Validate windows.create API's state input parameter.

chrome/browser/extensions/api/tabs/tabs_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/tabs/tabs_api.h"
 
 #include <algorithm>
 #include <limits>
 #include <vector>
 
@@ skipping 180 matching lines @@
       return ui::SHOW_STATE_MAXIMIZED;
     case windows::WINDOW_STATE_FULLSCREEN:
       return ui::SHOW_STATE_FULLSCREEN;
     case windows::WINDOW_STATE_NONE:
       return ui::SHOW_STATE_DEFAULT;
   }
   NOTREACHED();
   return ui::SHOW_STATE_DEFAULT;
 }
 
+bool IsValidStateForWindowsCreateFunction(
+    const windows::Create::Params::CreateData* create_data) {
+  if (!create_data)
+    return true;
+
+  bool has_bound = create_data->left || create_data->top ||
+                   create_data->width || create_data->height;
+  bool is_panel =
+      create_data->type == windows::CreateType::CREATE_TYPE_PANEL ||
+      create_data->type == windows::CreateType::CREATE_TYPE_DETACHED_PANEL;
+
+  switch (create_data->state) {
+    case windows::WINDOW_STATE_MINIMIZED:
+      // If minimised, default focused state should be unfocused.
+      return !(create_data->focused && *create_data->focused) && !has_bound &&
+             !is_panel;
+    case windows::WINDOW_STATE_MAXIMIZED:
+    case windows::WINDOW_STATE_FULLSCREEN:
+      // If maximised/fullscreen, default focused state should be focused.
+      return !(create_data->focused && !*create_data->focused) && !has_bound &&
+             !is_panel;
+    case windows::WINDOW_STATE_NORMAL:
+    case windows::WINDOW_STATE_NONE:
+      return true;
+  }
+  NOTREACHED();
+  return true;
+}
+
 }  // namespace
 
 void ZoomModeToZoomSettings(ZoomController::ZoomMode zoom_mode,
                             api::tabs::ZoomSettings* zoom_settings) {
   DCHECK(zoom_settings);
   switch (zoom_mode) {
     case ZoomController::ZOOM_MODE_DEFAULT:
       zoom_settings->mode = api::tabs::ZOOM_SETTINGS_MODE_AUTOMATIC;
       zoom_settings->scope = api::tabs::ZOOM_SETTINGS_SCOPE_PER_ORIGIN;
       break;
@@ skipping 203 matching lines @@
                     GetProfile(),
                     include_incognito(),
                     NULL,
                     &source_tab_strip,
                     NULL,
                     &tab_index,
                     &error_))
       return false;
   }
 
+  if (!IsValidStateForWindowsCreateFunction(create_data)) {
+    error_ = keys::kInvalidWindowStateError;
+    return false;
+  }
+
   Profile* window_profile = GetProfile();
   Browser::Type window_type = Browser::TYPE_TABBED;
   bool create_panel = false;
 
   // panel_create_mode only applies if create_panel = true
   PanelManager::CreateMode panel_create_mode = PanelManager::CREATE_AS_DOCKED;
 
   gfx::Rect window_bounds;
   bool focused = true;
   bool saw_focus_key = false;
@@ skipping 1537 matching lines @@
   ZoomModeToZoomSettings(zoom_mode, &zoom_settings);
   zoom_settings.default_zoom_factor.reset(new double(
       content::ZoomLevelToZoomFactor(zoom_controller->GetDefaultZoomLevel())));
 
   results_ = api::tabs::GetZoomSettings::Results::Create(zoom_settings);
   SendResponse(true);
   return true;
 }
 
 }  // namespace extensions