given context. |
| // |
| // Note that `rfh` can be nullptr. |
| virtual bool IsSharedStorageAllowed(content::BrowserContext* browser_context, |
| content::RenderFrameHost* rfh, |
| const url::Origin& top_frame_origin, |
| const url::Origin& accessing_origin); |
| |
| // Allows the embedder to control if Shared Storage API `selectURL()` can |
| // happen in a given context. |
| virtual bool IsSharedStorageSelectURLAllowed( |
| content::BrowserContext* browser_context, |
| const url::Origin& top_frame_origin, |
| const url::Origin& accessing_origin); |
| |
| // Allows the embedder to control if Private Aggregation API operations can |
| // happen in a given context. |
| virtual bool IsPrivateAggregationAllowed( |
| content::BrowserContext* browser_context, |
| const url::Origin& top_frame_origin, |
| const url::Origin& reporting_origin); |
| |
| // Allows the embedder to control if Private Aggregation API debug mode |
| // operations can happen in a given context. |
| virtual bool IsPrivateAggregationDebugModeAllowed( |
| content::BrowserContext* browser_context, |
| const url::Origin& top_frame_origin, |
| const url::Origin& reporting_origin); |
| |
| // Returns whether cookie deprecation label should be allowed for the |
| // profile. Defaults to false to ensure no traffic label is sent by default. |
| virtual bool IsCookieDeprecationLabelAllowed( |
| content::BrowserContext* browser_context); |
| |
| // Returns whether cookie deprecation label should be allowed for the |
| // profile in a given context. Defaults to false to ensure no traffic label |
| // is sent by default. |
| virtual bool IsCookieDeprecationLabelAllowedForContext( |
| content::BrowserContext* browser_context, |
| const url::Origin& top_frame_origin, |
| const url::Origin& context_origin); |
| |
| // Returns whether cookies should be allowed for requests to `url`, fetched |
| // from contexts whose storage is keyed on `storage_key`. |
| virtual bool IsFullCookieAccessAllowed( |
| content::BrowserContext* browser_context, |
| const GURL& url, |
| const blink::StorageKey& storage_key); |
| |
| #if BUILDFLAG(IS_CHROMEOS) |
| // Notification that a trust anchor was used by the given user. |
| virtual void OnTrustAnchorUsed(BrowserContext* browser_context) {} |
| #endif |
| |
| // Allows the embedder to implement policy for whether an SCT auditing report |
| // should be sent. |
| virtual bool CanSendSCTAuditingReport(BrowserContext* browser_context); |
| |
| // Notification that a new SCT auditing report has been sent. |
| virtual void OnNewSCTAuditingReportSent(BrowserContext* browser_context) {} |
| |
| // Allows the embedder to override the LocationProvider implementation. |
| // Return nullptr to indicate the default one for the platform should be |
| // created. This is used by Qt, see |
| // https://bugs.chromium.org/p/chromium/issues/detail?id=725057#c7 |
| virtual std::unique_ptr<device::LocationProvider> |
| OverrideSystemLocationProvider(); |
| |
| // Returns a SharedURLLoaderFactory attached to the system network context. |
| // Must be called on the UI thread. The default implementation returns |
| // nullptr. |
| virtual scoped_refptr<network::SharedURLLoaderFactory> |
| GetSystemSharedURLLoaderFactory(); |
| |
| // Returns the system network context. This shouldn't be used to create a |
| // URLLoaderFactory, instead use GetSystemSharedURLLoaderFactory(). Must be |
| // called on the UI thread. The default implementation returns nullptr. |
| virtual network::mojom::NetworkContext* GetSystemNetworkContext(); |
| |
| // Allows an embedder to provide a Google API Key to use for network |
| // geolocation queries. |
| // * May be called from any thread. |
| // * Default implementation returns empty string, meaning send no API key. |
| virtual std::string GetGeolocationApiKey(); |
| |
| // Returns the global BrowserProcessPlatformParts' GeolocationManager on |
| // macOS and returns nullptr otherwise. For tests this should return a |
| // FakeGeolocationManager with the LocationSystemPermissionStatus set to |
| // allow. |
| virtual device::GeolocationManager* GetGeolocationManager(); |
| |
| #if BUILDFLAG(IS_ANDROID) |
| // Allows an embedder to decide whether to use the GmsCoreLocationProvider. |
| virtual bool ShouldUseGmsCoreGeolocationProvider(); |
| #endif |
| |
| // Allows the embedder to provide a storage partition configuration for a |
| // site. A storage partition configuration includes a domain of the embedder's |
| // choice, an optional name within that domain, and whether the partition is |
| // in-memory only. |
| virtual StoragePartitionConfig GetStoragePartitionConfigForSite( |
| BrowserContext* browser_context, |
| const GURL& site); |
| |
| // Allows the embedder to provide settings that determine if generated code |
| // can be cached and the amount of disk space used for caching generated code. |
| virtual GeneratedCodeCacheSettings GetGeneratedCodeCacheSettings( |
| BrowserContext* context); |
| |
| // Informs the embedder that a certificate error has occurred. If |
| // |overridable| is true and if |strict_enforcement| is false, the user |
| // can ignore the error and continue. The embedder can call the callback |
| // asynchronously. |
| virtual void AllowCertificateError( |
| WebContents* web_contents, |
| int cert_error, |
| const net::SSLInfo& ssl_info, |
| const GURL& request_url, |
| bool is_primary_main_frame_request, |
| bool strict_enforcement, |
| base::OnceCallback<void(CertificateRequestResultType)> callback); |
| |
| // Returns true if all requests with certificate errors should be blocked |
| // for a given |main_frame_url|, regardless of any other security settings. |
| virtual bool ShouldDenyRequestOnCertificateError(const GURL main_frame_url); |
| |
| // Selects a SSL client certificate and returns it to the |delegate|. Note: |
| // |delegate| may be called synchronously or asynchronously. |
| // |
| // Returns a callback that cancels the UI element corresponding to this |
| // request. The callback should expect to be invoked on the UI thread. The |
| // callback may be null. The callback is not required to be invoked. |
| // `web_contents` may be null if the requestor was called from something |
| // without an associated WebContents, like a service worker. In this case, UI |
| // should not be shown, but a certificate may still be provided (such as when |
| // the certificate is auto-selected by policy). |
| virtual base::OnceClosure SelectClientCertificate( |
| BrowserContext* browser_context, |
| WebContents* web_contents, |
| net::SSLCertRequestInfo* cert_request_info, |
| net::ClientCertIdentityList client_certs, |
| std::unique_ptr<ClientCertificateDelegate> delegate); |
| |
| // Returns a class to get notifications about media event. The embedder can |
| // return nullptr if they're not interested. |
| virtual MediaObserver* GetMediaObserver(); |
| |
| // Returns a class to observe usage of features. The embedder can return |
| // nullptr if they're not interested. The returned FeatureObserverClient must |
| // stay alive until BrowserMainParts::PostDestroyThreads() is called and |
| // threads are destroyed. Its interface will always be called from the same |
| // sequence. |
| virtual FeatureObserverClient* GetFeatureObserverClient(); |
| |
| // Returns true if the given page is allowed to open a window of the given |
| // type. If true is returned, |no_javascript_access| will indicate whether |
| // the window that is created should be scriptable/in the same process. |
| // This is called on the UI thread. |
| virtual bool CanCreateWindow( |
| RenderFrameHost* opener, |
| const GURL& opener_url, |
| const GURL& opener_top_level_frame_url, |
| const url::Origin& source_origin, |
| content::mojom::WindowContainerType container_type, |
| const GURL& target_url, |
| const Referrer& referrer, |
| const std::string& frame_name, |
| WindowOpenDisposition disposition, |
| const blink::mojom::WindowFeatures& features, |
| bool user_gesture, |
| bool opener_suppressed, |
| bool* no_javascript_access); |
| |
| // Allows the embedder to return a delegate for the SpeechRecognitionManager. |
| // The delegate will be owned by the manager. It's valid to return nullptr. |
| virtual SpeechRecognitionManagerDelegate* |
| CreateSpeechRecognitionManagerDelegate(); |
| |
| #if BUILDFLAG(IS_CHROMEOS_ASH) |
| // Allows the embedder to return a delegate for the TtsController. |
| virtual TtsControllerDelegate* GetTtsControllerDelegate(); |
| #endif |
| |
| // Applies policy-dictated changes to the manifest that was loaded from the |
| // provided render_frame_host. |
| virtual void MaybeOverrideManifest(RenderFrameHost* render_frame_host, |
| blink::mojom::ManifestPtr& manifest) {} |
| |
| // Allows the embedder to return a TTS platform implementation. |
| virtual TtsPlatform* GetTtsPlatform(); |
| |
| #if !BUILDFLAG(IS_ANDROID) |
| // Allows the embedder to return a DirectSocketsDelegate |
| // implementation. |
| virtual DirectSocketsDelegate* GetDirectSocketsDelegate(); |
| #endif |
| |
| // Called by WebContents to override the WebKit preferences that are used by |
| // the renderer. The content layer will add its own settings, and then it's up |
| // to the embedder to update it if it wants. |
| virtual void OverrideWebkitPrefs(WebContents* web_contents, |
| blink::web_pref::WebPreferences* prefs) {} |
| |
| // Similar to OverrideWebkitPrefs, but is only called after navigations. Some |
| // attributes in WebPreferences might need its value updated after navigation, |
| // and this method will give the opportunity for embedder to update them. |
| // Returns true if some values |prefs| changed due to embedder override. |
| virtual bool OverrideWebPreferencesAfterNavigation( |
| WebContents* web_contents, |
| blink::web_pref::WebPreferences* prefs); |
| |
| // Notifies that BrowserURLHandler has been created, so that the embedder can |
| // optionally add their own handlers. |
| virtual void BrowserURLHandlerCreated(BrowserURLHandler* handler) {} |
| |
| // Returns the default download directory. |
| // This can be called on any thread. |
| virtual base::FilePath GetDefaultDownloadDirectory(); |
| |
| // Returns the default filename used in downloads when we have no idea what |
| // else we should do with the file. |
| virtual std::string GetDefaultDownloadName(); |
| |
| // Returns the path to the browser shader disk cache root. |
| virtual base::FilePath GetShaderDiskCacheDirectory(); |
| |
| // Returns the path to the shader disk cache root for shaders generated by |
| // skia. |
| virtual base::FilePath GetGrShaderDiskCacheDirectory(); |
| |
| // Returns the path to the shader disk cache root for shaders generated by |
| // graphite dawn. |
| virtual base::FilePath GetGraphiteDawnDiskCacheDirectory(); |
| |
| // Returns the path to the net log default directory. |
