Do not parse JSON in the browser.

Do not parse JSON in the browser.

Chrome is tightly integrated into Android Pay until it supports loose
integration into Android payment apps per http://crbug.com/620173. This
means that Chrome needs to parse JSON objects from the website and pass
them into Android Pay SDK. This parsing should happen in the renderer to
be safe.

BUG=665169
Committed: https://crrev.com/571cfaafb1f82776520c02ae43d480343adb3bb8
Cr-Commit-Position: refs/heads/master@{#432725}

[please use gerrit instead, 2016-11-14 22:06:17]

The CQ bit was checked by rouslan@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-11-14 22:08:02]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[please use gerrit instead, 2016-11-14 22:20:36]

rouslan@chromium.org changed reviewers:
+ tsepez@chromium.org

[please use gerrit instead, 2016-11-14 22:20:37]

Tom, ptal. You've requested that we don't parse JSON in browser in here:
http://crrev.com/2470463002

[Tom Sepez, 2016-11-14 22:54:57]

LGTM

[please use gerrit instead, 2016-11-14 22:57:33]

rouslan@chromium.org changed reviewers:
+ mek@chromium.org

[please use gerrit instead, 2016-11-14 22:57:33]

Marijn, ptal WebKit.

[commit-bot: I haz the power, 2016-11-14 23:45:00]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-11-14 23:45:01]

Dry run: This issue passed the CQ dry run.

[please use gerrit instead, 2016-11-15 15:47:16]

rouslan@chromium.org changed reviewers:
+ thakis@chromium.org

[please use gerrit instead, 2016-11-15 15:47:16]

Nico, owners ptal third_party/WebKit/Source/modules/modules_idl_files.gni

[Nico, 2016-11-15 15:53:59]

gni lgtm

[Marijn Kruisselbrink, 2016-11-16 19:09:14]

sorry for the delay

https://codereview.chromium.org/2500183002/diff/1/third_party/WebKit/Source/m...
File third_party/WebKit/Source/modules/payments/PaymentRequest.cpp (right):

https://codereview.chromium.org/2500183002/diff/1/third_party/WebKit/Source/m...
third_party/WebKit/Source/modules/payments/PaymentRequest.cpp:398: const
ScriptValue& parameters = tokenization.parameters();
I mentioned that record<DOMString, DOMString> or something like that is probably
the correct type for this "parameters" thing in webidl, rather than object as it
is now. But as you pointed out record isn't supported yet by our bindings.

But thinking about this a bit more, our bindings do support a non-standard
"Dictionary" type (which is currently used by Headers, a class in fetch) which
is very similar (and one of the reasons webidl now has a record type). So I
think you could make this code a bit simpler by using Dictionary in your idl.
This whole loop then would just be something like:

Vector<String> keys;
parameters.getPropertyNames(keys);
out->parameters.resize(keys.size());
for (size_t i = 0; i < keys.size(); ++i) {
  String value;
  if (!DictionaryHelper::get(parameters, keys[i], value))
    continue;
  out->parameters[i]->key = keys[i];
  out->parameters[i]->value = value;
}

(btw, is it intentional that invalid values leave gaps in output->parameters?)

[please use gerrit instead, 2016-11-16 20:09:24]

The CQ bit was checked by rouslan@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-11-16 20:10:03]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[please use gerrit instead, 2016-11-16 20:23:23]

Marijn, ptal patch 2.

https://codereview.chromium.org/2500183002/diff/1/third_party/WebKit/Source/m...
File third_party/WebKit/Source/modules/payments/PaymentRequest.cpp (right):

https://codereview.chromium.org/2500183002/diff/1/third_party/WebKit/Source/m...
third_party/WebKit/Source/modules/payments/PaymentRequest.cpp:398: const
ScriptValue& parameters = tokenization.parameters();
Thank you. Dictionary was exactly what I needed.

I was leaving gaps in the list intentionally. However, upon further reflection,
I found a cleaner way to avoid the gaps.

[Marijn Kruisselbrink, 2016-11-16 20:25:11]

lgtm

[please use gerrit instead, 2016-11-16 20:25:54]

The CQ bit was unchecked by rouslan@chromium.org

[please use gerrit instead, 2016-11-16 20:26:01]

The CQ bit was checked by rouslan@chromium.org

[please use gerrit instead, 2016-11-16 20:26:02]

The patchset sent to the CQ was uploaded after l-g-t-m from tsepez@chromium.org,
thakis@chromium.org
Link to the patchset: https://codereview.chromium.org/2500183002/#ps20001
(title: "Use a Dictionary type in IDL")

[commit-bot: I haz the power, 2016-11-16 20:26:32]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[please use gerrit instead, 2016-11-16 21:45:04]

The CQ bit was unchecked by rouslan@chromium.org

[please use gerrit instead, 2016-11-16 22:39:55]

The CQ bit was checked by rouslan@chromium.org

[commit-bot: I haz the power, 2016-11-16 22:40:30]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-11-17 03:36:48]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-11-17 03:39:15]

Description was changed from

==========
Do not parse JSON in the browser.

Chrome is tightly integrated into Android Pay until it supports loose
integration into Android payment apps per http://crbug.com/620173. This
means that Chrome needs to parse JSON objects from the website and pass
them into Android Pay SDK. This parsing should happen in the renderer to
be safe.

BUG=665169
==========

to

==========
Do not parse JSON in the browser.

Chrome is tightly integrated into Android Pay until it supports loose
integration into Android payment apps per http://crbug.com/620173. This
means that Chrome needs to parse JSON objects from the website and pass
them into Android Pay SDK. This parsing should happen in the renderer to
be safe.

BUG=665169

Committed: https://crrev.com/571cfaafb1f82776520c02ae43d480343adb3bb8
Cr-Commit-Position: refs/heads/master@{#432725}
==========

[commit-bot: I haz the power, 2016-11-17 03:39:17]

Patchset 2 (id:??) landed as
https://crrev.com/571cfaafb1f82776520c02ae43d480343adb3bb8
Cr-Commit-Position: refs/heads/master@{#432725}