Check the format of an applicationServerKey when used to register a push subscription.

third_party/WebKit/Source/modules/push_messaging/PushSubscriptionOptions.cpp

Index: third_party/WebKit/Source/modules/push_messaging/PushSubscriptionOptions.cpp
diff --git a/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionOptions.cpp b/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionOptions.cpp
index c86b1683cb63b5019f479e7b0bd5b4fe82f92206..2bfc0c94c6d7f0ba7b9aed01242a9cf028253560 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionOptions.cpp
+++ b/third_party/WebKit/Source/modules/push_messaging/PushSubscriptionOptions.cpp
@@ -10,6 +10,7 @@
 #include "modules/push_messaging/PushSubscriptionOptionsInit.h"
 #include "public/platform/WebString.h"
 #include "public/platform/modules/push_messaging/WebPushSubscriptionOptions.h"
+#include "third_party/WebKit/Source/wtf/ASCIICType.h"
 #include "wtf/Assertions.h"
 #include "wtf/text/WTFString.h"
 
@@ -21,10 +22,9 @@ const int kMaxApplicationServerKeyLength = 255;
 String bufferSourceToString(
     const ArrayBufferOrArrayBufferView& applicationServerKey,
     ExceptionState& exceptionState) {
-  // Check the validity of the sender info. It must be a 65-byte uncompressed
-  // key, which has the byte 0x04 as the first byte as a marker.
   unsigned char* input;
   int length;
+  // Convert the input array into a string of bytes.
   if (applicationServerKey.isArrayBuffer()) {
     input = static_cast<unsigned char*>(
         applicationServerKey.getAsArrayBuffer()->data());
@@ -39,9 +39,16 @@ String bufferSourceToString(
     return String();
   }
 
-  // If the key is valid, just treat it as a string of bytes and pass it to
-  // the push service.
-  if (length <= kMaxApplicationServerKeyLength)
+  // Check the validity of the sender info. It must either be a 65-byte
+  // uncompressed VAPID key, which has the byte 0x04 as the first byte or a
+  // numeric sender ID.
+  const bool isVapid = length == 65 && input && *input == 0x04;

[Peter Beverloo, 2016/10/14 14:36:30]

Is checking for |input| required? When would length == 65 and we have a NULL
|input|?

(It seems to me like crashing is a good thing if we ever mess this up :-). Your
test coverage ensures we do.)

[harkness, 2016/10/14 15:13:47]

Done.

+  const bool isSenderId =
+      (length > 0) && (length < kMaxApplicationServerKeyLength) &&

[Peter Beverloo, 2016/10/14 14:36:30]

No parenthesis around the two comparisons on this line.

[harkness, 2016/10/14 15:13:47]

Done.

+      (std::find_if_not(input, input + length,
+                        &WTF::isASCIIDigit<unsigned char>) == input + length);
+
+  if (isVapid || isSenderId)
     return WebString::fromLatin1(input, length);
 
   exceptionState.throwDOMException(