mus: Add watcher for all touch events.

services/ui/ws/window_tree.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "services/ui/ws/window_tree.h"
 
 #include <stddef.h>
 
 #include <utility>
 
@@ skipping 1147 matching lines @@
                                   uint32_t observer_id) {
   if (matcher.is_null() || observer_id == 0) {
     // Clear any existing event observer.
     event_observer_matcher_.reset();
     event_observer_id_ = 0;
     return;
   }
 
   // Do not allow key events to be observed, as a compromised app could register
   // itself as an event observer and spy on keystrokes to another app.
-  if (!matcher->type_matcher) {
+  if (!matcher->type_matcher && !matcher->pointer_kind_matcher) {
     DVLOG(1) << "SetEventObserver must specify an event type.";
     return;
   }
+
   const ui::mojom::EventType event_type_whitelist[] = {
       ui::mojom::EventType::POINTER_CANCEL, ui::mojom::EventType::POINTER_DOWN,
       ui::mojom::EventType::POINTER_MOVE,   ui::mojom::EventType::POINTER_UP,
       ui::mojom::EventType::MOUSE_EXIT,     ui::mojom::EventType::WHEEL,
   };
+
   bool allowed = false;
-  for (ui::mojom::EventType event_type : event_type_whitelist) {
-    if (matcher->type_matcher->type == event_type) {
-      allowed = true;
-      break;
-    }
+  if (matcher->type_matcher) {
+    auto iter =
+        std::find(std::begin(event_type_whitelist),
+                  std::end(event_type_whitelist), matcher->type_matcher->type);
+    allowed = iter != std::end(event_type_whitelist);

[James Cook, 2016/07/12 23:22:59]

nit: I think this would be clearer with an early return if the item isn't found
on the whitelist. Ditto for an early return in the if() block below.

For example, if I'm a malicious client and I set matcher->type_matcher->type to
KEY_PRESSED and matcher->pointer_kind_matcher->pointer_kind to
PointerKind::MOUSE then "allowed" will be true at line 1193, even though I
should not be allowed to look for keystrokes.

EventMatcher::MatchesEvent() will still do the right thing, and won't match the
events, but it would be nice not to have to look at the EventMatcher
implementation to know that things are safe.

[sadrul, 2016/07/13 00:28:30]

Good catch! +1

[riajiang, 2016/07/13 15:40:21]

Done.

+  }
+  if (matcher->pointer_kind_matcher) {
+    ui::mojom::PointerKind pointer_kind =
+        matcher->pointer_kind_matcher->pointer_kind;
+    allowed = pointer_kind == ui::mojom::PointerKind::MOUSE ||

[msw, 2016/07/12 22:23:11]

q: Will we imminently add other PointerKind types that shouldn't be allowed? It
seems odd to check this if all PointerKind types are allowed.

[sadrul, 2016/07/13 00:28:30]

I don't really expect new pointer-kinds (I think stylus would just be PEN?).
This explicit check is to make sure external clients aren't using some invalid
pointer-kind.

+              pointer_kind == ui::mojom::PointerKind::TOUCH ||
+              pointer_kind == ui::mojom::PointerKind::PEN;
   }
   if (!allowed) {
     DVLOG(1) << "SetEventObserver event type not allowed";
     return;
   }
 
   event_observer_matcher_.reset(new EventMatcher(*matcher));
   event_observer_id_ = observer_id;
 }
 
@@ skipping 449 matching lines @@
 }
 
 bool WindowTree::IsWindowRootOfAnotherTreeForAccessPolicy(
     const ServerWindow* window) const {
   WindowTree* tree = window_server_->GetTreeWithRoot(window);
   return tree && tree != this;
 }
 
 }  // namespace ws
 }  // namespace ui