Improve print preview checks in the PDF plugin

pdf/out_of_process_instance.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/out_of_process_instance.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>  // for min/max()
@@ skipping 275 matching lines @@
       font_substitution_reported_(false),
 #endif
       print_preview_page_count_(0),
       last_progress_sent_(0),
       recently_sent_find_update_(false),
       received_viewport_message_(false),
       did_call_start_loading_(false),
       stop_scrolling_(false),
       background_color_(0),
       top_toolbar_height_(0),
-      accessibility_state_(ACCESSIBILITY_STATE_OFF) {
+      accessibility_state_(ACCESSIBILITY_STATE_OFF),
+      is_print_preview_(false) {
   loader_factory_.Initialize(this);
   timer_factory_.Initialize(this);
   form_factory_.Initialize(this);
   print_callback_factory_.Initialize(this);
   engine_.reset(PDFEngine::Create(this));
   pp::Module::Get()->AddPluginInterface(kPPPPdfInterface, &ppp_private);
   AddPerInstanceObject(kPPPPdfInterface, this);
 
   RequestFilteringInputEvents(PP_INPUTEVENT_CLASS_MOUSE);
   RequestFilteringInputEvents(PP_INPUTEVENT_CLASS_KEYBOARD);
@@ skipping 11 matching lines @@
                                 const char* argn[],
                                 const char* argv[]) {
   // Check if the PDF is being loaded in the PDF chrome extension. We only allow
   // the plugin to be loaded in the extension and print preview to avoid
   // exposing sensitive APIs directly to external websites.
   pp::Var document_url_var = pp::URLUtil_Dev::Get()->GetDocumentURL(this);
   if (!document_url_var.is_string())
     return false;
   std::string document_url = document_url_var.AsString();
   base::StringPiece document_url_piece(document_url);
+  is_print_preview_ = document_url_piece.starts_with(kChromePrint);
   if (!document_url_piece.starts_with(kChromeExtension) &&
-      !document_url_piece.starts_with(kChromePrint)) {
+      !is_print_preview_) {
     return false;
   }
 
   // Check if the plugin is full frame. This is passed in from JS.
   for (uint32_t i = 0; i < argc; ++i) {
     if (strcmp(argn[i], "full-frame") == 0) {
       full_ = true;
       break;
     }
   }
@@ skipping 30 matching lines @@
   if (!original_url)
     return false;
 
   if (!stream_url)
     stream_url = original_url;
 
   // If we're in print preview mode we don't need to load the document yet.
   // A |kJSResetPrintPreviewModeType| message will be sent to the plugin letting
   // it know the url to load. By not loading here we avoid loading the same
   // document twice.
-  if (IsPrintPreviewUrl(original_url))
+  if (IsPrintPreview())
     return true;
 
   LoadUrl(stream_url);
   url_ = original_url;
   pp::PDF::SetCrashData(GetPluginInstance(), original_url, top_level_url);
   return engine_->New(original_url, headers);
 }
 
 void OutOfProcessInstance::HandleMessage(const pp::Var& message) {
   pp::VarDictionary dict(message);
@@ skipping 38 matching lines @@
     RotateClockwise();
   } else if (type == kJSRotateCounterclockwiseType) {
     RotateCounterclockwise();
   } else if (type == kJSSelectAllType) {
     engine_->SelectAll();
   } else if (type == kJSResetPrintPreviewModeType &&
              dict.Get(pp::Var(kJSPrintPreviewUrl)).is_string() &&
              dict.Get(pp::Var(kJSPrintPreviewGrayscale)).is_bool() &&
              dict.Get(pp::Var(kJSPrintPreviewPageCount)).is_int()) {
     url_ = dict.Get(pp::Var(kJSPrintPreviewUrl)).AsString();
+    // For security reasons we crash if the URL that is trying to be loaded here
+    // isn't a print preview one.
+    CHECK(IsPrintPreview() && IsPrintPreviewUrl(url_));
     preview_pages_info_ = std::queue<PreviewPageInfo>();
     preview_document_load_state_ = LOAD_STATE_COMPLETE;
     document_load_state_ = LOAD_STATE_LOADING;
     LoadUrl(url_);
     preview_engine_.reset();
     engine_.reset(PDFEngine::Create(this));
     engine_->SetGrayscale(dict.Get(pp::Var(kJSPrintPreviewGrayscale)).AsBool());
     engine_->New(url_.c_str(), nullptr /* empty header */);
 
