Add "Show saved copy" button in dino page when there's offline copy

chrome/browser/net/net_error_tab_helper.cc

Index: chrome/browser/net/net_error_tab_helper.cc
diff --git a/chrome/browser/net/net_error_tab_helper.cc b/chrome/browser/net/net_error_tab_helper.cc
index a0e73cf6cb1e2c50084dc6ce1a1817860884b2fe..2aa944c052eafd22a6bd0a9f09cd87b89371b7ed 100644
--- a/chrome/browser/net/net_error_tab_helper.cc
+++ b/chrome/browser/net/net_error_tab_helper.cc
@@ -13,6 +13,7 @@
 #include "chrome/browser/net/net_error_diagnostics_dialog.h"
 #include "chrome/browser/platform_util.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/common/localized_error.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/render_messages.h"
 #include "components/error_page/common/net_error_info.h"
@@ -124,7 +125,7 @@ void NetErrorTabHelper::DidStartProvisionalLoadForFrame(
   is_error_page_ = is_error_page;
 
 #if defined(OS_ANDROID)
-  SetHasOfflinePages(render_frame_host);
+  SetOfflinePageInfo(render_frame_host);
 #endif
 }
 
@@ -177,6 +178,7 @@ bool NetErrorTabHelper::OnMessageReceived(
                         RunNetworkDiagnostics)
 #if defined(OS_ANDROID)
     IPC_MESSAGE_HANDLER(ChromeViewHostMsg_ShowOfflinePages, ShowOfflinePages)
+    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_LoadOfflineCopy, LoadOfflineCopy)
 #endif
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
@@ -286,15 +288,19 @@ void NetErrorTabHelper::RunNetworkDiagnosticsHelper(
 }
 
 #if defined(OS_ANDROID)
-void NetErrorTabHelper::SetHasOfflinePages(
+void NetErrorTabHelper::SetOfflinePageInfo(
   content::RenderFrameHost* render_frame_host) {
   DCHECK(web_contents());
+  OfflinePageStatus status = OfflinePageStatus::NONE;
   TabAndroid* tab = TabAndroid::FromWebContents(web_contents());
-  bool has_offline_pages = tab && tab->HasOfflinePages();
+  if (tab && tab->HasOfflinePages()) {
+    status = tab->HasOfflineCopyForCurrentPage() ?
+        OfflinePageStatus::HAS_PAGE_COPY : OfflinePageStatus::HAS_OTHER_COPIES;
+  }
   render_frame_host->Send(
-      new ChromeViewMsg_SetHasOfflinePages(
+      new ChromeViewMsg_SetOfflinePageInfo(
           render_frame_host->GetRoutingID(),
-          has_offline_pages));
+          static_cast<int>(status)));
 }
 
 void NetErrorTabHelper::ShowOfflinePages() {
@@ -303,6 +309,13 @@ void NetErrorTabHelper::ShowOfflinePages() {
   if (tab)
     tab->ShowOfflinePages();
 }
-#endif
+
+void NetErrorTabHelper::LoadOfflineCopy(const GURL& url) {

[nasko, 2015/11/13 23:55:13]

Since this URL comes from the renderer, it cannot be directly trusted. It needs
to be validated first. The pattern used is:

GURL validated_url(url);
if (validated_url.is_valid())
  // do whatever is correct for invalid URLs, here probably just return

Also, Daniel's comment still stands - doesn't this method allow for any page to
be requested? Is this intentional? What are the allowed pages to load?

[jianli, 2015/11/14 00:26:05]

Done.
No. Yes, currently only error page is allowed to trigger loading the offline
page.

[mmenke, 2015/11/14 00:41:11]

The renderer is untrusted.  Any page could claim to be an error page (And you're
not even checking that the URL came from an error page, actually).  Looks like
the TabAndroid code will only let bookmarked pages in the "offline page cache"
(For lack of a better term) to be shown, so any compromised renderer could
navigate to a bookmarked paged.  I guess this could leak the information about
whether or not a page is bookmarked, since if it's not, the navigation won't
occur.  I don't see any other security or privacy issues here?

A security engineer should still look at this (And you need an owner for
renderer_messages.h, anyways, conveniently enough)

[nasko, 2015/11/14 00:43:49]

When the renderer process is exploited by an attacker, it can lie that an error
page has been loaded in the process. How are we guarding against that?

[jianli, 2015/11/14 00:46:05]

Per my understanding, the button click handling in error page are done by
NetErrorPageController that is injected into v8. If we have problem with this,
all methods defined in NetErrorPageController face the same problem. 

+  DCHECK(web_contents());
+  TabAndroid* tab = TabAndroid::FromWebContents(web_contents());
+  if (tab)
+    tab->LoadOfflineCopy(url);
+}
+#endif  // defined(OS_ANDROID)
 
 }  // namespace chrome_browser_net