Sanitize chrome://extension-icon/ URL inputs.

chrome/browser/ui/webui/extension_icon_source.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/extension_icon_source.h"
 
 #include "base/callback.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/stl_util-inl.h"
 #include "base/string_number_conversions.h"
@@ skipping 246 matching lines @@
   match_param = match_param.substr(0, match_param.find('?'));
 
   // The icon size and match types are encoded as string representations of
   // their enum values, so to get the enum back, we read the string as an int
   // and then cast to the enum.
   Extension::Icons size;
   int size_num;
   if (!base::StringToInt(size_param, &size_num))
     return false;
   size = static_cast<Extension::Icons>(size_num);
+  if (size <= 0)
+    return false;
 
   ExtensionIconSet::MatchType match_type;
   int match_num;
   if (!base::StringToInt(match_param, &match_num))
     return false;
   match_type = static_cast<ExtensionIconSet::MatchType>(match_num);
+  if (!(match_type == ExtensionIconSet::MATCH_EXACTLY ||
+        match_type == ExtensionIconSet::MATCH_SMALLER ||
+        match_type == ExtensionIconSet::MATCH_BIGGER))
+    match_type = ExtensionIconSet::MATCH_EXACTLY;
 
   std::string extension_id = path_parts.at(0);
   const Extension* extension =
       profile_->GetExtensionService()->GetExtensionById(extension_id, true);
   if (!extension)
     return false;
 
   bool grayscale = path_lower.find("grayscale=true") != std::string::npos;
 
   SetData(request_id, extension, grayscale, size, match_type);
@@ skipping 29 matching lines @@
 
 void ExtensionIconSource::ClearData(int request_id) {
   std::map<int, ExtensionIconRequest*>::iterator i =
       request_map_.find(request_id);
   if (i == request_map_.end())
     return;
 
   delete i->second;
   request_map_.erase(i);
 }