| virtual base::FilePath GetNetLogDefaultDirectory(); |
| |
| // Returns the path to the First-Party Sets directory. |
| virtual base::FilePath GetFirstPartySetsDirectory(); |
| |
| // Returns the path to Local Traces directory. |
| virtual absl::optional<base::FilePath> GetLocalTracesDirectory(); |
| |
| // Notification that a pepper plugin has just been spawned. This allows the |
| // embedder to add filters onto the host to implement interfaces. |
| // This is called on the IO thread. |
| virtual void DidCreatePpapiPlugin(BrowserPpapiHost* browser_host) {} |
| |
| // Gets the host for an external out-of-process plugin. |
| virtual BrowserPpapiHost* GetExternalBrowserPpapiHost(int plugin_child_id); |
| |
| // Returns true if the socket operation specified by |params| is allowed from |
| // the given |browser_context| and |url|. If |params| is nullptr, this method |
| // checks the basic "socket" permission, which is for those operations that |
| // don't require a specific socket permission rule. |
| // |private_api| indicates whether this permission check is for the private |
| // Pepper socket API or the public one. |
| virtual bool AllowPepperSocketAPI(BrowserContext* browser_context, |
| const GURL& url, |
| bool private_api, |
| const SocketPermissionRequest* params); |
| |
| // Returns true if the "vpnProvider" permission is allowed from the given |
| // |browser_context| and |url|. |
| virtual bool IsPepperVpnProviderAPIAllowed(BrowserContext* browser_context, |
| const GURL& url); |
| |
| // Creates a new VpnServiceProxy. The caller owns the returned value. It's |
| // valid to return nullptr. |
| virtual std::unique_ptr<VpnServiceProxy> GetVpnServiceProxy( |
| BrowserContext* browser_context); |
| |
| // Returns an implementation of a file selecition policy. Can return null. |
| virtual std::unique_ptr<ui::SelectFilePolicy> CreateSelectFilePolicy( |
| WebContents* web_contents); |
| |
| // Returns additional allowed scheme set which can access files in |
| // FileSystem API. |
| virtual void GetAdditionalAllowedSchemesForFileSystem( |
| std::vector<std::string>* additional_schemes) {} |
| |
| // |schemes| is a return value parameter that gets an allowlist of schemes |
| // that should bypass the Is Privileged Context check. |
| // See http://www.w3.org/TR/powerful-features/#settings-privileged |
| virtual void GetSchemesBypassingSecureContextCheckAllowlist( |
| std::set<std::string>* schemes) {} |
| |
| // Returns auto mount handlers for URL requests for FileSystem APIs. |
| virtual void GetURLRequestAutoMountHandlers( |
| std::vector<storage::URLRequestAutoMountHandler>* handlers) {} |
| |
| // Returns additional file system backends for FileSystem API. |
| // |browser_context| is needed in the additional FileSystemBackends. |
| // It has mount points to create objects returned by additional |
| // FileSystemBackends, and SpecialStoragePolicy for permission granting. |
| virtual void GetAdditionalFileSystemBackends( |
| BrowserContext* browser_context, |
| const base::FilePath& storage_partition_path, |
| std::vector<std::unique_ptr<storage::FileSystemBackend>>* |
| additional_backends) {} |
| |
| // Creates a new DevToolsManagerDelegate. It's valid to return nullptr. |
| virtual std::unique_ptr<content::DevToolsManagerDelegate> |
| CreateDevToolsManagerDelegate(); |
| |
| // Stores the new expiration time up until which events related to |service| |
| // can still be logged. |service| is the int value of the |
| // DevToolsBackgroundService enum. |expiration_time| can be null, denoting |
| // that nothing should be recorded any more. |
| virtual void UpdateDevToolsBackgroundServiceExpiration( |
| BrowserContext* browser_context, |
| int service, |
| base::Time expiration_time); |
| |
| // Returns a mapping from a background service to the time up until which |
| // recording the background service's events is still allowed. |
| virtual base::flat_map<int, base::Time> |
| GetDevToolsBackgroundServiceExpirations(BrowserContext* browser_context); |
| |
| // Creates a new TracingDelegate. The caller owns the returned value. |
| // It's valid to return nullptr. |
| virtual TracingDelegate* GetTracingDelegate(); |
| |
| // Returns true if plugin referred to by the url can use |
| // pp::FileIO::RequestOSFileHandle. |
| virtual bool IsPluginAllowedToCallRequestOSFileHandle( |
| BrowserContext* browser_context, |
| const GURL& url); |
| |
| // Returns true if dev channel APIs are available for plugins. |
| virtual bool IsPluginAllowedToUseDevChannelAPIs( |
| BrowserContext* browser_context, |
| const GURL& url); |
| |
| // Allows to register browser interfaces exposed through the |
| // RenderProcessHost. Note that interface factory callbacks added to |
| // |registry| will by default be run immediately on the IO thread, unless a |
| // task runner is provided. |
| virtual void ExposeInterfacesToRenderer( |
| service_manager::BinderRegistry* registry, |
| blink::AssociatedInterfaceRegistry* associated_registry, |
| RenderProcessHost* render_process_host) {} |
| |
| // Called to bind additional frame-bound media interfaces to the renderer. |
| virtual void BindMediaServiceReceiver(RenderFrameHost* render_frame_host, |
| mojo::GenericPendingReceiver receiver) { |
| } |
| |
| // The Media Service can run in many different types of configurations |
| // (typically in the GPU process or its own isolated process), but some |
| // clients want an additional dedicated instance to use for specific |
| // operations (e.g. for rendering protected content). Clients should override |
| // this to create such an instance, and return a bound Remote to control it. |
| // See MediaInterfaceProxy and MediaInterfaceFactoryHolder for usage. |
| virtual mojo::Remote<media::mojom::MediaService> RunSecondaryMediaService(); |
| |
| // Allows to register browser interfaces exposed through the RenderFrameHost. |
| // This mechanism will replace interface registries and binders used for |
| // handling InterfaceProvider's GetInterface() calls (see crbug.com/718652). |
| virtual void RegisterBrowserInterfaceBindersForFrame( |
| RenderFrameHost* render_frame_host, |
| mojo::BinderMapWithContext<RenderFrameHost*>* map) {} |
| |
| // Allows the embedder to control when Mojo interface binders are run for a |
| // frame that is in a managed mode, such as prerendering and preview mode. |
| // |
| // Prerender2 limits inactivated pages' capabilities by controlling when to |
| // bind Mojo interfaces. See content/browser/preloading/prerender/README.md |
| // for more about capability control. |
| // |
| // Preview mode follows the same limits that Prerender2 defines, and the page |
| // behaves as a prerendered page in Blink. But as the preview page is visible |
| // to users, we relax the restriction a little to permit rendering related |
| // operations. |
| // |
| // The embedder can add entries to `policy_map` for interfaces that it |
| // registers in `RegisterBrowserInterfaceBindersForFrame()` and |
| // `RegisterAssociatedInterfaceBindersForRenderFrameHost ()`. It should not |
| // change or remove existing entries. |
| // |
| // This function is called at most once, when the first RenderFrameHost is |
| // created for prerendering a page that is same-origin to the page that |
| // triggered the prerender. |
| virtual void RegisterMojoBinderPoliciesForSameOriginPrerendering( |
| MojoBinderPolicyMap& policy_map) {} |
| virtual void RegisterMojoBinderPoliciesForPreview( |
| MojoBinderPolicyMap& policy_map) {} |
| |
| // Allows to register browser interfaces which are exposed to a service worker |
| // execution context. |
| virtual void RegisterBrowserInterfaceBindersForServiceWorker( |
| BrowserContext* browser_context, |
| const ServiceWorkerVersionBaseInfo& service_worker_version_info, |
| mojo::BinderMapWithContext<const ServiceWorkerVersionBaseInfo&>* map) {} |
| |
| // Allows the embedder to register browser channel-associated interfaces that |
| // are exposed through the ServiceWorker. `service_worker_version_info` |
| // contains the information to uniquely identify the service worker instance. |
| // `associated_registry` contains interfaces provided by the browser. |
| virtual void RegisterAssociatedInterfaceBindersForServiceWorker( |
| const ServiceWorkerVersionBaseInfo& service_worker_version_info, |
| blink::AssociatedInterfaceRegistry& associated_registry) {} |
| |
| // Allows the embedder to register per-WebUI interface brokers that are used |
| // for handling Mojo.bindInterface in WebUI JavaScript. |
| // |
| // The exposed interfaces are grouped by the WebUI controller type. For any |
| // given WebUI page, only the interfaces corresponding to its controller type |
| // will be exposed. |
| virtual void RegisterWebUIInterfaceBrokers( |
| WebUIBrowserInterfaceBrokerRegistry& registry) {} |
| |
| // Allows the embedder to register browser channel-associated interfaces that |
| // are exposed through the RenderFrameHost. |
| virtual void RegisterAssociatedInterfaceBindersForRenderFrameHost( |
| RenderFrameHost& render_frame_host, |
| blink::AssociatedInterfaceRegistry& associated_registry); |
| |
| // Handles an unhandled incoming interface binding request from the GPU |
| // process. Called on the IO thread. |
| virtual void BindGpuHostReceiver(mojo::GenericPendingReceiver receiver) {} |
| |
| // Handles an unhandled incoming interface binding request from a Utility |
| // process. Called on the IO thread. |
| virtual void BindUtilityHostReceiver(mojo::GenericPendingReceiver receiver) {} |
| |
| // Called on the main thread to handle an unhandled interface receiver binding |
| // request from a render process. See |RenderThread::BindHostReceiver()|. |
| virtual void BindHostReceiverForRenderer( |
| RenderProcessHost* render_process_host, |
| mojo::GenericPendingReceiver receiver) {} |
| |
| // Allows to override the visibility state of a RenderFrameHost. |
| // |visibility_state| should not be null. It will only be set if needed. |
| virtual void OverridePageVisibilityState( |
| RenderFrameHost* render_frame_host, |
| PageVisibilityState* visibility_state) {} |
| |
| // Allows an embedder to provide its own ControllerPresentationServiceDelegate |
| // implementation. Returns nullptr if unavailable. |
| virtual ControllerPresentationServiceDelegate* |
| GetControllerPresentationServiceDelegate(WebContents* web_contents); |
| |
| // Allows an embedder to provide its own ReceiverPresentationServiceDelegate |
| // implementation. Returns nullptr if unavailable. Only WebContents created |
| // for offscreen presentations should be passed to this API. The WebContents |
| // must belong to an incognito profile. |
| virtual ReceiverPresentationServiceDelegate* |
| GetReceiverPresentationServiceDelegate(WebContents* web_contents); |
| |
| // Add or remove an observer for presentations associated with `web_contents`. |
