Media Session: passing metadata from renderer/ to browser/.

content/renderer/media/android/renderer_media_session_manager.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/android/renderer_media_session_manager.h"
 
 #include "base/logging.h"
 #include "content/common/media/media_session_messages_android.h"
+#include "content/public/common/media_metadata.h"
 #include "content/public/renderer/render_thread.h"
 #include "content/renderer/media/android/webmediasession_android.h"
 
 namespace content {
 
 static const int kDefaultMediaSessionID = 0;
 
 RendererMediaSessionManager::RendererMediaSessionManager(
     RenderFrame* render_frame)
     : RenderFrameObserver(render_frame),
@@ skipping 33 matching lines @@
 }
 
 void RendererMediaSessionManager::Deactivate(
     int session_id,
     scoped_ptr<blink::WebMediaSessionDeactivateCallback> callback) {
   int request_id = pending_deactivation_requests_.Add(callback.release());
   Send(
       new MediaSessionHostMsg_Deactivate(routing_id(), session_id, request_id));
 }
 
+void RendererMediaSessionManager::SetMetadata(
+    int session_id,
+    const content::MediaMetadata& metadata) {
+  // Apply some security rules on the MediaMetadata before sending over IPC.

[philipj_slow, 2015/12/14 14:09:24]

Does it help to apply this on the renderer side as well? If the renderer is
compromised, then presumably these checks won't stop it from being naughty?
(Pardon my ignorance if this is how it's always done, for some reason.)

[mlamouri (slow - plz ping), 2016/01/05 16:01:17]

This is mostly sanity check: a string more than 4000 characters long is whether
a bug or an attempt to mess with the browser process. A process sending a string
with 10k characters will not be killed, the string will only be shortened.

[philipj_slow, 2016/01/18 12:31:43]

If it's only a sanity check, maybe s/security rules/sanity check/ in the comment
so that it doesn't look like this code matters for security? Still not sure if
there's any harm in just removing the checks, would like to learn :)

[mlamouri (slow - plz ping), 2016/01/19 14:20:09]

Updated the comment. I was asked to do that a while ago by the security team for
websites provided string sent over IPC. My understanding is that malicious
websites might try to overflow the browser process. Also, long string might help
using exploit. Though, my understanding might be wrong. I'm not part of the
security team for a reason ;)

+  MediaMetadata ipc_metadata = metadata;
+  ipc_metadata.title = base::NullableString16(

[jochen (gone - plz use gerrit), 2015/12/14 12:38:30]

i'm surprised this has to be done manually, and you don't have to just use the
ipc macros to declare the struct fields :-/

[mlamouri (slow - plz ping), 2016/01/05 16:01:17]

AFAICT, it isn't done very often.

+      ipc_metadata.title.string().substr(0, MediaMetadata::kMaxIPCStringLength),
+      ipc_metadata.title.is_null());
+  ipc_metadata.artist = base::NullableString16(
+      ipc_metadata.artist.string().substr(0,
+                                          MediaMetadata::kMaxIPCStringLength),
+      ipc_metadata.artist.is_null());
+  ipc_metadata.album = base::NullableString16(
+      ipc_metadata.album.string().substr(0, MediaMetadata::kMaxIPCStringLength),
+      ipc_metadata.album.is_null());
+
+  Send(new MediaSessionHostMsg_SetMetadata(routing_id(),
+                                           session_id,
+                                           ipc_metadata));
+}
+
 void RendererMediaSessionManager::OnDidActivate(int request_id, bool success) {
   DCHECK(pending_activation_requests_.Lookup(request_id)) << request_id;
   blink::WebMediaSessionActivateCallback* callback =
       pending_activation_requests_.Lookup(request_id);
   if (success) {
     callback->onSuccess();
   } else {
     callback->onError(
         blink::WebMediaSessionError(blink::WebMediaSessionError::Activate));
   }
   pending_activation_requests_.Remove(request_id);
 }
 
 void RendererMediaSessionManager::OnDidDeactivate(int request_id) {
   DCHECK(pending_deactivation_requests_.Lookup(request_id)) << request_id;
   pending_deactivation_requests_.Lookup(request_id)->onSuccess();
   pending_deactivation_requests_.Remove(request_id);
 }
 
 }  // namespace content