Delegate TargetHandler::Session permission checks to the root client

Bug: 1114636
Change-Id: Iba3865206d7e80b363ec69180ac05e20b56aade2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2380855Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/master@{#802736}

chrome/browser/extensions/api/debugger/debugger_apitest.cc

@@ -391,4 +391,14 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessDebuggerExtensionApiTest,
       << message_;
 }
 
+IN_PROC_BROWSER_TEST_F(SitePerProcessDebuggerExtensionApiTest,
+                       AutoAttachPermissions) {
+  GURL url(embedded_test_server()->GetURL(
+      "a.com",
+      "/extensions/api_test/debugger_auto_attach_permissions/page.html"));
+  ASSERT_TRUE(RunExtensionTestWithArg("debugger_auto_attach_permissions",
+                                      url.spec().c_str()))
+      << message_;
+}
+
 }  // namespace extensions

chrome/test/data/extensions/api_test/debugger_auto_attach_permissions/background.js

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const protocolVersion = '1.3';
+
+chrome.test.getConfig(config => chrome.test.runTests([
+  async function testAutoAttachPermissions() {
+    const {openTab} = await import('/_test_resources/test_util/tabs_util.js');
+    const topURL = config.customArg;
+    const subframeURL = topURL.replace('http://a.com', 'http://b.com');
+    const pageTab = await openTab(topURL);
+    const debuggee = {tabId: pageTab.id};
+
+    const protocolCallbacks = new Map();
+
+    function dispatchMessage(key, args) {
+      if (key === 'Target.receivedMessageFromTarget') {
+        const message = JSON.parse(args.message);
+        if ('id' in message)
+          dispatchMessage(message.id, message);
+        else
+          dispatchMessage(message.method, message.params);
+        return;
+      }
+      const cb = protocolCallbacks.get(key);
+      if (!cb)
+        return;
+      protocolCallbacks.delete(key);
+      cb(args);
+    }
+
+    chrome.debugger.onEvent.addListener((_, method, params) =>
+        dispatchMessage(method, params));
+
+    function onceEvent(name) {
+      return new Promise(resolve => {protocolCallbacks.set(name, resolve);});
+    }
+
+    let callId = 0;
+
+    function sendMessageToTarget(targetDebuggee, method, params) {
+      const message = {
+        id: ++callId,
+        method,
+        params
+      };
+      chrome.debugger.sendCommand(debuggee, 'Target.sendMessageToTarget', {
+        targetId: targetDebuggee.targetId,
+        message: JSON.stringify(message)
+      });
+      return new Promise(resolve => protocolCallbacks.set(message.id, resolve));
+    }
+
+    await new Promise(resolve =>
+        chrome.debugger.attach(debuggee, protocolVersion, resolve));
+
+    await new Promise(resolve =>
+        chrome.debugger.sendCommand(debuggee, 'Target.setAutoAttach', {
+            autoAttach: true,
+            waitForDebuggerOnStart: false,
+            flatten: false},
+        resolve));
+    chrome.debugger.sendCommand(debuggee, 'Runtime.enable', null);
+    const expression = `
+        const frame = document.body.firstElementChild;
+        frame.src = '${subframeURL}';
+    `;
+    chrome.debugger.sendCommand(debuggee, 'Runtime.evaluate', {expression});
+
+    const attachedParams = await onceEvent('Target.attachedToTarget');
+
+    const childDebuggee = {targetId: attachedParams.targetInfo.targetId};
+    const anotherTab = await openTab(topURL);
+    const targets = await new Promise(resolve =>
+        chrome.debugger.getTargets(resolve));
+
+    const anotherTabTarget = targets.find(
+        t => t.type === 'page' && t.tabId === anotherTab.id);
+
+    const result = await sendMessageToTarget(childDebuggee,
+        'Target.attachToTarget', {targetId: anotherTabTarget.id});
+
+    chrome.test.assertTrue('error' in result, 'Expected error, got success!');
+    chrome.test.assertEq(result.error.message, 'Not allowed');
+
+    chrome.test.succeed();
+  }
+]));

chrome/test/data/extensions/api_test/debugger_auto_attach_permissions/manifest.json

+{
+  "name": "Debugger API test for permission checks on sessions resulted from auto-attach",
+  "version": "1.0",
+  "manifest_version": 2,
+  "background": {
+    "scripts": ["background.js"]
+  },
+  "permissions": [
+    "debugger"
+  ]
+}

chrome/test/data/extensions/api_test/debugger_auto_attach_permissions/page.html

+<html>
+<iframe></iframe>
+</html>
\ No newline at end of file

content/browser/devtools/protocol/target_handler.cc

@@ -467,7 +467,7 @@ class TargetHandler::Session : public DevToolsAgentHostClient {
       // was introduced. Try a DCHECK instead and possibly remove the check.
       if (!handler_->root_session_->HasChildSession(id_))
         return;
-      handler_->root_session_->GetClient()->DispatchProtocolMessage(
+      GetRootClient()->DispatchProtocolMessage(
           handler_->root_session_->GetAgentHost(), message);
       return;
     }
@@ -485,6 +485,26 @@ class TargetHandler::Session : public DevToolsAgentHostClient {
     Detach(true);
   }
 
+  bool MayAttachToURL(const GURL& url, bool is_webui) override {
+    return GetRootClient()->MayAttachToURL(url, is_webui);
+  }
+
+  bool MayAttachToBrowser() override {
+    return GetRootClient()->MayAttachToBrowser();
+  }
+
+  bool MayReadLocalFiles() override {
+    return GetRootClient()->MayReadLocalFiles();
+  }
+
+  bool MayWriteLocalFiles() override {
+    return GetRootClient()->MayWriteLocalFiles();
+  }
+
+  content::DevToolsAgentHostClient* GetRootClient() {
+    return handler_->root_session_->GetClient();
+  }
+
   TargetHandler* handler_;
   scoped_refptr<DevToolsAgentHost> agent_host_;
   std::string id_;