| virtual void AddPresentationObserver(PresentationObserver* observer, |
| WebContents* web_contents); |
| virtual void RemovePresentationObserver(PresentationObserver* observer, |
| WebContents* web_contents); |
| |
| // Add or remove an observer for privacy sandbox attestations. Returns true if |
| // privacy sandbox attestations have ever been loaded, or if attestations are |
| // not enforced. |
| virtual bool AddPrivacySandboxAttestationsObserver( |
| PrivacySandboxAttestationsObserver* observer); |
| virtual void RemovePrivacySandboxAttestationsObserver( |
| PrivacySandboxAttestationsObserver* observer); |
| |
| // Allows programmatic opening of a new tab/window without going through |
| // another WebContents. For example, from a Worker. |site_instance| |
| // describes the context initiating the navigation. |callback| will be |
| // invoked with the appropriate WebContents* when available. |
| virtual void OpenURL(SiteInstance* site_instance, |
| const OpenURLParams& params, |
| base::OnceCallback<void(WebContents*)> callback); |
| |
| // Allows the embedder to register one or more NavigationThrottles for the |
| // navigation indicated by |navigation_handle|. A NavigationThrottle is used |
| // to control the flow of a navigation on the UI thread. The embedder is |
| // guaranteed that the throttles will be executed in the order they were |
| // provided. NavigationThrottles are run only for document loading |
| // navigations; they are specifically not run for page activating navigations |
| // such as prerender activation and back-forward cache restores or for |
| // navigations that don't use a URLLoader like same-document navigations. |
| virtual std::vector<std::unique_ptr<NavigationThrottle>> |
| CreateThrottlesForNavigation(NavigationHandle* navigation_handle); |
| |
| // Allows the embedder to register one or more CommitDeferringConditions for |
| // the navigation indicated by |navigation_handle|. A |
| // CommitDeferringCondition is used to delay committing a navigation until an |
| // embedder-defined condition is met. Similar to NavigationThrottles, |
| // CommitDeferringConditions are not used in navigations that don't use a |
| // URLLoader, like same-document navigations. Unlike NavigationThrottles, |
| // CommitDeferringConditions are also run on page activating navigations such |
| // as prerender activation and back-forward cache restores. |
| virtual std::vector<std::unique_ptr<CommitDeferringCondition>> |
| CreateCommitDeferringConditionsForNavigation( |
| NavigationHandle* navigation_handle, |
| content::CommitDeferringCondition::NavigationType type); |
| |
| // Called at the start of the navigation to get opaque data the embedder |
| // wants to see passed to the corresponding URLRequest on the IO thread. |
| virtual std::unique_ptr<NavigationUIData> GetNavigationUIData( |
| NavigationHandle* navigation_handle); |
| |
| // Allows the embedder to provide its own AudioManager implementation. |
| // If this function returns nullptr, a default platform implementation |
| // will be used. |
| virtual std::unique_ptr<media::AudioManager> CreateAudioManager( |
| media::AudioLogFactory* audio_log_factory); |
| |
| // The ScreenEnumerator object can be used to query all attached screens |
| // at once. This function should be called on the IO thread. |
| virtual std::unique_ptr<media::ScreenEnumerator> CreateScreenEnumerator() |
| const; |
| |
| // Returns true if (and only if) CreateAudioManager() is implemented and |
| // returns a non-null value. |
| virtual bool OverridesAudioManager(); |
| |
| // Returns true if the system audio echo cancellation shall be enforced. |
| virtual bool EnforceSystemAudioEchoCancellation(); |
| |
| // Populates |mappings| with all files that need to be mapped before launching |
| // a child process. |
| #if (BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC)) || BUILDFLAG(IS_FUCHSIA) |
| virtual void GetAdditionalMappedFilesForChildProcess( |
| const base::CommandLine& command_line, |
| int child_process_id, |
| content::PosixFileDescriptorInfo* mappings) {} |
| #endif // BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA) |
| |
| #if BUILDFLAG(IS_CHROMEOS_LACROS) |
| // Populates |mappings| with all files that need to be mapped before launching |
| // a Zygote process. |
| virtual void GetAdditionalMappedFilesForZygote( |
| base::CommandLine* command_line, |
| content::PosixFileDescriptorInfo* mappings) {} |
| #endif // BUILDFLAG(IS_CHROMEOS_LACROS) |
| |
| #if BUILDFLAG(IS_WIN) |
| // Defines flags that can be passed to PreSpawnChild. |
| enum ChildSpawnFlags { |
| kChildSpawnFlagNone = 0, |
| kChildSpawnFlagRendererCodeIntegrity = 1 << 0, |
| }; |
| |
| // Defines flags that can be passed to GetAppContainerSidForSandboxType. |
| enum AppContainerFlags { |
| kAppContainerFlagNone = 0, |
| kAppContainerFlagDisableAppContainer = 1 << 0, |
| }; |
| |
| // This may be called on the PROCESS_LAUNCHER thread before the child process |
| // configuration is set. It gives the embedder a chance to modify the sandbox |
| // configuration. Returns false if configuration is invalid and the child |
| // should not spawn. Only use this for embedder-specific policies, since the |
| // bulk of sandbox policies should go inside the relevant |
| // SandboxedProcessLauncherDelegate. |
| virtual bool PreSpawnChild(sandbox::TargetConfig* config, |
| sandbox::mojom::Sandbox sandbox_type, |
| ChildSpawnFlags flags); |
| |
| // This may be called on the PROCESS_LAUNCHER thread before the child process |
| // is launched. It gives the embedder a chance to indicate that a process will |
| // not be compatible with Hardware-enforced Stack Protection (CET). |
| // |utility_sub_type| should match that provided on the command line to the |
| // child process. Only use this for embedder-specific processes, and prefer to |
| // key off Sandbox in the relevant SandboxedProcessLauncherDelegate. |
| virtual bool IsUtilityCetCompatible(const std::string& utility_sub_type); |
| |
| // Returns the AppContainer SID for the specified sandboxed process type, or |
| // empty string if this sandboxed process type does not support living inside |
| // an AppContainer. Called on PROCESS_LAUNCHER thread. |
| // `flags` can signal to the embedder any special behavior that should happen |
| // for the `sandbox_type`. |
| virtual std::wstring GetAppContainerSidForSandboxType( |
| sandbox::mojom::Sandbox sandbox_type, |
| AppContainerFlags flags); |
| |
| // Returns true if renderer App Container should be disabled. |
| // This is called on the UI thread. |
| virtual bool IsRendererAppContainerDisabled(); |
| |
| // Returns the LPAC capability name to use for file data that the network |
| // service needs to access to when running within LPAC sandbox. Embedders |
| // should override this with their own unique name to ensure security of the |
| // network service data. |
| virtual std::wstring GetLPACCapabilityNameForNetworkService(); |
| |
| // Returns whether renderer code integrity is enabled. |
| // This is called on the UI thread. |
| virtual bool IsRendererCodeIntegrityEnabled(); |
| |
| // Performs a fast and orderly shutdown of the browser. If present, |
| // `control_type` is a CTRL_* value from a Windows console control handler; |
| // see https://learn.microsoft.com/en-us/windows/console/handlerroutine. |
| virtual void SessionEnding(absl::optional<DWORD> control_type) {} |
| |
| // Returns true if the audio process should run with high priority. false |
| // otherwise. |
| virtual bool ShouldEnableAudioProcessHighPriority(); |
| #endif |
| |
| // Binds a new media remoter service to |receiver|, if supported by the |
| // embedder, for the |source| that lives in the render frame represented |
| // by |render_frame_host|. This may be called multiple times if there is more |
| // than one source candidate in the same render frame. |
| virtual void CreateMediaRemoter( |
| RenderFrameHost* render_frame_host, |
| mojo::PendingRemote<media::mojom::RemotingSource> source, |
| mojo::PendingReceiver<media::mojom::Remoter> receiver) {} |
| |
| // Allows the embedder to register one or more URLLoaderThrottles for a |
| // browser-initiated request. These include navigation requests and requests |
| // for web worker scripts. |
| // |
| // |wc_getter| returns the WebContents of the context of the |request| when |
| // available. It can return nullptr for requests for which it there are no |
| // WebContents (e.g., requests for web workers). |
| // |
| // |navigation_ui_data| is only valid if this is a navigation request. |
| // |
| // |frame_tree_node_id| is also invalid (kNoFrameTreeNodeId) in some cases |
| // (e.g., requests for web workers). |
| // |
| // This is called on the UI thread. |
| virtual std::vector<std::unique_ptr<blink::URLLoaderThrottle>> |
| CreateURLLoaderThrottles( |
| const network::ResourceRequest& request, |
| BrowserContext* browser_context, |
| const base::RepeatingCallback<WebContents*()>& wc_getter, |
| NavigationUIData* navigation_ui_data, |
| int frame_tree_node_id); |
| |
| // Allows the embedder to register one or more URLLoaderThrottles for handling |
| // a user-initiated `fetch(url, {keepalive: true})` request from documents or |
| // from worker scripts in the renderer. Note this is different from |
| // `CreateURLLoaderThrottles` and `CreateThrottlesForNavigation` that are |
| // created for requests initiated in the browser. |
| // |
| // Keepalive requests are initiated in the renderer, and have throttles |
| // created by `ContentRendererClient::CreateURLLoaderThrottleProvider`. |
| // However, these requests may live longer than the renderer process itself. |
| // Therefore, this method is used to create browser-side throttles in addition |
| // to renderer-side throttles. |
| // |
| // All the `URLLoaderThrottle` methods up to `WillProcessResponse` are called |
| // on the browser-side throttles for keepalive requests, but are effectively |
| // ignored while the renderer is still alive. However, if the renderer |
| // terminates before the request has finished, subsequent calls to |
| // browser-side throttle take effect, for example any throttling applied to |
| // redirects. Response on the browser side is ignored, so response-related |
| // throttle methods, e.g. `WillProcessResponse` itself, will not be called. |
| // |
| // See this section for the difference between the renderer-side throttles and |
| // browser-side throttles for keepalive requests: |
| // https://docs.google.com/document/d/1ZzxMMBvpqn8VZBZKnb7Go8TWjnrGcXuLS_USwVVRUvY/edit#heading=h.eu8mlvut479 |
| // |
| // |wc_getter| returns the WebContents of the context of the |request| when |
| // available. It can return nullptr for requests for which it there are no |
| // WebContents (e.g., requests for web workers). |
| // |
| // |frame_tree_node_id| is also invalid (kNoFrameTreeNodeId) in some cases |
