[GCM] Only allow the senders that the application is currently registered for

chrome/browser/services/gcm/gcm_profile_service.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/services/gcm/gcm_profile_service.h"
 
 #include <string>
 #include <vector>
 
 #include "base/base64.h"
@@ skipping 888 matching lines @@
 }
 
 void GCMProfileService::MessageReceived(const std::string& app_id,
                                         GCMClient::IncomingMessage message) {
   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
 
   // Drop the event if signed out.
   if (username_.empty())
     return;
 
+  RegistrationInfoMap::iterator iter = registration_info_map_.find(app_id);
+  if (iter == registration_info_map_.end() ||
+      iter->second.sender_id != message.sender_id) {
+    return;
+  }
+
   GetEventRouter(app_id)->OnMessage(app_id, message);
 }
 
 void GCMProfileService::MessagesDeleted(const std::string& app_id) {
   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
 
   // Drop the event if signed out.
   if (username_.empty())
     return;
 
@@ skipping 135 matching lines @@
   // allowed.
   return false;
 }
 
 // static
 const char* GCMProfileService::GetPersistentRegisterKeyForTesting() {
   return kRegistrationKey;
 }
 
 }  // namespace gcm