Limit depth of parsing of dictionaries returned by JS evaluation.

ios/web/web_state/ui/web_view_js_utils.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/web_view_js_utils.h"
 
 #include <CoreFoundation/CoreFoundation.h>
 #import <WebKit/WebKit.h>
 
 #include "base/logging.h"
+#include "base/mac/foundation_util.h"
 #include "base/mac/scoped_nsobject.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/values.h"
 
 namespace web {
 
 NSString* const kJSEvaluationErrorDomain = @"JSEvaluationError";
+int const kMaximumParsingRecursionDepth = 6;
 
-std::unique_ptr<base::Value> ValueResultFromWKResult(id wk_result) {
+std::unique_ptr<base::Value> ValueResultFromWKResult(id wk_result,

[Eugene But (OOO till 7-30), 2016/09/12 16:12:00]

Could you please move this function to anonymous namespace and add comments.

[jif, 2016/09/13 09:41:09]

Done.

+                                                     int max_depth) {
   if (!wk_result)
     return nullptr;
 
   std::unique_ptr<base::Value> result;
+
+  if (max_depth < 0) {

[Eugene But (OOO till 7-30), 2016/09/12 16:12:00]

NIT: Should this be |max_depth <= 0| ?

Otherwise recursion depth can be 7

[jif, 2016/09/13 09:41:09]

I briefly looked at the definition of "depth", and it looks like the root node
of a tree has a depth of 0.

This means that if |max_depth| is 0, |ValueResultFromWKResult| should at least
parse the root node. This would not be the case with "max_depth <= 0", and is
why is chose "max_depth < 0".

Does that make sense?

[Eugene But (OOO till 7-30), 2016/09/13 15:52:55]

Sure.

+    DLOG(WARNING) << "JS maximum recursion depth exceeded.";
+    return result;
+  }
+
   CFTypeID result_type = CFGetTypeID(wk_result);
   if (result_type == CFStringGetTypeID()) {
     result.reset(new base::StringValue(base::SysNSStringToUTF16(wk_result)));
     DCHECK(result->IsType(base::Value::TYPE_STRING));
   } else if (result_type == CFNumberGetTypeID()) {
     result.reset(new base::FundamentalValue([wk_result doubleValue]));
     DCHECK(result->IsType(base::Value::TYPE_DOUBLE));
   } else if (result_type == CFBooleanGetTypeID()) {
     result.reset(
         new base::FundamentalValue(static_cast<bool>([wk_result boolValue])));
     DCHECK(result->IsType(base::Value::TYPE_BOOLEAN));
   } else if (result_type == CFNullGetTypeID()) {
     result = base::Value::CreateNullValue();
     DCHECK(result->IsType(base::Value::TYPE_NULL));
   } else if (result_type == CFDictionaryGetTypeID()) {
     std::unique_ptr<base::DictionaryValue> dictionary =
         base::MakeUnique<base::DictionaryValue>();
     for (id key in wk_result) {
-      DCHECK([key respondsToSelector:@selector(UTF8String)]);
-      const std::string& path([key UTF8String]);
-      dictionary->Set(path,
-                      ValueResultFromWKResult([wk_result objectForKey:key]));
+      NSString* objCString = base::mac::ObjCCast<NSString>(key);

[Eugene But (OOO till 7-30), 2016/09/12 16:12:00]

s/objCString/obj_c_string

[jif, 2016/09/13 09:41:09]

Done.

+      if (objCString) {

[Eugene But (OOO till 7-30), 2016/09/12 16:12:00]

Do you need this check? base::SysNSStringToUTF8 handles nil inputs just fine
returning empty strings.

[jif, 2016/09/13 09:41:09]

Ah, thanks!
Done.

+        const std::string path = base::SysNSStringToUTF8(objCString);
+        std::unique_ptr<base::Value> value = ValueResultFromWKResult(
+            [wk_result objectForKey:objCString], max_depth - 1);
+        if (value) {
+          dictionary->Set(path, std::move(value));
+        }
+      }
     }
     result = std::move(dictionary);
   } else {
     NOTREACHED();  // Convert other types as needed.
   }
   return result;
 }
 
+std::unique_ptr<base::Value> ValueResultFromWKResult(id wk_result) {
+  return ValueResultFromWKResult(wk_result, kMaximumParsingRecursionDepth);
+}
+
 void ExecuteJavaScript(WKWebView* web_view,
                        NSString* script,
                        JavaScriptResultBlock completion_handler) {
   DCHECK([script length]);
   if (!web_view && completion_handler) {
     dispatch_async(dispatch_get_main_queue(), ^{
       NSString* error_message =
           @"JS evaluation failed because there is no web view.";
       base::scoped_nsobject<NSError> error([[NSError alloc]
           initWithDomain:kJSEvaluationErrorDomain
                     code:JS_EVALUATION_ERROR_CODE_NO_WEB_VIEW
                 userInfo:@{NSLocalizedDescriptionKey : error_message}]);
       completion_handler(nil, error);
     });
     return;
   }
 
   [web_view evaluateJavaScript:script completionHandler:completion_handler];
 }
 
 }  // namespace web