| // (e.g., requests for web workers). |
| // |
| // This is called on the UI thread. |
| virtual std::vector<std::unique_ptr<blink::URLLoaderThrottle>> |
| CreateURLLoaderThrottlesForKeepAlive( |
| const network::ResourceRequest& request, |
| BrowserContext* browser_context, |
| const base::RepeatingCallback<WebContents*()>& wc_getter, |
| int frame_tree_node_id); |
| |
| // Allows the embedder to register per-scheme URLLoaderFactory implementations |
| // to handle navigation URL requests for schemes not handled by the Network |
| // Service. |
| // |
| // Note that a RenderFrameHost or RenderProcessHost aren't passed in because |
| // these can change during a navigation (e.g. depending on redirects). |
| // |
| // |ukm_source_id| can be used to record UKM events associated with the |
| // navigation. |
| using NonNetworkURLLoaderFactoryMap = |
| std::map<std::string, |
| mojo::PendingRemote<network::mojom::URLLoaderFactory>>; |
| virtual void RegisterNonNetworkNavigationURLLoaderFactories( |
| int frame_tree_node_id, |
| NonNetworkURLLoaderFactoryMap* factories); |
| |
| // Allows the embedder to register per-scheme URLLoaderFactory |
| // implementations to handle dedicated/shared worker main script requests |
| // initiated by the browser process for schemes not handled by the Network |
| // Service. The resulting |factories| must be used only by the browser |
| // process. The caller must not send any of |factories| to any other process. |
| virtual void RegisterNonNetworkWorkerMainResourceURLLoaderFactories( |
| BrowserContext* browser_context, |
| NonNetworkURLLoaderFactoryMap* factories); |
| |
| // Allows the embedder to register per-scheme URLLoaderFactory |
| // implementations to handle service worker main/imported script requests |
| // initiated by the browser process for schemes not handled by the Network |
| // Service. Only called for service worker update check. |
| // The resulting |factories| must be used only by the browser process. The |
| // caller must not send any of |factories| to any other process. |
| virtual void RegisterNonNetworkServiceWorkerUpdateURLLoaderFactories( |
| BrowserContext* browser_context, |
| NonNetworkURLLoaderFactoryMap* factories); |
| |
| // Allows the embedder to register per-scheme URLLoaderFactory implementations |
| // to handle subresource URL requests for schemes not handled by the Network |
| // Service. This function can also be used to make a factory for other |
| // non-subresource requests, such as: |
| // -downloads |
| // -service worker script when starting a service worker. In that case, the |
| // frame id will be MSG_ROUTING_NONE |
| virtual void RegisterNonNetworkSubresourceURLLoaderFactories( |
| int render_process_id, |
| int render_frame_id, |
| const absl::optional<url::Origin>& request_initiator_origin, |
| NonNetworkURLLoaderFactoryMap* factories); |
| |
| // Describes the purpose of the factory in WillCreateURLLoaderFactory(). |
| enum class URLLoaderFactoryType { |
| // For navigations. |
| kNavigation, |
| |
| // For downloads. |
| kDownload, |
| |
| // For subresource requests from a document. |
| kDocumentSubResource, |
| |
| // For the main script request of a dedicated worker or shared worker. |
| kWorkerMainResource, |
| |
| // For the subresource requests from a dedicated worker or shared worker, |
| // including importScripts(). |
| kWorkerSubResource, |
| |
| // For fetching a service worker main script or subresource scripts, |
| // including importScripts(). |
| kServiceWorkerScript, |
| |
| // For regular fetches from a service worker (e.g., fetch(), XHR), not |
| // including importScripts(). |
| kServiceWorkerSubResource, |
| |
| // For prefetches. |
| kPrefetch, |
| }; |
| |
| // Allows the embedder to intercept URLLoaderFactory interfaces used by the |
| // content layer to request resources from (usually) the network service. |
| // |
| // The parameters for URLLoaderFactory creation, namely |header_client| and |
| // |factory_override|, are used in the network service where the resulting |
| // factory is bound to |factory_receiver|. Note that |factory_receiver| that's |
| // passed to the network service might be different from the original factory |
| // receiver that was given to the embedder if the embedder had replaced it. |
| // |
| // |type| indicates the type of requests the factory will be used for. |
| // |
| // |frame| is nullptr for type kWorkerSubResource, kServiceWorkerSubResource |
| // and kServiceWorkerScript. For kNavigation type, it's the RenderFrameHost |
| // the navigation might commit in. Else it's the initiating frame. |
| // |
| // |render_process_id| is the id of a render process host in which the |
| // URLLoaderFactory will be used. |
| // |
| // |request_initiator| indicates which origin will be the initiator of |
| // requests that will use the URLLoaderFactory. It's set when this factory is |
| // created a) for a renderer to use to fetch subresources |
| // (kDocumentSubResource, kWorkerSubResource, kServiceWorkerSubResource), or |
| // b) for the browser to use to fetch a worker (kWorkerMainResource) or |
| // service worker scripts (kServiceWorkerScript). |
| // An opaque origin is passed currently for navigation (kNavigation) and |
| // download (kDownload) factories even though requests from these factories |
| // can have a valid |network::ResourceRequest::request_initiator|. |
| // Note: For the kDocumentSubResource case, the |request_initiator| may be |
| // incorrect in some cases: |
| // - Sandboxing flags of the frame are not taken into account, which may mean |
| // that |request_initiator| might need to be opaque but isn't. |
| // - For about:blank frames, the |request_initiator| might be opaque or might |
| // be the process lock. |
| // TODO(lukasza): https://crbug.com/888079: Ensure that |request_initiator| is |
| // always accurate. |
| // |
| // |navigation_id| is valid iff |type| is |kNavigation|. It corresponds to the |
| // Navigation ID returned by NavigationHandle::GetNavigationId(). |
| // |
| // |ukm_source_id| can be used to record UKM events associated with the |
| // page or worker this URLLoaderFactory is intended for (it may be |
| // kInvalidUkmSourceId if there is no such ID available). |
| // |
| // |*factory_receiver| is always valid upon entry and MUST be valid upon |
| // return. The embedder may swap out the value of |*factory_receiver| for its |
| // own, in which case it must return |true| to indicate that it's proxying |
| // requests for the URLLoaderFactory. Otherwise |*factory_receiver| is left |
| // unmodified and this must return |false|. |
| // |
| // |header_client| may be bound within this call. This can be used in |
| // URLLoaderFactoryParams when creating the factory. |
| // |
| // |bypass_redirect_checks| will be set to true when the embedder will be |
| // handling redirect security checks. |
| // |
| // |disable_secure_dns| will be set to true when the URLLoaderFactory will be |
| // used exclusively within a window that requires secure DNS to be turned off, |
| // such as a window created for captive portal resolution. |
| // |
| // |factory_override| gives the embedder a chance to replace the network |
| // service's "internal" URLLoaderFactory. See more details in the |
| // documentation for URLLoaderFactoryOverride in network_context.mojom. |
| // The point is to allow the embedder to override network behavior without |
| // losing the security features of the network service. The embedder should |
| // use |factory_override| instead of swapping out |*factory_receiver| if such |
| // security features are desired. |
| // |
| // Prefer |factory_receiver| to this parameter if both work, as it is less |
| // error-prone. |
| // |
| // |factory_override| may be nullptr when this WillCreateURLLoaderFactory() |
| // call is for a factory that will be used for requests where such security |
| // features are no-op (e.g., for navigations). Otherwise, |*factory_override| |
| // is nullptr by default, and the embedder can elect to set |
| // |*factory_override| to a valid override. |
| // |
| // |navigation_response_task_runner| is a task runner that may be used for |
| // navigation request blocking tasks. Null when the URLLoaderFactory is not |
| // being created for a navigation request. |
| // |
| // Always called on the UI thread. |
| virtual bool WillCreateURLLoaderFactory( |
| BrowserContext* browser_context, |
| RenderFrameHost* frame, |
| int render_process_id, |
| URLLoaderFactoryType type, |
| const url::Origin& request_initiator, |
| absl::optional<int64_t> navigation_id, |
| ukm::SourceIdObj ukm_source_id, |
| mojo::PendingReceiver<network::mojom::URLLoaderFactory>* factory_receiver, |
| mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>* |
| header_client, |
| bool* bypass_redirect_checks, |
| bool* disable_secure_dns, |
| network::mojom::URLLoaderFactoryOverridePtr* factory_override, |
| scoped_refptr<base::SequencedTaskRunner> navigation_response_task_runner); |
| |
| // Returns true when the embedder wants to intercept a websocket connection. |
| virtual bool WillInterceptWebSocket(RenderFrameHost* frame); |
| |
| // Returns the WebSocket creation options. |
| virtual uint32_t GetWebSocketOptions(RenderFrameHost* frame); |
| |
| using WebSocketFactory = base::OnceCallback<void( |
| const GURL& /* url */, |
| std::vector<network::mojom::HttpHeaderPtr> /* additional_headers */, |
| mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>, |
| mojo::PendingRemote<network::mojom::WebSocketAuthenticationHandler>, |
| mojo::PendingRemote<network::mojom::TrustedHeaderClient>)>; |
| |
| // Allows the embedder to intercept a WebSocket connection. This is called |
| // only when WillInterceptWebSocket returns true. |
| // |
| // |factory| provides a way to create a usual WebSocket connection. |url|, |
| // |requested_protocols|, |user_agent|, |handshake_client| are arguments |
| // given from the renderer. |
| // |
| // Always called on the UI thread and only when the Network Service is |
| // enabled. |
| virtual void CreateWebSocket( |
| RenderFrameHost* frame, |
| WebSocketFactory factory, |
| const GURL& url, |
| const net::SiteForCookies& site_for_cookies, |
| const absl::optional<std::string>& user_agent, |
| mojo::PendingRemote<network::mojom::WebSocketHandshakeClient> |
| handshake_client); |
| |
| // Allows the embedder to control if establishing a WebTransport connection is |
| // allowed. |
| // |
| // `process_id` is the ID of the process which hosts the initiator context. |
| // `frame_routing_id` is the ID of the frame with which the initiator context |
| // is associated, or MSG_ROUTING_NONE if there is no associated frame. |
| // `url` is the destination URL and |
| // `initiator_origin` is the origin of the initiator context. |
| // When the connection is blocked, `callback` is called with `error`. |
