Sanitize JSON string before parsing it.

chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.chrome.browser.payments;
 
 import android.app.Activity;
 import android.graphics.Bitmap;
 import android.os.Handler;
 import android.text.TextUtils;
 
 import org.chromium.base.Callback;
 import org.chromium.base.Log;
 import org.chromium.chrome.browser.autofill.PersonalDataManager;
 import org.chromium.chrome.browser.autofill.PersonalDataManager.AutofillProfile;
 import org.chromium.chrome.browser.favicon.FaviconHelper;
 import org.chromium.chrome.browser.payments.ui.LineItem;
 import org.chromium.chrome.browser.payments.ui.PaymentInformation;
 import org.chromium.chrome.browser.payments.ui.PaymentOption;
 import org.chromium.chrome.browser.payments.ui.PaymentRequestUI;
 import org.chromium.chrome.browser.payments.ui.SectionInformation;
 import org.chromium.chrome.browser.payments.ui.ShoppingCart;
 import org.chromium.chrome.browser.preferences.PreferencesLauncher;
 import org.chromium.chrome.browser.preferences.autofill.AutofillCreditCardEditor;
 import org.chromium.chrome.browser.preferences.autofill.AutofillProfileEditor;
 import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.chrome.browser.util.UrlUtilities;
+import org.chromium.components.safejson.JsonSanitizer;
 import org.chromium.content.browser.ContentViewCore;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.mojo.system.MojoException;
 import org.chromium.mojom.payments.PaymentDetails;
 import org.chromium.mojom.payments.PaymentItem;
 import org.chromium.mojom.payments.PaymentOptions;
 import org.chromium.mojom.payments.PaymentRequest;
 import org.chromium.mojom.payments.PaymentRequestClient;
 import org.chromium.mojom.payments.PaymentResponse;
 import org.chromium.mojom.payments.ShippingOption;
 import org.chromium.ui.base.WindowAndroid;
 import org.json.JSONException;
 import org.json.JSONObject;
 
+import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Locale;
 import java.util.Set;
 import java.util.regex.Pattern;
 
 /**
@@ skipping 407 matching lines @@
 
         return new SectionInformation(PaymentRequestUI.TYPE_SHIPPING_OPTIONS,
                 result.size() == 1 ? 0 : SectionInformation.NO_SELECTION, result);
     }
 
     private JSONObject getValidatedData(Set<String> supportedMethods, String stringifiedData) {
         if (TextUtils.isEmpty(stringifiedData)) return new JSONObject();
 
         JSONObject result;
         try {
-            result = new JSONObject(stringifiedData);
-        } catch (JSONException e) {
-            // Payment method specific data should be a JSON object.
+            result = new JSONObject(JsonSanitizer.sanitize(stringifiedData));

[Robert Sesek, 2016/06/07 19:10:06]

I'm wondering if it'd be better to create a new class
org.chromium.compoents.safejson.SafeJsonParser that mimics the C++ interface and
returns a JSONObject. That way clients of the component don't have to understand
the sanitization that's happening underneath. And it'd provide symmetry between
C++ and Java interfaces.

+        } catch (JSONException | IOException | IllegalStateException e) {
+            // Payment method specific data should be a valid JSON object.
             return null;
         }
 
         Iterator<String> it = result.keys();
         while (it.hasNext()) {
             String name = it.next();
             // Each key should be one of the supported payment methods.
             if (!supportedMethods.contains(name)) return null;
             // Each value should be a JSON object.
             if (result.optJSONObject(name) == null) return null;
@@ skipping 232 matching lines @@
             }
             mPaymentMethodsSection = null;
         }
     }
 
     private void closeClient() {
         if (mClient != null) mClient.close();
         mClient = null;
     }
 }