Issue 1793 - check whether the frame is whitelisted before injecting CSS

src/plugin/PluginTabBase.cpp

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-2015 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with Adblock Plus.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #include "PluginStdAfx.h"
 #include "AdblockPlusClient.h"
 #include "PluginClientBase.h"
 #include "PluginSettings.h"
 #include "AdblockPlusDomTraverser.h"
 #include "PluginTabBase.h"
 #include "IeVersion.h"
+#include "../shared/Utils.h"
 #include <Mshtmhst.h>
 
 CPluginTabBase::CPluginTabBase(CPluginClass* plugin)
   : m_plugin(plugin)
   , m_isActivated(false)
   , m_continueThreadRunning(true)
 {
   m_filter = std::auto_ptr<CPluginFilter>(new CPluginFilter());
   m_filter->hideFiltersLoadedEvent = CreateEvent(NULL, true, false, NULL);
 
@@ skipping 161 matching lines @@
   params.rgvarg = &var;
   params.rgdispidNamedArgs = 0;
   hr = pWndEx->Invoke(dispid, IID_NULL, LOCALE_USER_DEFAULT, DISPATCH_PROPERTYPUT | DISPATCH_PROPERTYPUTREF, &params, 0, 0, 0);
   DEBUG_GENERAL("Invoke");
   if (FAILED(hr))
   {
     DEBUG_ERROR_LOG(hr, PLUGIN_ERROR_CREATE_SETTINGS_JAVASCRIPT, PLUGIN_ERROR_CREATE_SETTINGS_JAVASCRIPT_INVOKE, "CPluginTabBase::InjectABP - Failed to create Settings in JavaScript");
   }
 }
 
+namespace
+{
+  ATL::CComPtr<IWebBrowser2> GetParent(IWebBrowser2& browser)

[Eric, 2015/11/17 22:30:22]

    IWebBrowser2* GetParent(IWebBrowser2& browser)

+  {
+    ATL::CComPtr<IDispatch> parentDispatch;
+    if (FAILED(browser.get_Parent(&parentDispatch)) || !parentDispatch)
+    {
+      return nullptr;
+    }
+    // The InternetExplorer application always returns a pointer to itself.
+    // https://msdn.microsoft.com/en-us/library/aa752136(v=vs.85).aspx
+    if (parentDispatch.IsEqualObject(&browser))
+    {
+      return nullptr;
+    }

[Eric, 2015/11/17 22:30:22]

    ATL::CComQIPtr<IWebBrowser2> parent = parentDispatch; // Call QI and ensure
Release is called
    return parent; // invokes "operator IWebBrowser2*"

All the code below this can then be omitted.

That is, of course, assuming that IE acts sanely when it returns a parent
browser. The reason that get_Parent() returns IDispatch is for the case when the
browser is used as an ActiveX control outside of IE. We're inside IE entirely,
so it seems we should be able to assume that the IDispatch we receive is an
interface for a IWebBrowser2 object.

[sergei, 2015/11/18 10:07:50]

Yes, this is just an assumption and it does not work because `parent` is always
nullptr here. So we need the code below.

[Eric, 2015/11/18 14:24:02]

What do you mean "because `parent` is always nullptr"? Are you saying that the
IDispatch from get_Parent() is not actually a browser?

[sergei, 2015/11/18 14:28:17]

In your snippet
`parent` is nullptr. I don't know whether it's a browser or not, it does not
expose IWebBrowser2 through QueryInterface.

+    ATL::CComQIPtr<IServiceProvider> parentDocumentServiceProvider = parentDispatch;
+    if (!parentDocumentServiceProvider)
+    {
+      return nullptr;
+    }
+    ATL::CComPtr<IWebBrowserApp> webBrowserApp;
+    if (FAILED(parentDocumentServiceProvider->QueryService(IID_IWebBrowserApp, &webBrowserApp)) || !webBrowserApp)
+    {
+      return nullptr;
+    }
+    return ATL::CComQIPtr<IWebBrowser2>(webBrowserApp);
+  }

[Eric, 2015/11/18 15:25:22]

Except after the call to IsEqualObject(), many of the other returns of nullptr
really ought to be throwing logic_error instead. As it's written, we're
suppressing notifying ourselves of deficiencies in our own code.

I'm not going to insist that these be changed, though. Our exception handling is
fairly poor still, and not improving the code here in this way matters little at
this time.

+
+  bool IsFrameWhiteListed(ATL::CComPtr<IWebBrowser2> frame)
+  {
+    if (!frame)
+    {
+      return false;
+    }
+    auto url = GetLocationUrl(*frame);
+    std::vector<std::string> frameHierarchy;
+    while(frame = GetParent(*frame))
+    {
+      frameHierarchy.push_back(ToUtf8String(GetLocationUrl(*frame)));
+    }
+    CPluginClient* client = CPluginClient::GetInstance();
+    return client->IsWhitelistedUrl(url, frameHierarchy)
+        || client->IsElemhideWhitelistedOnDomain(url, frameHierarchy);
+  }
+}
+
 void CPluginTabBase::OnDownloadComplete(IWebBrowser2* browser)
 {
   CPluginClient* client = CPluginClient::GetInstance();
   std::wstring url = GetDocumentUrl();
   if (!client->IsWhitelistedUrl(url) && !client->IsElemhideWhitelistedOnDomain(url))
   {
     m_traverser->TraverseDocument(browser, GetDocumentDomain(), GetDocumentUrl());
   }
   InjectABP(browser);
 }
@@ skipping 169 matching lines @@
           LogQueue::LogPluginError(pluginError.GetErrorCode(), pluginError.GetErrorId(), pluginError.GetErrorSubid(), pluginError.GetErrorDescription(), true, pluginError.GetProcessId(), pluginError.GetThreadId());
         }
 
         // Non-hanging sleep
         Sleep(50);
       }
 
       tabLoopIteration++;
   }
 }