| // `handshake_client` will be proxied to block the connection while |
| // handshaking. |
| using WillCreateWebTransportCallback = base::OnceCallback<void( |
| mojo::PendingRemote<network::mojom::WebTransportHandshakeClient> |
| handshake_client, |
| absl::optional<network::mojom::WebTransportErrorPtr> error)>; |
| virtual void WillCreateWebTransport( |
| int process_id, |
| int frame_routing_id, |
| const GURL& url, |
| const url::Origin& initiator_origin, |
| mojo::PendingRemote<network::mojom::WebTransportHandshakeClient> |
| handshake_client, |
| WillCreateWebTransportCallback callback); |
| |
| // Allows the embedder to intercept or replace the mojo objects used for |
| // preference-following access to cookies. This is primarily used for objects |
| // vended to renderer processes for limited, origin-locked (to |origin|), |
| // access to script-accessible cookies from JavaScript, so returned objects |
| // should treat their inputs as untrusted. |site_for_cookies| held by |
| // |isolation_info| represents which domains the cookie manager should |
| // consider to be first-party, for purposes of SameSite cookies and any |
| // third-party cookie blocking the embedder may implement (if |
| // |site_for_cookies| is empty, no domains are first-party). |
| // |top_frame_origin| held by |isolation_info| represents the domain for |
| // top-level frame, and can be used to look up preferences that are dependent |
| // on that. |
| // |
| // |*receiver| is always valid upon entry. |
| // |
| // If this methods returns true, it should have created an object bound to |
| // |*receiver|, and the value of |*receiver| afterwards is unusable. |
| // |
| // If the method returns false, it's the caller's responsibility to create |
| // an appropriate RestrictedCookieManager bound to the value of |*receiver| |
| // after it finishes executing --- the implementation is permitted to swap out |
| // the value of |*receiver| for a different one (which permits interposition |
| // of a proxy object). |
| // |
| // If |is_service_worker| is false, then |process_id| and |routing_id| |
| // describe the frame the result is to be used from. If it's true, operations |
| // are not bound to a particular frame, but are in context of a service worker |
| // appropriate for |origin|. |
| // |
| // This is called on the UI thread. |
| virtual bool WillCreateRestrictedCookieManager( |
| network::mojom::RestrictedCookieManagerRole role, |
| BrowserContext* browser_context, |
| const url::Origin& origin, |
| const net::IsolationInfo& isolation_info, |
| bool is_service_worker, |
| int process_id, |
| int routing_id, |
| mojo::PendingReceiver<network::mojom::RestrictedCookieManager>* receiver); |
| |
| // Allows the embedder to returns a list of request interceptors that can |
| // intercept a navigation request. |
| // |
| // Always called on the IO thread and only when the Network Service is |
| // enabled. |
| virtual std::vector<std::unique_ptr<URLLoaderRequestInterceptor>> |
| WillCreateURLLoaderRequestInterceptors( |
| content::NavigationUIData* navigation_ui_data, |
| int frame_tree_node_id, |
| int64_t navigation_id, |
| scoped_refptr<base::SequencedTaskRunner> navigation_response_task_runner); |
| |
| // Callback to handle a request for a URLLoader. |
| using URLLoaderRequestHandler = base::OnceCallback<void( |
| const network::ResourceRequest& resource_request, |
| mojo::PendingReceiver<network::mojom::URLLoader> url_loader_receiver, |
| mojo::PendingRemote<network::mojom::URLLoaderClient> client)>; |
| |
| // Allows the embedder to return a callback that is capable of loading a |
| // service worker navigation preload request. Similar to |
| // |WillCreateURLLoaderRequestInterceptors()|, but only allows for synchronous |
| // decisions of whether to handle the preload request with no fallback. As a |
| // result of being synchronous, the embedder can decide which, if there are |
| // multiple, URLLoader handlers is appropriate. If the embedder returns a null |
| // callback, the default behavior will be used to fetch the request. |
| virtual URLLoaderRequestHandler |
| CreateURLLoaderHandlerForServiceWorkerNavigationPreload( |
| int frame_tree_node_id, |
| const network::ResourceRequest& resource_request); |
| |
| // Called when the NetworkService, accessible through |
| // content::GetNetworkService(), is created. Implementations should avoid |
| // calling into GetNetworkService() again to avoid re-entrancy if the service |
| // fails to start. |
| virtual void OnNetworkServiceCreated( |
| network::mojom::NetworkService* network_service); |
| |
| // Configures the NetworkContextParams (|network_context_params|) and |
| // CertVerifierCreationParams (|cert_verifier_creation_params|) for a |
| // BrowserContext's StoragePartition. StoragePartition will use the |
| // NetworkService to create a new NetworkContext using these params. |
| // |
| // Embedders wishing to modify the initial configuration of the CertVerifier |
| // should edit |cert_verifier_creation_params| rather than |
| // |network_context_params->cert_verifier_params|, which will be discarded. |
| // |
| // By default the |network_context_params| is populated with |user_agent| |
| // based on the value returned by GetUserAgent(), and with a fixed legacy |
| // "accept-language" header value of "en-us,en". |
| // If |in_memory| is true, |relative_partition_path| is still a path that |
| // uniquely identifies the storage partition, though nothing should be written |
| // to it. |
| // |
| // If |relative_partition_path| is the empty string, it means this needs to |
| // create the default NetworkContext for the BrowserContext. |
| virtual void ConfigureNetworkContextParams( |
| BrowserContext* context, |
| bool in_memory, |
| const base::FilePath& relative_partition_path, |
| network::mojom::NetworkContextParams* network_context_params, |
| cert_verifier::mojom::CertVerifierCreationParams* |
| cert_verifier_creation_params); |
| |
| // Returns the parent paths that contain all the network service's |
| // BrowserContexts' storage. Multiple paths can be returned, e.g. in case the |
| // persistent storage location differs from the cache storage location. |
| virtual std::vector<base::FilePath> GetNetworkContextsParentDirectory(); |
| |
| // Called once during initialization of NetworkService to provide constants |
| // to NetLog. (Though it may be called multiples times if NetworkService |
| // crashes and needs to be reinitialized). The return value is merged with |
| // |GetNetConstants()| and passed to FileNetLogObserver - see documentation |
| // of |FileNetLogObserver::CreateBounded()| for more information. The |
| // convention is to put new constants under a subdict at the key "clientInfo". |
| virtual base::Value::Dict GetNetLogConstants(); |
| |
| #if BUILDFLAG(IS_ANDROID) |
| // Only used by Android WebView. |
| // Returns: |
| // true - The check was successfully performed without throwing a |
| // Java exception. |*ignore_navigation| is set to the |
| // result of the check in this case. |
| // false - A Java exception was thrown. It is no longer safe to |
| // make JNI calls, because of the uncleared exception. |
| // Callers should return to the message loop as soon as |
| // possible, so that the exception can be rethrown. |
| virtual bool ShouldOverrideUrlLoading(int frame_tree_node_id, |
| bool browser_initiated, |
| const GURL& gurl, |
| const std::string& request_method, |
| bool has_user_gesture, |
| bool is_redirect, |
| bool is_outermost_main_frame, |
| ui::PageTransition transition, |
| bool* ignore_navigation); |
| |
| // Returns true if navigation can synchronously continue if the frame |
| // being navigated (and all child frames) do not have beforeunload handlers. |
| // Synchronously continuing with navigation can lead to reentrancy in |
| // content, which is not supported (triggers CHECKs). Defaults to true. The |
| // ability to disable this is provided for Android WebView, which is known to |
| // cause reentrancy for such synchronous navigations. |
| virtual bool SupportsAvoidUnnecessaryBeforeUnloadCheckSync(); |
| #endif |
| |
| // Called on IO or UI thread to determine whether or not to allow load and |
| // render MHTML page from http/https URLs. |
| virtual bool AllowRenderingMhtmlOverHttp( |
| NavigationUIData* navigation_ui_data); |
| |
| // Called on IO or UI thread to determine whether or not to allow load and |
| // render MHTML page from http/https URLs. |
| virtual bool ShouldForceDownloadResource( |
| content::BrowserContext* browser_context, |
| const GURL& url, |
| const std::string& mime_type); |
| |
| virtual void CreateDeviceInfoService( |
| RenderFrameHost* render_frame_host, |
| mojo::PendingReceiver<blink::mojom::DeviceAPIService> receiver); |
| |
| virtual void CreateManagedConfigurationService( |
| RenderFrameHost* render_frame_host, |
| mojo::PendingReceiver<blink::mojom::ManagedConfigurationService> |
| receiver); |
| |
| #if !BUILDFLAG(IS_ANDROID) |
| // Allows the embedder to provide an implementation of the Serial API. |
| virtual SerialDelegate* GetSerialDelegate(); |
| #endif |
| |
| // Allows the embedder to provide an implementation of the WebHID API. |
| virtual HidDelegate* GetHidDelegate(); |
| |
| // Allows the embedder to provide an implementation of the Web Bluetooth API. |
| virtual BluetoothDelegate* GetBluetoothDelegate(); |
| |
| // Allows the embedder to provide an implementation of the WebUSB API. |
| virtual UsbDelegate* GetUsbDelegate(); |
| |
| // Allows the embedder to provide an implementation of the Private Network |
| // Device API. |
| virtual PrivateNetworkDeviceDelegate* GetPrivateNetworkDeviceDelegate(); |
| |
| // Allows the embedder to provide an implementation of the Local Font Access |
| // API. |
| virtual FontAccessDelegate* GetFontAccessDelegate(); |
| |
| #if BUILDFLAG(IS_CHROMEOS) |
| // Allows the embedder to provide an implementation of the Web Smart Card API. |
| virtual SmartCardDelegate* GetSmartCardDelegate( |
| BrowserContext* browser_context); |
| #endif |
| |
| // Attempt to open the Payment Handler window inside its corresponding |
| // PaymentRequest UI surface. Returns true if the ContentBrowserClient |
| // implementation supports this operation (desktop Chrome) or false otherwise. |
| // |callback| is invoked with true if the window opened successfully, false if |
| // the attempt failed. Both the render process and frame IDs are also passed |
| // to |callback|. |
| virtual bool ShowPaymentHandlerWindow( |
| content::BrowserContext* browser_context, |
| const GURL& url, |
| base::OnceCallback<void(bool /* success */, |
| int /* render_process_id */, |
| int /* render_frame_id */)> callback); |
| |
| // Called when starting BrowserMainLoop to create a base::ThreadPoolInstance. |
| // The embedder may choose to not create a thread pool; in that case |
