Prevent leaking PDF data cross-origin

chrome/browser/resources/pdf/pdf.js

Index: chrome/browser/resources/pdf/pdf.js
diff --git a/chrome/browser/resources/pdf/pdf.js b/chrome/browser/resources/pdf/pdf.js
index 61dd1600f01b3e8c82e191763bc4fe2d7dc240d8..c4a282102e5e574a3bf4a4df3ff8e6a2dfbe8644 100644
--- a/chrome/browser/resources/pdf/pdf.js
+++ b/chrome/browser/resources/pdf/pdf.js
@@ -95,6 +95,7 @@ function PDFViewer(browserApi) {
   this.browserApi_ = browserApi;
   this.loadState_ = LoadState.LOADING;
   this.parentWindow_ = null;
+  this.parentOrigin_ = null;
 
   this.delayedScriptingMessages_ = [];
 
@@ -720,6 +721,7 @@ PDFViewer.prototype = {
   handleScriptingMessage: function(message) {
     if (this.parentWindow_ != message.source) {
       this.parentWindow_ = message.source;
+      this.parentOrigin_ = message.origin;
       // Ensure that we notify the embedder if the document is loaded.
       if (this.loadState_ != LoadState.LOADING)
         this.sendDocumentLoadedMessage_();
@@ -806,10 +808,25 @@ PDFViewer.prototype = {
    * @param {Object} message the message to send.
    */
   sendScriptingMessage_: function(message) {
-    if (this.parentWindow_)
-      this.parentWindow_.postMessage(message, '*');
-  },
+    if (this.parentWindow_ && this.parentOrigin_) {
+      var targetOrigin;
+      // Only send data back to the embedder if it is from the same origin,
+      // unless we're sending it to ourselves (which could happen in the case
+      // of tests). We also allow documentLoaded messages through as this won't
+      // leak important information.
+      if (this.parentOrigin_ == window.location.origin)
+        targetOrigin = this.parentOrigin_;
+      else if (message.type == 'documentLoaded')
+        targetOrigin = '*';
+      else
+        targetOrigin = this.browserApi_.getStreamInfo().originalUrl;
+      this.parentWindow_.postMessage(message, targetOrigin);
 
+      // Dispatch an event which can be hooked into for testing.
+      window.dispatchEvent(new CustomEvent('scripting-message-sent',

[Sam McNally, 2015/08/25 03:11:20]

Could you add an extra listener on the plugin object in tests instead of always
dispatching this event?

[raymes, 2015/08/25 04:02:23]

Done.

+          { 'detail': { 'target': this.parentWindow_, 'message': message } }));
+    }
+  },
 
   /**
    * @type {Viewport} the viewport of the PDF viewer.