mus: Add watcher for all touch events.

services/ui/ws/window_tree.cc

Index: services/ui/ws/window_tree.cc
diff --git a/services/ui/ws/window_tree.cc b/services/ui/ws/window_tree.cc
index 8a62bdd534534c4c4b111647511e306071068afe..65a5f771838ac8224b88988c0431a178ec74209b 100644
--- a/services/ui/ws/window_tree.cc
+++ b/services/ui/ws/window_tree.cc
@@ -1165,21 +1165,30 @@ void WindowTree::SetEventObserver(mojom::EventMatcherPtr matcher,
 
   // Do not allow key events to be observed, as a compromised app could register
   // itself as an event observer and spy on keystrokes to another app.
-  if (!matcher->type_matcher) {
+  if (!matcher->type_matcher && !matcher->pointer_kind_matcher) {
     DVLOG(1) << "SetEventObserver must specify an event type.";
     return;
   }
+
   const ui::mojom::EventType event_type_whitelist[] = {
       ui::mojom::EventType::POINTER_CANCEL, ui::mojom::EventType::POINTER_DOWN,
       ui::mojom::EventType::POINTER_MOVE,   ui::mojom::EventType::POINTER_UP,
       ui::mojom::EventType::MOUSE_EXIT,     ui::mojom::EventType::WHEEL,
   };
+
   bool allowed = false;
-  for (ui::mojom::EventType event_type : event_type_whitelist) {
-    if (matcher->type_matcher->type == event_type) {
-      allowed = true;
-      break;
-    }
+  if (matcher->type_matcher) {
+    auto iter =
+        std::find(std::begin(event_type_whitelist),
+                  std::end(event_type_whitelist), matcher->type_matcher->type);
+    allowed = iter != std::end(event_type_whitelist);

[James Cook, 2016/07/12 23:22:59]

nit: I think this would be clearer with an early return if the item isn't found
on the whitelist. Ditto for an early return in the if() block below.

For example, if I'm a malicious client and I set matcher->type_matcher->type to
KEY_PRESSED and matcher->pointer_kind_matcher->pointer_kind to
PointerKind::MOUSE then "allowed" will be true at line 1193, even though I
should not be allowed to look for keystrokes.

EventMatcher::MatchesEvent() will still do the right thing, and won't match the
events, but it would be nice not to have to look at the EventMatcher
implementation to know that things are safe.

[sadrul, 2016/07/13 00:28:30]

Good catch! +1

[riajiang, 2016/07/13 15:40:21]

Done.

+  }
+  if (matcher->pointer_kind_matcher) {
+    ui::mojom::PointerKind pointer_kind =
+        matcher->pointer_kind_matcher->pointer_kind;
+    allowed = pointer_kind == ui::mojom::PointerKind::MOUSE ||

[msw, 2016/07/12 22:23:11]

q: Will we imminently add other PointerKind types that shouldn't be allowed? It
seems odd to check this if all PointerKind types are allowed.

[sadrul, 2016/07/13 00:28:30]

I don't really expect new pointer-kinds (I think stylus would just be PEN?).
This explicit check is to make sure external clients aren't using some invalid
pointer-kind.

+              pointer_kind == ui::mojom::PointerKind::TOUCH ||
+              pointer_kind == ui::mojom::PointerKind::PEN;
   }
   if (!allowed) {
     DVLOG(1) << "SetEventObserver event type not allowed";