| // ThreadPoolInstance::Get() will be null. Returns true if the |
| // ThreadPoolInstance was created. |
| // Note: the embedder should *not* start the ThreadPoolInstance for |
| // BrowserMainLoop, BrowserMainLoop itself is responsible for that. |
| virtual bool CreateThreadPool(base::StringPiece name); |
| |
| // Returns true if the tab security level is acceptable to allow WebAuthn |
| // requests, false otherwise. This is not attached to |
| // WebAuthenticationDelegate so it can be available on Android as well. |
| virtual bool IsSecurityLevelAcceptableForWebAuthn( |
| content::RenderFrameHost* rfh, |
| const url::Origin& caller_origin); |
| |
| #if !BUILDFLAG(IS_ANDROID) |
| // Returns an embedder-provided subclass of WebAuthenticationDelegate. This |
| // allows the embedder to customize the implementation of the Web |
| // Authentication API. |
| virtual WebAuthenticationDelegate* GetWebAuthenticationDelegate(); |
| |
| // Returns an AuthenticatorRequestClientDelegate subclass instance to provide |
| // embedder-specific configuration for a single Web Authentication API request |
| // being serviced in a given RenderFrame. The instance is guaranteed to be |
| // destroyed before the RenderFrame goes out of scope. The embedder may choose |
| // to return nullptr to indicate that the request cannot be serviced right |
| // now. |
| virtual std::unique_ptr<AuthenticatorRequestClientDelegate> |
| GetWebAuthenticationRequestDelegate(RenderFrameHost* render_frame_host); |
| #endif |
| |
| // Get platform ClientCertStore. May return nullptr. Called on the UI thread. |
| virtual std::unique_ptr<net::ClientCertStore> CreateClientCertStore( |
| BrowserContext* browser_context); |
| |
| // Creates a LoginDelegate that asks the user for a username and password. |
| // |web_contents| should not be null when CreateLoginDelegate is called. |
| // |first_auth_attempt| is needed by AwHttpAuthHandler constructor. |
| // |auth_required_callback| is used to transfer auth credentials to |
| // URLRequest::SetAuth(). The credentials parameter of the callback |
| // is absl::nullopt if the request should be cancelled; otherwise |
| // the credentials will be used to respond to the auth challenge. |
| // This method is called on the UI thread. The callback must be |
| // called on the UI thread as well. If the LoginDelegate is destroyed |
| // before the callback, the request has been canceled and the callback |
| // should not be called. |
| // |
| // NOTE: For the Negotiate challenge on ChromeOS the credentials are handled |
| // on OS level. In that case CreateLoginDelegate returns nullptr, since the |
| // credentials are not passed to the browser and the authentication |
| // should be cancelled. (See b/260522530). |
| // |
| // |auth_required_callback| may not be called reentrantly. If the request may |
| // be handled synchronously, CreateLoginDelegate must post the callback to a |
| // separate event loop iteration, taking care not to call it if the |
| // LoginDelegate is destroyed in the meantime. |
| // |
| // There is no guarantee that |web_contents| will outlive the |
| // LoginDelegate. The LoginDelegate implementation can use WebContentsObserver |
| // to be notified when the WebContents is destroyed. |
| // |
| // TODO(davidben): This should be guaranteed. It isn't due to asynchronous |
| // destruction between the network logic and the owning WebContents, but that |
| // should be hidden from the embedder. Ideally this method would be on |
| // WebContentsDelegate, where the lifetime ordering is more |
| // obvious. https://crbug.com/456255 |
| virtual std::unique_ptr<LoginDelegate> CreateLoginDelegate( |
| const net::AuthChallengeInfo& auth_info, |
| WebContents* web_contents, |
| const GlobalRequestID& request_id, |
| bool is_request_for_primary_main_frame, |
| const GURL& url, |
| scoped_refptr<net::HttpResponseHeaders> response_headers, |
| bool first_auth_attempt, |
| LoginAuthRequiredCallback auth_required_callback); |
| |
| // Launches the url for the given tab. Returns true if an attempt to handle |
| // the url was made, e.g. by launching an app. Note that this does not |
| // guarantee that the app successfully handled it. |
| // |
| // |initiating_origin| is the origin of the last redirecting server (falling |
| // back to the request initiator if there were no redirects / if the request |
| // goes straight to an external protocol, or null, e.g. in the case of |
| // browser-initiated navigations. The initiating origin is intended to help |
| // users make security decisions about whether to allow an external |
| // application to launch. |
| // |
| // |initiator_document| refers to the document that initiated the navigation, |
| // if it is still available. Use |initiating_origin| instead for security |
| // decisions. |
| // |
| // |out_factory| allows the embedder to continue the navigation, by providing |
| // their own URLLoader. If it isn't set, the navigation is canceled. It is |
| // canceled either silently when this function returns true, or with an error |
| // page otherwise. |
| virtual bool HandleExternalProtocol( |
| const GURL& url, |
| base::RepeatingCallback<WebContents*()> web_contents_getter, |
| int frame_tree_node_id, |
| NavigationUIData* navigation_data, |
| bool is_primary_main_frame, |
| bool is_in_fenced_frame_tree, |
| network::mojom::WebSandboxFlags sandbox_flags, |
| ui::PageTransition page_transition, |
| bool has_user_gesture, |
| const absl::optional<url::Origin>& initiating_origin, |
| RenderFrameHost* initiator_document, |
| mojo::PendingRemote<network::mojom::URLLoaderFactory>* out_factory); |
| |
| // Creates an OverlayWindow to be used for video or Picture-in-Picture. |
| // This window will house the content shown when in Picture-in-Picture mode. |
| // This will return a new OverlayWindow. |
| // |
| // May return nullptr if embedder does not support this functionality. The |
| // default implementation provides nullptr OverlayWindow. |
| virtual std::unique_ptr<VideoOverlayWindow> |
| CreateWindowForVideoPictureInPicture( |
| VideoPictureInPictureWindowController* controller); |
| |
| // Registers the watcher to observe updates in RendererPreferences. |
| virtual void RegisterRendererPreferenceWatcher( |
| BrowserContext* browser_context, |
| mojo::PendingRemote<blink::mojom::RendererPreferenceWatcher> watcher); |
| |
| // Returns true if it is OK to accept untrusted exchanges, such as expired |
| // signed exchanges, and unsigned Web Bundles. |
| // The embedder may require --user-data-dir flag and so on to accept it in |
| // order to make sure that insecure contents will not persist accidentally. |
| virtual bool CanAcceptUntrustedExchangesIfNeeded(); |
| |
| // Called on every request completion to update the data use when network |
| // service is enabled. |
| virtual void OnNetworkServiceDataUseUpdate( |
| GlobalRenderFrameHostId render_frame_host_id, |
| int32_t network_traffic_annotation_id_hash, |
| int64_t recv_bytes, |
| int64_t sent_bytes); |
| |
| // Returns the absolute path to a directory in which sandboxed out-of-process |
| // Storage Service instances should be confined. By default this is empty, and |
| // the browser cannot create sandboxed Storage Service instances. |
| virtual base::FilePath GetSandboxedStorageServiceDataDirectory(); |
| |
| // Returns true if the audio service should be sandboxed. false otherwise. |
| virtual bool ShouldSandboxAudioService(); |
| |
| // Returns true if the network service should be sandboxed. false otherwise. |
| // This is called on the UI thread. |
| virtual bool ShouldSandboxNetworkService(); |
| |
| // Returns true if system DNS resolution should be run outside of the network |
| // service. This is useful if the network service is sandboxed but system DNS |
| // resolution cannot run sandboxed. |
| virtual bool ShouldRunOutOfProcessSystemDnsResolution(); |
| |
| // Browser-side API to log blink UseCounters for events that don't occur in |
| // the renderer. |
| virtual void LogWebFeatureForCurrentPage( |
| content::RenderFrameHost* render_frame_host, |
| blink::mojom::WebFeature feature) {} |
| |
| // Returns a string describing the embedder product name and version, |
| // of the form "productname/version", with no other slashes. |
| // Used as part of the user agent string. |
| virtual std::string GetProduct(); |
| |
| // Returns the user agent. This can also return the reduced user agent, based |
| // on blink::features::kUserAgentReduction. Content may cache this value. |
| virtual std::string GetUserAgent(); |
| |
| // Returns the user agent, allowing for preferences (i.e. enterprise policy). |
| // Default to the non-context |GetUserAgent| above. |
| virtual std::string GetUserAgentBasedOnPolicy( |
| content::BrowserContext* context); |
| |
| // Returns user agent metadata. Content may cache this value. |
| virtual blink::UserAgentMetadata GetUserAgentMetadata(); |
| |
| // Returns a 256x256 transparent background image of the product logo, i.e. |
| // the browser icon, if available. |
| virtual absl::optional<gfx::ImageSkia> GetProductLogo(); |
| |
| // Returns whether |origin| should be considered a integral component similar |
| // to native code, and as such whether its log messages should be recorded. |
| virtual bool IsBuiltinComponent(BrowserContext* browser_context, |
| const url::Origin& origin); |
| |
| // Returns whether given |url| has to be blocked. It's used only for renderer |
| // debug URLs, as other requests are handled via NavigationThrottlers and |
| // blocklist policies are applied there. |
| virtual bool ShouldBlockRendererDebugURL(const GURL& url, |
| BrowserContext* context, |
| RenderFrameHost* render_frame_host); |
| |
| // Returns the default accessibility mode for the given browser context. |
| virtual ui::AXMode GetAXModeForBrowserContext( |
| BrowserContext* browser_context); |
| |
| #if BUILDFLAG(IS_ANDROID) |
| // Defines the heuristics we can use to enable wide color gamut (WCG). |
| enum class WideColorGamutHeuristic { |
| kUseDisplay, // Use WCG if display supports it. |
| kUseWindow, // Use WCG if window is WCG. |
| kNone, // Never use WCG. |
| }; |
| |
| // Returns kNone by default. |
| virtual WideColorGamutHeuristic GetWideColorGamutHeuristic(); |
| |
| // Creates the TtsEnvironmentAndroid. A return value of null results in using |
| // a default implementation. |
| virtual std::unique_ptr<TtsEnvironmentAndroid> CreateTtsEnvironmentAndroid(); |
| |
| // If enabled, DialogOverlays will observe the container view for location |
| // changes and reposition themselves automatically. Note that this comes with |
| // some overhead and should only be enabled if the embedder itself can be |
| // moved. Defaults to false. |
| virtual bool ShouldObserveContainerViewLocationForDialogOverlays(); |
| #endif |
| |
