<webview>: Plumb edit commands

content/common/browser_plugin/browser_plugin_messages.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Multiply-included message header, no traditional include guard.
 
 #include <string>
 
 #include "base/basictypes.h"
 #include "base/process.h"
 #include "base/shared_memory.h"
 #include "base/values.h"
 #include "cc/output/compositor_frame.h"
 #include "cc/output/compositor_frame_ack.h"
 #include "content/common/browser_plugin/browser_plugin_message_enums.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
+#include "content/common/edit_command.h"
 #include "content/public/common/common_param_traits.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_message_macros.h"
 #include "ipc/ipc_message_utils.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDragOperation.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDragStatus.h"
 #include "ui/gfx/point.h"
 #include "ui/gfx/rect.h"
 #include "ui/gfx/size.h"
 #include "webkit/glue/webcursor.h"
@@ skipping 117 matching lines @@
 // to its origin.
 IPC_MESSAGE_ROUTED1(BrowserPluginHostMsg_AllocateInstanceID,
                     int /* request_id */)
 
 // This message is sent from BrowserPlugin to BrowserPluginGuest to issue an
 // edit command.
 IPC_MESSAGE_ROUTED2(BrowserPluginHostMsg_ExecuteEditCommand,
                      int /* instance_id */,
                      std::string /* command */)
 
+// This message must be sent just before sending a key event.
+IPC_MESSAGE_ROUTED2(BrowserPluginHostMsg_SetEditCommandsForNextKeyEvent,
+                    int /* instance_id */,
+                    std::vector<content::EditCommand> /* edit_commands */)

[Charlie Reis, 2013/05/28 16:49:25]

Sanity check: What damage could a compromised renderer do if it sent corrupted
EditCommands?  I see that we currently send them from the browser to the
renderer in input_messages.h, but the browser is trusted.  We wouldn't want a
bad renderer to take over the browser or another renderer by sending it a bad
EditCommand.

(If there's some validation logic or a reason this is safe, then I'm fine with
it.)

[Fady Samuel, 2013/05/28 21:24:17]

Edit commands are derived from key combinations. We already forward (and trust)
mouse events and touch events from the embedder to the guest. Why would edit
commands be any different?

Mind you, for keyboard events we actually grab those off the embedder's queue. I
did that for implementation simplicity and not necessarily for security:
NativeWebKeyboardEvents are required to process system keys if I recall
correctly. Thus, rather than creating a new WebKeyboardEvent for the guest from
the embedder, we grab the embedder's from its key queue.

Maybe we need to rethink the security of input events in general?

+
 // This message is sent to the browser process to enable or disable autosize
 // mode.
 IPC_MESSAGE_ROUTED3(
     BrowserPluginHostMsg_SetAutoSize,
     int /* instance_id */,
     BrowserPluginHostMsg_AutoSize_Params /* auto_size_params */,
     BrowserPluginHostMsg_ResizeGuest_Params /* resize_guest_params */)
 
 // This message is sent to the browser process to indicate that a BrowserPlugin
 // has taken ownership of the lifetime of the guest of the given |instance_id|.
@@ skipping 284 matching lines @@
 // request to the embeddder through this message.
 IPC_MESSAGE_CONTROL4(BrowserPluginMsg_RequestPermission,
                      int /* instance_id */,
                      BrowserPluginPermissionType /* permission_type */,
                      int /* request_id */,
                      DictionaryValue /* request_info */)
 
 // Forwards a PointerLock Unlock request to the BrowserPlugin.
 IPC_MESSAGE_CONTROL1(BrowserPluginMsg_UnlockMouse, int /* instance_id */)