Sanitize JSON string before parsing it.

chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java

Index: chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java
index 8c920f4ac903726efc7e359c2b440323be725240..ab5c84026ee28a805033a1355d50ba6df31d5332 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java
@@ -25,6 +25,7 @@ import org.chromium.chrome.browser.preferences.autofill.AutofillCreditCardEditor
 import org.chromium.chrome.browser.preferences.autofill.AutofillProfileEditor;
 import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.chrome.browser.util.UrlUtilities;
+import org.chromium.components.safejson.JsonSanitizer;
 import org.chromium.content.browser.ContentViewCore;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.mojo.system.MojoException;
@@ -39,6 +40,7 @@ import org.chromium.ui.base.WindowAndroid;
 import org.json.JSONException;
 import org.json.JSONObject;
 
+import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
@@ -466,9 +468,9 @@ public class PaymentRequestImpl implements PaymentRequest, PaymentRequestUI.Clie
 
         JSONObject result;
         try {
-            result = new JSONObject(stringifiedData);
-        } catch (JSONException e) {
-            // Payment method specific data should be a JSON object.
+            result = new JSONObject(JsonSanitizer.sanitize(stringifiedData));

[Robert Sesek, 2016/06/07 19:10:06]

I'm wondering if it'd be better to create a new class
org.chromium.compoents.safejson.SafeJsonParser that mimics the C++ interface and
returns a JSONObject. That way clients of the component don't have to understand
the sanitization that's happening underneath. And it'd provide symmetry between
C++ and Java interfaces.

+        } catch (JSONException | IOException | IllegalStateException e) {
+            // Payment method specific data should be a valid JSON object.
             return null;
         }