| // Obtains the list of MIME types that are for plugins with external handlers. |
| virtual base::flat_set<std::string> GetPluginMimeTypesWithExternalHandlers( |
| BrowserContext* browser_context); |
| |
| // Possibly augment |download_policy| based on the status of |frame_host| as |
| // well as |user_gesture|. |
| virtual void AugmentNavigationDownloadPolicy( |
| RenderFrameHost* frame_host, |
| bool user_gesture, |
| blink::NavigationDownloadPolicy* download_policy); |
| |
| // Writes the browsing topics for a particular requesting context into the |
| // output parameter `topics` and returns whether the access permission is |
| // allowed. `context_origin` and `main_frame` will potentially be used for the |
| // access permission check, for calculating the topics, and/or for the |
| // `BrowsingTopicsPageLoadDataTracker` to track the API usage. If `get_topics` |
| // is true, topics calculation result will be stored to `topics`. If `observe` |
| // is true, record the observation (i.e. the <calling context site, |
| // top level site> pair) to the `BrowsingTopicsSiteDataStorage` database. |
| virtual bool HandleTopicsWebApi( |
| const url::Origin& context_origin, |
| content::RenderFrameHost* main_frame, |
| browsing_topics::ApiCallerSource caller_source, |
| bool get_topics, |
| bool observe, |
| std::vector<blink::mojom::EpochTopicPtr>& topics); |
| |
| // Returns the number of distinct topics epochs versions for `main_frame`. |
| // Must be called when topics are eligible (i.e. `HandleTopicsWebApi` would |
| // return true for the same main frame context). |
| virtual int NumVersionsInTopicsEpochs( |
| content::RenderFrameHost* main_frame) const; |
| |
| // Returns whether a site is blocked to use Bluetooth scanning API. |
| virtual bool IsBluetoothScanningBlocked( |
| content::BrowserContext* browser_context, |
| const url::Origin& requesting_origin, |
| const url::Origin& embedding_origin); |
| |
| // Blocks a site to use Bluetooth scanning API. |
| virtual void BlockBluetoothScanning(content::BrowserContext* browser_context, |
| const url::Origin& requesting_origin, |
| const url::Origin& embedding_origin); |
| |
| // Returns via callback: |
| // 1. A boolean indicating whether persistent device IDs are allowed. |
| // 2. A salt for hashing media device IDs for the given storage key. |
| // Ideally, the salt should be unique per `storage_key` and persistent if |
| // cookie access is allowed for `site_for_cookies`. However the embedder is |
| // free to return a salt that does not satisfy all these properties. |
| virtual void GetMediaDeviceIDSalt( |
| content::RenderFrameHost* rfh, |
| const net::SiteForCookies& site_for_cookies, |
| const blink::StorageKey& storage_key, |
| base::OnceCallback<void(bool, const std::string&)> callback); |
| |
| // Requests an SMS from |origin_list| from a remote device with telephony |
| // capabilities, for example the user's mobile phone. Callbacks |callback| |
| // with the origins and one-time-code from the SMS upon success or a failure |
| // type on error. The returned callback cancels receiving of the response. |
| // Calling it will run |callback| if it hasn't been executed yet, otherwise it |
| // will be a no-op. Returns a null callback if fetching from a remote device |
| // is disabled. |
| virtual base::OnceClosure FetchRemoteSms( |
| content::WebContents* web_contents, |
| const std::vector<url::Origin>& origin_list, |
| base::OnceCallback<void(absl::optional<std::vector<url::Origin>>, |
| absl::optional<std::string>, |
| absl::optional<content::SmsFetchFailureType>)> |
| callback); |
| |
| // Uploads an enterprise legacy tech event to the enterprise management server |
| // if the `url` or `frame_url` that triggers the event is matched to any |
| // enterprise policies that are set by administrators. For a description of |
| // reported fields, see |
| // https://crsrc.org/c/components/enterprise/common/proto/legacy_tech_events.proto |
| virtual void ReportLegacyTechEvent( |
| content::RenderFrameHost* render_frame_host, |
| const std::string type, |
| const GURL& url, |
| const GURL& frame_url, |
| const std::string& filename, |
| uint64_t line, |
| uint64_t column, |
| std::optional<LegacyTechCookieIssueDetails> cookie_issue_details); |
| |
| // Check whether paste is allowed. To paste, an implementation may require |
| // a `render_frame_host` to have user activation or various permissions. |
| // Primary checks should be done in the renderer, to allow for errors to |
| // be emitted, but this allows for a security recheck in the browser in |
| // case of compromised renderers. |
| // |
| // Due to potential race conditions, permissions may be disallowed here in |
| // uncompromised renderers. For example, a permission may be granted when |
| // checked in the renderer, but the permission may be revoked by the time |
| // this check starts. |
| virtual bool IsClipboardPasteAllowed( |
| content::RenderFrameHost* render_frame_host); |
| |
| // Determines if a clipboard paste containing |data| of type |data_type| is |
| // allowed in this renderer frame. Possible data types supported for paste |
| // are in the ClipboardHostImpl class. Text based formats will use the |
| // data_type ui::ClipboardFormatType::PlainTextType() unless it is known |
| // to be of a more specific type, like RTF or HTML, in which case a type |
| // such as ui::ClipboardFormatType::RtfType() or |
| // ui::ClipboardFormatType::HtmlType() is used. |
| // |
| // It is also possible for the data type to be |
| // ui::ClipboardFormatType::WebCustomDataType() indicating that the paste |
| // uses a custom data format. It is up to the implementation to attempt to |
| // understand the type if possible. It is acceptable to deny pastes of |
| // unknown data types. |
| // |
| // The implementation is expected to show UX to the user if needed. If |
| // shown, the UX should be associated with the specific WebContents. |
| // |
| // The callback is called, possibly asynchronously, with a status indicating |
| // whether the operation is allowed or not. If the operation is allowed, |
| // the callback is passed the data the can be pasted. |
| virtual void IsClipboardPasteContentAllowed( |
| content::WebContents* web_contents, |
| const GURL& url, |
| const ui::ClipboardFormatType& data_type, |
| ClipboardPasteData content_analyisis_data, |
| IsClipboardPasteContentAllowedCallback callback); |
| |
| // Returns true if a copy to the clipboard from `url` is allowed by the |
| // CopyPreventionSettings policy, false otherwise. The check is only performed |
| // if `data_size_in_bytes` is greater or equal than the minimum data size |
| // specified in the policy. If the copy is blocked `replacement_data` will be |
| // filled with an explainer message meant to be written to the clipboard for |
| // the user to see. |
| virtual bool IsClipboardCopyAllowed(content::BrowserContext* browser_context, |
| const GURL& url, |
| size_t data_size_in_bytes, |
| std::u16string& replacement_data); |
| |
| // Allows the embedder to override normal user activation checks done when |
| // entering fullscreen. For example, it is used in layout tests to allow |
| // fullscreen when mock screen orientation changes. |
| virtual bool CanEnterFullscreenWithoutUserActivation(); |
| |
| #if BUILDFLAG(ENABLE_VR) |
| // Allows the embedder to provide mechanisms to integrate with WebXR |
| // functionality. |
| virtual XrIntegrationClient* GetXrIntegrationClient(); |
| #endif |
| |
| // External applications and services may launch the browser in a mode which |
| // exposes browser control interfaces via Mojo. Any such interface binding |
| // request received from an external client is passed to this method. |
| virtual void BindBrowserControlInterface(mojo::ScopedMessagePipeHandle pipe); |
| |
| // Returns true when a context (e.g., iframe) whose URL is |url| should |
| // inherit the parent COEP value implicitly, similar to "blob:" |
| virtual bool ShouldInheritCrossOriginEmbedderPolicyImplicitly( |
| const GURL& url); |
| |
| // Returns true when a ServiceWorker whose URL is |url| should inherit its |
| // PolicyContainer from its creator instead of from its main script |
| // response. |
| virtual bool ShouldServiceWorkerInheritPolicyContainerFromCreator( |
| const GURL& url); |
| |
| enum class PrivateNetworkRequestPolicyOverride { |
| kForceAllow, |
| kBlockInsteadOfWarn, |
| kDefault, |
| }; |
| |
| // Returns whether and how we should override the default private network |
| // request policy. |
| // |
| // See the Private Network Access spec for more details: |
| // https://wicg.github.io/private-network-access. |
| // |
| // |browser_context| must not be nullptr. Caller retains ownership. |
| // |origin| is the origin of a navigation ready to commit. |
| virtual PrivateNetworkRequestPolicyOverride |
| ShouldOverridePrivateNetworkRequestPolicy(BrowserContext* browser_context, |
| const url::Origin& origin); |
| |
| // Whether the JIT should be disabled for the given |browser_context| and |
| // |site_url|. Pass an empty GURL for |site_url| to get the default JIT policy |
| // for the current |browser_context|. |
| // |site_url| should not be resolved to an effective URL before passing to |
| // this function. |
| virtual bool IsJitDisabledForSite(BrowserContext* browser_context, |
| const GURL& site_url); |
| |
| // Returns the URL-Keyed Metrics service for chrome:ukm. |
| virtual ukm::UkmService* GetUkmService(); |
| |
| // Returns the Origin Trials Settings. If the embedder does not support Origin |
| // Trials, the method will return a null |
| // blink::mojom::OriginTrialsSettingsPtr. |
| virtual blink::mojom::OriginTrialsSettingsPtr GetOriginTrialsSettings(); |
| |
| // Called when a keepalive request |
| // (https://fetch.spec.whatwg.org/#request-keepalive-flag) is requested. |
| virtual void OnKeepaliveRequestStarted(BrowserContext* browser_context); |
| |
| // Called when a keepalive request finishes either successfully or |
| // unsuccessfully. |
| virtual void OnKeepaliveRequestFinished(); |
| |
| #if BUILDFLAG(IS_MAC) |
| // Sets up the embedder sandbox parameters for the given sandbox type. Returns |
| // true if parameters were successfully set up or false if no additional |
| // parameters were set up. |
| virtual bool SetupEmbedderSandboxParameters( |
| sandbox::mojom::Sandbox sandbox_type, |
| sandbox::SandboxCompiler* compiler); |
| #endif // BUILDFLAG(IS_MAC) |
| |
| virtual void GetHyphenationDictionary( |
| base::OnceCallback<void(const base::FilePath&)>); |
| |
| // Returns true if the embedder has an error page to show for the given http |
| // status code. |
| virtual bool HasErrorPage(int http_status_code); |
| |
| // Creates a controller that intermediates the exchange of ID tokens for the |
| // given |web_contents|. |
| virtual std::unique_ptr<IdentityRequestDialogController> |
