SecureBrowser Class Reference

#include <SecureBrowser.hpp>

Static Public Member Functions
static bool	open (const std::string &url, int argc, char **argv)
static void	open (const std::string &url)
static void	openInWindow (const std::string &url, uintptr_t window_id)
static void	open_notify (const std::string &url, int argc, char **argv)
static void	open_notify (const std::string &url)
static CefRefPtr< CefApp >	createApp ()

Detailed Description

Definition at line 25 of file SecureBrowser.hpp.

Member Function Documentation

createApp()

CefRefPtr< CefApp > SecureBrowser::createApp ( )

static

Definition at line 632 of file SecureBrowser.cpp.

                                           {
    return new ClamApp();
}

References ClamApp::ClamApp().

Referenced by open(), and open_notify().

open() [1/2]

void SecureBrowser::open ( const std::string & url )

inlinestatic

Definition at line 29 of file SecureBrowser.hpp.

                                           {
        open(url, 0, nullptr);
    }

References open().

open() [2/2]

bool SecureBrowser::open ( const std::string & url, int argc, char ** argv )

static

Definition at line 636 of file SecureBrowser.cpp.

                                                                    {
    if (!BastionGuard::Platform::cef_available()) {
        std::cerr << _("[SecureBrowser] CEF disabilitato su questa build o distribuzione.\n");
        return false;
    }
 
    if (!std::getenv("BG_SANDBOX"))
        start_local_warning_server();
 
    bool expected = false;
    if (!g_cef_started.compare_exchange_strong(expected, true)) {
        std::cerr << _("[SecureBrowser] ⚠️ Richiesta duplicata nello stesso processo.\n");
        return false;
    }
 
    InstanceLock lock("/tmp/BastionGuard-bankopener.lock");
    if (!lock.acquired()) {
        std::cerr << _("[SecureBrowser] ℹ️ Istanza già attiva. Rifiuto nuovo avvio.\n");
        g_cef_started = false;
        return false;
    }
 
    auto fail = [&](const std::string& msg) -> bool {
        std::cerr << msg << "\n";
        g_cef_started = false;
        return false;
    };
 
    std::cout << _("[SecureBrowser] 🧩 Avvio sandbox Blink/CEF per URL: ") << url << std::endl;
 
    clear_proxy_env();
 
    setenv("SSL_CERT_DIR", "/etc/ssl/certs", 1);
    setenv("SSL_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt", 1);
    setenv("NSS_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt", 1);
    setenv("NSS_CERT_DIR", "/etc/ssl/certs", 1);
 
    const std::string cef_dir   = "/usr/share/BastionGuard/cef";
    const std::string cache_dir = Glib::get_home_dir() + "/.cache/BastionGuard/cef_sandbox";
    std::error_code ec;
    fs::create_directories(cache_dir, ec);
    if (ec) {
        std::cerr << _("[SecureBrowser] ⚠️ Creazione cache_dir fallita: ") << ec.message() << "\n";
    }
 
    // Profilo CEF dedicato persistente: non importiamo cookie dal browser
    // esterno (Firefox/Chrome), ma manteniamo quelli creati dalla sessione
    // sicura. Questo evita di mischiare token legati a fingerprint diversi.
    setenv("BG_CEF_PERSIST_SESSION", "1", 1);
 
    CefMainArgs args(argc, argv);
    CefRefPtr<CefApp> app = createApp();
 
    auto try_init_cef = [&](const char* backend) -> bool {
        if (backend) setenv("BastionGuard_CEF_BACKEND", backend, 1);
 
        CefSettings settings;
        settings.no_sandbox = true;
        settings.windowless_rendering_enabled = false;
        settings.log_severity = LOGSEVERITY_WARNING;
        settings.background_color = CefColorSetARGB(0xFF, 0xFF, 0xFF, 0xFF);
 
        CefString(&settings.resources_dir_path) = cef_dir;
        CefString(&settings.locales_dir_path)   = cef_dir + "/locales";
        CefString(&settings.cache_path)         = cache_dir;
 
        // Il tuo SDK CEF espone persist_session_cookies (a differenza di
        // persist_user_preferences, che nella build in uso non esiste).
        // Con cache_path non vuoto conserva anche i cookie senza Expires/Max-Age.
        settings.persist_session_cookies = true;
 
        bool init_ok = CefInitialize(args, settings, app, nullptr);
        if (!init_ok) {
            std::cerr << _("[SecureBrowser] ❌ CefInitialize returned false for backend: ")
            << (backend ? backend : "auto") << "\n";
        }
        return init_ok;
    };
 
