Restrict JavaScript dialogs to 100 characters.

components/app_modal/javascript_dialog_manager.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/app_modal/javascript_dialog_manager.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/i18n/rtl.h"
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/utf_string_conversions.h"
 #include "components/app_modal/app_modal_dialog.h"
 #include "components/app_modal/app_modal_dialog_queue.h"
 #include "components/app_modal/javascript_app_modal_dialog.h"
 #include "components/app_modal/javascript_dialog_extensions_client.h"
 #include "components/app_modal/javascript_native_dialog_factory.h"
 #include "components/app_modal/native_app_modal_dialog.h"
 #include "components/url_formatter/elide_url.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/javascript_message_type.h"
 #include "grit/components_strings.h"
 #include "net/base/net_util.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/gfx/font_list.h"
+#include "ui/gfx/text_elider.h"
 
 namespace app_modal {
 namespace {
 
 #if !defined(OS_ANDROID)
 // Keep in sync with kDefaultMessageWidth, but allow some space for the rest of
 // the text.
 const int kUrlElideWidth = 350;
 #endif
 
@@ skipping 13 matching lines @@
   }
 
   DISALLOW_COPY_AND_ASSIGN(DefaultExtensionsClient);
 };
 
 bool ShouldDisplaySuppressCheckbox(
     ChromeJavaScriptDialogExtraData* extra_data) {
   return extra_data->has_already_shown_a_dialog_;
 }
 
+// JavaScript dialogs are heavily used for scams; reduce their power by removing
+// their ability to show long messages.
+base::string16 TruncateMessage(const base::string16& message) {
+  return gfx::TruncateString(message, 100, gfx::CHARACTER_BREAK);

[Peter Kasting, 2016/02/19 02:18:34]

Please use an eliding method rather than a truncation method so that at least
the message looks like we've elided it instead of just looking like a bug.

[Avi (use Gerrit), 2016/02/19 02:24:42]

This was a bad implementation; doing it in a new way in the new patchset.

+}
+
 }  // namespace
 
 ////////////////////////////////////////////////////////////////////////////////
 // JavaScriptDialogManager, public:
 
 // static
 JavaScriptDialogManager* JavaScriptDialogManager::GetInstance() {
   return base::Singleton<JavaScriptDialogManager>::get();
 }
 
@@ skipping 76 matching lines @@
   base::string16 dialog_title =
       GetTitle(web_contents, origin_url, accept_lang, is_alert);
 
   extensions_client_->OnDialogOpened(web_contents);
 
   AppModalDialogQueue::GetInstance()->AddDialog(new JavaScriptAppModalDialog(
       web_contents,
       &javascript_dialog_extra_data_,
       dialog_title,
       message_type,
-      message_text,
+      TruncateMessage(message_text),
       default_prompt_text,
       ShouldDisplaySuppressCheckbox(extra_data),
       false,  // is_before_unload_dialog
       false,  // is_reload
       base::Bind(&JavaScriptDialogManager::OnDialogClosed,
                  base::Unretained(this), web_contents, callback)));
 }
 
 void JavaScriptDialogManager::RunBeforeUnloadDialog(
     content::WebContents* web_contents,
@@ skipping 10 matching lines @@
     // lost its privilege to deny unloading.
     callback.Run(true, base::string16());
     return;
   }
 
   const base::string16 title = l10n_util::GetStringUTF16(is_reload ?
       IDS_BEFORERELOAD_MESSAGEBOX_TITLE : IDS_BEFOREUNLOAD_MESSAGEBOX_TITLE);
   const base::string16 footer = l10n_util::GetStringUTF16(is_reload ?
       IDS_BEFORERELOAD_MESSAGEBOX_FOOTER : IDS_BEFOREUNLOAD_MESSAGEBOX_FOOTER);
 
-  base::string16 full_message =
-      message_text + base::ASCIIToUTF16("\n\n") + footer;
+  base::string16 message =
+      TruncateMessage(message_text) + base::ASCIIToUTF16("\n\n") + footer;
 
   extensions_client_->OnDialogOpened(web_contents);
 
   AppModalDialogQueue::GetInstance()->AddDialog(new JavaScriptAppModalDialog(
       web_contents,
       &javascript_dialog_extra_data_,
       title,
       content::JAVASCRIPT_MESSAGE_TYPE_CONFIRM,
-      full_message,
+      message,
       base::string16(),  // default_prompt_text
       ShouldDisplaySuppressCheckbox(extra_data),
       true,        // is_before_unload_dialog
       is_reload,
       base::Bind(&JavaScriptDialogManager::OnDialogClosed,
                  base::Unretained(this), web_contents, callback)));
 }
 
 bool JavaScriptDialogManager::HandleJavaScriptDialog(
     content::WebContents* web_contents,
@@ skipping 87 matching lines @@
   // lazy background page after the dialog closes. (Dialogs are closed before
   // their WebContents is destroyed so |web_contents| is still valid here.)
   extensions_client_->OnDialogClosed(web_contents);
 
   last_close_time_ = base::TimeTicks::Now();
 
   callback.Run(success, user_input);
 }
 
 }  // namespace app_modal