| CreateIdentityRequestDialogController(WebContents* web_contents); |
| |
| // Creates a digital credential provider to fetch from native apps. |
| virtual std::unique_ptr<DigitalCredentialProvider> |
| CreateDigitalCredentialProvider(); |
| |
| // Returns true if JS dialogs from an iframe with different origin from the |
| // main frame should be disallowed. |
| virtual bool SuppressDifferentOriginSubframeJSDialogs( |
| BrowserContext* browser_context); |
| |
| // Allows the embedder to provide an AnchorElementPreconnectDelegate that will |
| // be used to make heuristics based preconnects. |
| virtual std::unique_ptr<AnchorElementPreconnectDelegate> |
| CreateAnchorElementPreconnectDelegate(RenderFrameHost& render_frame_host); |
| |
| // Allows the embedder to provide a SpeculationHostDelegate that will be used |
| // to process speculation rules provided by the document hosted by |
| // `render_frame_host`. |
| virtual std::unique_ptr<SpeculationHostDelegate> |
| CreateSpeculationHostDelegate(RenderFrameHost& render_frame_host); |
| |
| // Allows the embedder to provide a PrefetchServiceDelegate that will be used |
| // to make prefetches. |
| virtual std::unique_ptr<PrefetchServiceDelegate> |
| CreatePrefetchServiceDelegate(BrowserContext* browser_context); |
| |
| // Allows the embedder to provide a PrerenderWebContentsDelegate that will be |
| // used to start prerendering in a new WebContents (i.e. new tab). |
| virtual std::unique_ptr<PrerenderWebContentsDelegate> |
| CreatePrerenderWebContentsDelegate(); |
| |
| // Returns true if find-in-page should be disabled for a given `origin`. |
| virtual bool IsFindInPageDisabledForOrigin(const url::Origin& origin); |
| |
| // Called on every WebContents creation. |
| virtual void OnWebContentsCreated(WebContents* web_contents); |
| |
| // Allows overriding the policy of whether to assign documents to origin-keyed |
| // agent clusters by default. That is, it controls the behaviour when the |
| // Origin-Agent-Cluster header is absent. |
| // |
| // If the embedder returns true, this prevents the use of origin-keyed agent |
| // clusters by default (i.e., when the Origin-Agent-Cluster header is absent). |
| // If the embedder returns false, then the decision is based on |
| // blink::features::kOriginAgentClusterDefaultEnabled instead. |
| virtual bool ShouldDisableOriginAgentClusterDefault( |
| BrowserContext* browser_context); |
| |
| // Whether a navigation in |render_frame_host| should preconnect early. |
| virtual bool ShouldPreconnectNavigation(RenderFrameHost* render_frame_host); |
| |
| // Returns true if First-Party Sets is enabled. The value of this method |
| // should not change in a single browser session. |
| virtual bool IsFirstPartySetsEnabled(); |
| |
| // Returns true iff the embedder will provide a list of First-Party Sets via |
| // content::FirstPartySetsHandler::SetPublicFirstPartySets during startup, at |
| // some point. If `IsFirstPartySetsEnabled()` returns false, this method will |
| // still be called, but its return value will be ignored. |
| // |
| // If this method returns false but `IsFirstPartySetsEnabled()` returns true |
| // (e.g. in tests), an empty list will be used instead of waiting for the |
| // embedder to call content::FirstPartySetsHandler::SetPublicFirstPartySets. |
| virtual bool WillProvidePublicFirstPartySets(); |
| |
| // This returns a dictionary that an embedder can use to pass data from the |
| // browser to the renderer for error pages. |
| // The |error_code| is the network error as specified in |
| // `net/base/net_error_list.h`. Information is returned in a struct. Default |
| // implementation returns nullptr. |
| virtual mojom::AlternativeErrorPageOverrideInfoPtr |
| GetAlternativeErrorPageOverrideInfo( |
| const GURL& url, |
| content::RenderFrameHost* render_frame_host, |
| content::BrowserContext* browser_context, |
| int32_t error_code); |
| |
| // Called when a `SharedStorageWorkletHost` is created for `rfh`. |
| virtual void OnSharedStorageWorkletHostCreated(RenderFrameHost* rfh) {} |
| |
| // Whether the outermost origin should be sent to the renderer. This is |
| // needed if the outermost origin is an extension, but for normal pages |
| // we do not want to expose this. |
| virtual bool ShouldSendOutermostOriginToRenderer( |
| const url::Origin& outermost_origin); |
| |
| // Returns true if a given filesystem: `url` navigation is allowed (i.e. |
| // originates from a Chrome App). Returns false for all other |
| // navigations. |
| virtual bool IsFileSystemURLNavigationAllowed( |
| content::BrowserContext* browser_context, |
| const GURL& url); |
| |
| // Called when optionally blockable insecure content is displayed on a secure |
| // page (resulting in mixed content). |
| virtual void OnDisplayInsecureContent(WebContents* web_contents) {} |
| |
| #if BUILDFLAG(IS_MAC) |
| // Gets the suffix for an embedder-specific helper child process. The |
| // |child_flags| is a value greater than |
| // ChildProcessHost::CHILD_EMBEDDER_FIRST. The embedder-specific helper app |
| // bundle should be placed next to the known //content Mac helpers in the |
| // framework bundle. |
| virtual std::string GetChildProcessSuffix(int child_flags); |
| #endif // BUILDFLAG(IS_MAC) |
| |
| // Checks if Isolated Web Apps are enabled, e.g. by feature flag |
| // or in any other way. |
| virtual bool AreIsolatedWebAppsEnabled(BrowserContext* browser_context); |
| |
| // This function can serve to block third-party storage partitioning |
| // from being enabled if it returns false. If it returns true, then |
| // we fallback on the base feature to determine if partitioning is on. |
| virtual bool IsThirdPartyStoragePartitioningAllowed( |
| content::BrowserContext* browser_context, |
| const url::Origin& top_level_origin); |
| |
| // Checks whether credentials should be included in fenced frame automatic |
| // beacon requests, based on user cookie settings. Any cookies sent in an |
| // automatic beacon response header will be honored and stored. |
| // |
| // `destination_url` is the URL that the automatic beacon is being sent to, |
| // and the URL whose origin's cookies will be accessed. |
| // |
| // `top_frame_origin` is the main frame of the page that ran the auction that |
| // resulted in the creation of the FencedFrameReporter that called this |
| // function. |
| // |
| // TODO(crbug.com/1496395): After 3PCD, this will be dead code and should be |
| // removed. |
| virtual bool AreDeprecatedAutomaticBeaconCredentialsAllowed( |
| content::BrowserContext* browser_context, |
| const GURL& destination_url, |
| const url::Origin& top_frame_origin); |
| |
| // Checks if file or directory pickers from the file system access web API |
| // require a user gesture (transient activation). They usually do, but this |
| // can be bypassed via admin policy. |
| virtual bool IsTransientActivationRequiredForShowFileOrDirectoryPicker( |
| WebContents* web_contents); |
| |
| // Checks if `origin` should always receive a first-party StorageKey |
| // in RenderFrameHostImpl. Currently in Chrome, this is true for all |
| // extension origins. |
| virtual bool ShouldUseFirstPartyStorageKey(const url::Origin& origin); |
| |
| // Allows the embedder to return a delegate for the responsiveness calculator. |
| // The default implementation returns nullptr. |
| virtual std::unique_ptr<ResponsivenessCalculatorDelegate> |
| CreateResponsivenessCalculatorDelegate(); |
| |
| // Checks if the given BrowserContext can receive cookie changes when it is in |
| // BFCache. |
| virtual bool CanBackForwardCachedPageReceiveCookieChanges( |
| content::BrowserContext& browser_context, |
| const GURL& url, |
| const net::SiteForCookies& site_for_cookies, |
| const absl::optional<url::Origin>& top_frame_origin, |
| const net::CookieSettingOverrides overrides); |
| |
| // Callback will be called with either an error |
| // (!=`FileSystemAccessStatus::kOk`) or a list of cloud file handles as |
| // result. |
| using GetCloudIdentifiersCallback = base::OnceCallback<void( |
| blink::mojom::FileSystemAccessErrorPtr, |
| std::vector<blink::mojom::FileSystemAccessCloudIdentifierPtr>)>; |
| |
| // Retrieve the identifiers the cloud storage providers use for a given |
| // file/directory. |
| virtual void GetCloudIdentifiers( |
| const storage::FileSystemURL& url, |
| FileSystemAccessPermissionContext::HandleType handle_type, |
| GetCloudIdentifiersCallback callback); |
| |
| // Checks if the given BrowserContext allows to store the page loaded with |
| // "Cache-control: no-store" header in BFCache. |
| virtual bool ShouldAllowBackForwardCacheForCacheControlNoStorePage( |
| content::BrowserContext* browser_context); |
| |
| // Set whether the browser is running in minimal mode (where most subsystems |
| // are left uninitialized). |
| virtual void SetIsMinimalMode(bool minimal) {} |
| |
| // Returns whether, when using SubCaptureTargets (cropTo, restrictTo), |
| // the sub-capture target tokens should be associated with the *outermost* |
| // main-frame or embedder. If not, then the direct main-frame will be used. |
| // This even allows changing the WebContents being captured, which is a very |
| // powerful feature, and is likely only appropriate on embedded systems |
| // where the Web application is trusted. |
| virtual bool UseOutermostMainFrameOrEmbedderForSubCaptureTargets() const; |
| |
| #if !BUILDFLAG(IS_ANDROID) |
| // Allows the embedder to correlate backend media services with profile-keyed |
| // effect settings. |
| virtual void BindVideoEffectsManager( |
| const std::string& device_id, |
| content::BrowserContext* browser_context, |
| mojo::PendingReceiver<video_capture::mojom::VideoEffectsManager> |
| video_effects_manager); |
| #endif // !BUILDFLAG(IS_ANDROID) |
| |
| // Re-order audio device `infos` based on user preference. The ordering will |
| // be from most preferred to least preferred. |
| virtual void PreferenceRankVideoDeviceInfos( |
| BrowserContext* browser_context, |
| blink::WebMediaDeviceInfoArray& infos); |
| |
| // Re-order video device `infos` based on user preference. The ordering will |
| // be from most preferred to least preferred. |
| virtual void PreferenceRankAudioDeviceInfos( |
| BrowserContext* browser_context, |
| blink::WebMediaDeviceInfoArray& infos); |
| |
| // Allows the embedder to override the proxy bypass policy used for IP |
| // Protection. |
| // Even if a domain is part of the masked domain list and is |
| // eligible for IP Protection, the embedder can use a certain policy to bypass |
| // certain network requests from IP Protection. |
| // By default, there is no bypass policy used. |
| virtual network::mojom::IpProtectionProxyBypassPolicy |
| GetIpProtectionProxyBypassPolicy(); |
| }; |
| |
| } // namespace content |
| |
| #endif // CONTENT_PUBLIC_BROWSER_CONTENT_BROWSER_CLIENT_H_ |