    // -------------------------------------------------------------------------
    //  Scelta backend prima di CefInitialize.
    //
    //  CEF chiama OnBeforeCommandLineProcessing UNA VOLTA SOLA, prima del primo
    //  CefInitialize, e CefInitialize non si può ri-eseguire dentro lo stesso
    //  processo. Quindi il backend va deciso QUI, e l'eventuale fallback X11
    //  va impostato via env (BastionGuard_CEF_BACKEND/OZONE_PLATFORM) prima di
    //  toccare CefInitialize. Se CefInitialize fallisce, il processo deve
    //  ri-execvp se stesso impostando l'env diverso.
    // -------------------------------------------------------------------------
    auto pick_backend = []() -> const char* {
        if (const char* b = std::getenv("BastionGuard_CEF_BACKEND")) {
            if (std::strcmp(b, "wayland") == 0 || std::strcmp(b, "x11") == 0)
                return b;
        }
        if (const char* o = std::getenv("OZONE_PLATFORM")) {
            if (std::strcmp(o, "wayland") == 0 || std::strcmp(o, "x11") == 0)
                return o;
        }
        if (const char* s = std::getenv("XDG_SESSION_TYPE")) {
            if (std::strcmp(s, "wayland") == 0) return "wayland";
            if (std::strcmp(s, "x11")     == 0) return "x11";
        }
        if (std::getenv("WAYLAND_DISPLAY")) return "wayland";
        if (std::getenv("DISPLAY"))         return "x11";
        return "x11"; // default safe
    };
 
    const char* backend_pref = pick_backend();
    std::cerr << _("[SecureBrowser] backend preferito: ") << backend_pref << "\n";
 
    bool ok = try_init_cef(backend_pref);
 
    // Fallback: se Wayland fallisce e DISPLAY è disponibile, ri-execvp con X11.
    // (CefInitialize non si può richiamare nello stesso processo.)
    if (!ok && std::strcmp(backend_pref, "wayland") == 0 &&
        std::getenv("DISPLAY") && !std::getenv("BG_CEF_X11_FALLBACK")) {
        std::cerr << _("[SecureBrowser] ⚠️ CEF Wayland fallito → re-exec con X11.\n");
        setenv("BG_CEF_X11_FALLBACK",        "1",   1);
        setenv("BastionGuard_CEF_BACKEND",   "x11", 1);
        setenv("OZONE_PLATFORM",             "x11", 1);
        setenv("GDK_BACKEND",                "x11", 1);
        unsetenv("WAYLAND_DISPLAY");
        // execvp con argv originale: re-entry sicuro, niente stato CEF a metà.
        if (argv && argv[0]) {
            std::vector<char*> reargv;
            for (int i = 0; i < argc; ++i) reargv.push_back(argv[i]);
            reargv.push_back(nullptr);
            execvp(argv[0], reargv.data());
            std::perror("execvp(x11 fallback)");
        }
    }
 
    if (!ok) {
        return fail(_("[SecureBrowser] ❌ CefInitialize fallito definitivamente."));
    }
 
    CefRefPtr<SimpleHandler> handler = new SimpleHandler();
    CefRefPtr<SecureBrowserViewDelegate> view_delegate =
        new SecureBrowserViewDelegate();
 
    CefBrowserSettings bset;
    bset.javascript = STATE_ENABLED;
    bset.webgl = STATE_ENABLED;
 
    CefRefPtr<CefBrowserView> mainView =
    CefBrowserView::CreateBrowserView(
        handler, url, bset, nullptr, nullptr, view_delegate);
 
    if (!mainView) {
        CefShutdown();
        return fail(_("[SecureBrowser] ❌ CreateBrowserView() ha restituito nullptr."));
    }
 
    class WindowDelegate : public CefWindowDelegate {
    public:
        explicit WindowDelegate(CefRefPtr<CefBrowserView> main) : mainView_(main) {}
 
        void OnWindowCreated(CefRefPtr<CefWindow> window) override {
            window->AddChildView(mainView_);
            window->SetBounds(CefRect(100, 100, 1200, 800));
            mainView_->SetBounds(CefRect(0, 0, 1200, 800));
            window->SetTitle("BastionGuard Secure Browser");
            window->Show();
        }
 
        void OnWindowDestroyed(CefRefPtr<CefWindow>) override {
            CefQuitMessageLoop();
        }
 
        IMPLEMENT_REFCOUNTING(WindowDelegate);
 
    private:
        CefRefPtr<CefBrowserView> mainView_;
    };
 
    CefWindow::CreateTopLevelWindow(new WindowDelegate(mainView));
 
    std::cout << _("[SecureBrowser] ✅ Finestra sandbox creata, avvio message loop.\n");
 
    CefRunMessageLoop();
    CefShutdown();
 
    g_cef_started = false;
    std::cout << _("[SecureBrowser] ✅ Sandbox chiusa correttamente.\n");
    return true;
}

References _, InstanceLock::acquired(), BastionGuard::Platform::cef_available(), clear_proxy_env(), createApp(), g_cef_started, main(), and start_local_warning_server().

Referenced by open(), SecureList::open_if_allowed(), BankOpener::open_if_trusted(), and openInWindow().

open_notify() [1/2]

void SecureBrowser::open_notify ( const std::string & url )

inlinestatic

Definition at line 40 of file SecureBrowser.hpp.

