Make limitations for input.ime.sendKeyEvents API.

chrome/browser/ui/input_method/input_method_engine.cc

Index: chrome/browser/ui/input_method/input_method_engine.cc
diff --git a/chrome/browser/ui/input_method/input_method_engine.cc b/chrome/browser/ui/input_method/input_method_engine.cc
index 81a8f4cac492fad5ae3dff8a4eca70e5d67a154e..0cbe387a4f83bf7b4a08a8ade7ea361428c59c50 100644
--- a/chrome/browser/ui/input_method/input_method_engine.cc
+++ b/chrome/browser/ui/input_method/input_method_engine.cc
@@ -4,7 +4,16 @@
 
 #include "chrome/browser/ui/input_method/input_method_engine.h"
 
+#include "chrome/browser/ui/browser_finder.h"
+#include "chrome/browser/ui/browser_window.h"
+#include "chrome/browser/ui/tabs/tab_strip_model.h"
+#include "chrome/common/url_constants.h"
+#include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/render_frame_host.h"
+#include "content/public/common/url_constants.h"
+#include "extensions/common/constants.h"
+#include "ui/aura/window.h"
+#include "ui/aura/window_tree_host.h"
 #include "ui/base/ime/composition_text.h"
 #include "ui/base/ime/ime_bridge.h"
 #include "ui/base/ime/ime_input_context_handler_interface.h"
@@ -185,6 +194,11 @@ ui::ImeWindow* InputMethodEngine::FindWindowById(int window_id) const {
 bool InputMethodEngine::SendKeyEvent(ui::KeyEvent* event,
                                      const std::string& code) {
   DCHECK(event);
+
+  // input.ime.sendKeyEvents API is only allowed to work on text fields.
+  if (current_input_type_ == ui::TEXT_INPUT_TYPE_NONE)
+    return false;
+
   if (event->key_code() == ui::VKEY_UNKNOWN)
     event->set_key_code(ui::DomCodeToUsLayoutKeyboardCode(event->code()));
 
@@ -192,9 +206,73 @@ bool InputMethodEngine::SendKeyEvent(ui::KeyEvent* event,
       ui::IMEBridge::Get()->GetInputContextHandler();
   if (!input_context)
     return false;
+
+  Browser* browser = chrome::FindLastActive();
+  DCHECK(browser);
+  content::WebContents* web_contents =
+      browser->tab_strip_model()->GetActiveWebContents();
+  ui::InputMethod* input_method =
+      browser->window()->GetNativeWindow()->GetHost()->GetInputMethod();
+
+  if (web_contents) {
+    GURL url = web_contents->GetLastCommittedURL();
+    // If |input_context->GetInputMethod() != input_method|, treats |url| as

[Devlin, 2016/06/23 18:43:22]

Should this ever happen?  If not, can we just never send the key event?

[Azure Wei, 2016/06/24 06:38:19]

This could happen when the current top input view has not been set as last
active browser, like panel AppWindow. I don't think we should not send the key
events for all these cases, since the input method that will handle the events
is still the right window. Not sending the key events will make the API unable
to work under lots of cases like chrome Apps. 

+    // special page no mater what it is.
+    bool url_trustable = input_context->GetInputMethod() == input_method;
+    if (!url.is_empty() && !IsValidKeyForSpecialPage(url, url_trustable, event))

[Devlin, 2016/06/23 18:43:21]

same question as above for url.is_empty()

[Azure Wei, 2016/06/24 06:38:18]

Removed this check as it should not happen. And if it happens, it will be
treated as 'special url'.

+      return false;
+  }
+
   input_context->SendKeyEvent(event);
 
   return true;
 }
 
+bool InputMethodEngine::IsValidKeyForSpecialPage(const GURL& url,
+                                                 bool url_trustable,
+                                                 ui::KeyEvent* ui_event) {
+  // input.ime.sendKeyEvents API is not allowed to send ENTER et al. keys on
+  // some special pages (like chrome://).
+  std::vector<const char*> whitelist_schemes{url::kFtpScheme, url::kHttpScheme,
+                                             url::kHttpsScheme};
+  std::vector<GURL> whitelist_urls{GURL(url::kAboutBlankURL),
+                                   GURL(chrome::kChromeUINewTabURL)};
+
+  // Checks if the current url is special url.
+  if (url_trustable) {
+    for (auto scheme : whitelist_schemes) {
+      if (url.SchemeIs(scheme))
+        return true;
+    }
+    for (auto whitelist_url : whitelist_urls) {
+      if (url.spec().substr(0, whitelist_url.spec().size()) ==

[Devlin, 2016/06/23 18:43:22]

probably compare GURL::GetOrigin() here.

[Azure Wei, 2016/06/24 06:38:19]

Done.

+          whitelist_url.spec())
+        return true;
+    }
+  }
+
+  std::vector<ui::KeyboardCode> whitelist_keycodes{
+      ui::VKEY_BACK, ui::VKEY_LEFT, ui::VKEY_RIGHT, ui::VKEY_UP, ui::VKEY_DOWN};

[Devlin, 2016/06/23 18:43:22]

is this git cl formatted?

[Azure Wei, 2016/06/24 06:38:19]

Yes. It's formatted.

+  std::vector<ui::KeyboardCode> invalid_character_keycodes{ui::VKEY_TAB,
+                                                           ui::VKEY_RETURN};
+
+  // Whitelists all character keys.
+  if (ui_event->GetDomKey().IsCharacter() && !ui_event->IsControlDown() &&
+      !ui_event->IsCommandDown()) {
+    for (auto invalid_key : invalid_character_keycodes) {
+      if (ui_event->key_code() == invalid_key)
+        return false;
+    }
+    return true;
+  }
+
+  // Checks if the key event is white listed key.
+  for (auto key : whitelist_keycodes) {
+    if (ui_event->key_code() == key)
+      return true;
+  }
+
+  return false;
+}
+
 }  // namespace input_method