     print_preview_page_count_ =
         std::max(dict.Get(pp::Var(kJSPrintPreviewPageCount)).AsInt(), 0);
 
     paint_manager_.InvalidateRect(pp::Rect(pp::Point(), plugin_size_));
   } else if (type == kJSLoadPreviewPageType &&
              dict.Get(pp::Var(kJSPreviewPageUrl)).is_string() &&
              dict.Get(pp::Var(kJSPreviewPageIndex)).is_int()) {
-    ProcessPreviewPageInfo(dict.Get(pp::Var(kJSPreviewPageUrl)).AsString(),
+    // For security reasons we crash if the URL that is trying to be loaded here
+    // isn't a print preview one.
+    std::string url = dict.Get(pp::Var(kJSPreviewPageUrl)).AsString();
+    CHECK(IsPrintPreview() && IsPrintPreviewUrl(url));

[Lei Zhang, 2016/11/08 07:38:13]

Put these as 2 separate CHECKs. Then if one fails, we'll know which. Ditto above
on line 443.

[raymes, 2016/11/08 23:18:01]

Done.

+    ProcessPreviewPageInfo(url,
                            dict.Get(pp::Var(kJSPreviewPageIndex)).AsInt());
   } else if (type == kJSStopScrollingType) {
     stop_scrolling_ = true;
   } else if (type == kJSGetSelectedTextType) {
     std::string selected_text = engine_->GetSelectedText();
     // Always return unix newlines to JS.
     base::ReplaceChars(selected_text, "\r", std::string(), &selected_text);
     pp::VarDictionary reply;
     reply.Set(pp::Var(kType), pp::Var(kJSGetSelectedTextReplyType));
     reply.Set(pp::Var(kJSSelectedText), selected_text);
@@ skipping 1012 matching lines @@
 
 void OutOfProcessInstance::AppendBlankPrintPreviewPages() {
   if (print_preview_page_count_ == 0)
     return;
   engine_->AppendBlankPages(print_preview_page_count_);
   if (!preview_pages_info_.empty())
     LoadAvailablePreviewPage();
 }
 
 bool OutOfProcessInstance::IsPrintPreview() {
-  return IsPrintPreviewUrl(url_);
+  return is_print_preview_;
 }
 
 uint32_t OutOfProcessInstance::GetBackgroundColor() {
   return background_color_;
 }
 
 void OutOfProcessInstance::CancelBrowserDownload() {
   pp::VarDictionary message;
   message.Set(kType, kJSCancelStreamUrlType);
   PostMessage(message);
 }
 
 void OutOfProcessInstance::IsSelectingChanged(bool is_selecting) {
   pp::VarDictionary message;
   message.Set(kType, kJSSetIsSelectingType);
   message.Set(kJSIsSelecting, pp::Var(is_selecting));
   PostMessage(message);
 }
 
 void OutOfProcessInstance::ProcessPreviewPageInfo(const std::string& url,
                                                   int dst_page_index) {
-  if (!IsPrintPreview())
-    return;
+  DCHECK(IsPrintPreview());
 
   int src_page_index = ExtractPrintPreviewPageIndex(url);
   if (src_page_index < 1)
     return;
 
   preview_pages_info_.push(std::make_pair(url, dst_page_index));
   LoadAvailablePreviewPage();
 }
 
 void OutOfProcessInstance::LoadAvailablePreviewPage() {
@@ skipping 25 matching lines @@
     const pp::FloatPoint& scroll_offset) {
   float max_x = document_size_.width() * zoom_ - plugin_dip_size_.width();
   float x = std::max(std::min(scroll_offset.x(), max_x), 0.0f);
   float min_y = -top_toolbar_height_;
   float max_y = document_size_.height() * zoom_ - plugin_dip_size_.height();
   float y = std::max(std::min(scroll_offset.y(), max_y), min_y);
   return pp::FloatPoint(x, y);
 }
 
 }  // namespace chrome_pdf