                                                  {
        open_notify(url, 0, nullptr);
    }

References open_notify().

open_notify() [2/2]

void SecureBrowser::open_notify ( const std::string & url, int argc, char ** argv )

static

Definition at line 897 of file SecureBrowser.cpp.

                                                                           {
    if (!BastionGuard::Platform::cef_available()) {
        std::cerr << _("[SecureBrowser] Notifiche CEF disabilitate su questa build o distribuzione.\n");
        return;
    }
 
    static std::atomic<bool> s_running{false};
    bool expected = false;
    if (!s_running.compare_exchange_strong(expected, true)) {
        std::cerr << _("[SecureBrowser] open_notify: già in esecuzione, ignoro\n");
        return;
    }
 
    InstanceLock lock("/tmp/BastionGuard-notify.lock");
    if (!lock.acquired()) {
        std::cerr << _("[SecureBrowser] open_notify: istanza notifica già attiva\n");
        s_running = false;
        return;
    }
 
    std::cout << _("[SecureBrowser] 🛡️ Apertura finestra notifica: ") << url << "\n";
 
    clear_proxy_env();
 
    setenv("SSL_CERT_DIR", "/etc/ssl/certs", 1);
    setenv("SSL_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt", 1);
 
    const std::string cef_dir   = "/usr/share/BastionGuard/cef";
    const std::string cache_dir = Glib::get_home_dir() + "/.cache/BastionGuard/cef_notify";
    std::error_code ec;
    fs::create_directories(cache_dir, ec);
 
    CefMainArgs args(argc ? argc : 0, argv);
    CefRefPtr<CefApp> app = createApp();
 
    CefSettings settings;
    settings.no_sandbox                   = true;
    settings.windowless_rendering_enabled = false;
    settings.log_severity                 = LOGSEVERITY_DISABLE;
    settings.background_color             = CefColorSetARGB(0xFF, 0x07, 0x09, 0x0F);
 
    CefString(&settings.resources_dir_path) = cef_dir;
    CefString(&settings.locales_dir_path)   = cef_dir + "/locales";
    CefString(&settings.cache_path)         = cache_dir;
 
    if (!CefInitialize(args, settings, app, nullptr)) {
        std::cerr << _("[SecureBrowser] ❌ open_notify: CefInitialize fallito\n");
        s_running = false;
        return;
    }
 
    class NotifyHandler : public CefClient,
    public CefLifeSpanHandler,
    public CefDisplayHandler {
    public:
        CefRefPtr<CefLifeSpanHandler> GetLifeSpanHandler() override { return this; }
        CefRefPtr<CefDisplayHandler> GetDisplayHandler() override { return this; }
 
        void OnAfterCreated(CefRefPtr<CefBrowser>) override {}
 
        void OnBeforeClose(CefRefPtr<CefBrowser>) override {
            CEF_REQUIRE_UI_THREAD();
            CefQuitMessageLoop();
        }
 
        IMPLEMENT_REFCOUNTING(NotifyHandler);
    };
 
    CefRefPtr<NotifyHandler> handler = new NotifyHandler();
    CefBrowserSettings bset;
    bset.javascript = STATE_ENABLED;
 
    CefRefPtr<CefBrowserView> view =
    CefBrowserView::CreateBrowserView(handler, url, bset, nullptr, nullptr, nullptr);
 
    if (!view) {
        std::cerr << _("[SecureBrowser] ❌ open_notify: CreateBrowserView fallito\n");
        CefShutdown();
        s_running = false;
        return;
    }
 
    class NotifyWindowDelegate : public CefWindowDelegate {
    public:
        explicit NotifyWindowDelegate(CefRefPtr<CefBrowserView> v) : view_(v) {}
 
        void OnWindowCreated(CefRefPtr<CefWindow> w) override {
            w->AddChildView(view_);
            w->SetBounds(CefRect(200, 200, 560, 420));
            view_->SetBounds(CefRect(0, 0, 560, 420));
            w->SetTitle(_("BastionGuard — Protected Session"));
            w->Show();
        }
 
        void OnWindowDestroyed(CefRefPtr<CefWindow>) override {
            CefQuitMessageLoop();
        }
 
        IMPLEMENT_REFCOUNTING(NotifyWindowDelegate);
 
    private:
        CefRefPtr<CefBrowserView> view_;
    };
 
    CefWindow::CreateTopLevelWindow(new NotifyWindowDelegate(view));
    CefRunMessageLoop();
    CefShutdown();
 
    s_running = false;
    std::cout << _("[SecureBrowser] ✅ Finestra notifica chiusa.\n");
}

References _, InstanceLock::acquired(), BastionGuard::Platform::cef_available(), clear_proxy_env(), and createApp().

Referenced by open_notify(), and open_notify_window().

openInWindow()

void SecureBrowser::openInWindow ( const std::string & url, uintptr_t window_id )

inlinestatic

Definition at line 32 of file SecureBrowser.hpp.

                                                                        {
        open(url, 0, nullptr);
    }

References open().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/SecureBrowser.hpp
• BastionGuard/src/SecureBrowser.cpp