Do not parse JSON in the browser.

components/payments/payment_request.mojom

Index: components/payments/payment_request.mojom
diff --git a/components/payments/payment_request.mojom b/components/payments/payment_request.mojom
index 5820909d98b46c5c7153410b8d685e226a1314fc..1e8bc5c307052972c4038ca2fff5a4ff4e6e2323 100644
--- a/components/payments/payment_request.mojom
+++ b/components/payments/payment_request.mojom
@@ -127,18 +127,51 @@ struct PaymentOptions {
   PaymentShippingType shipping_type;
 };
 
+enum AndroidPayEnvironment {
+  PRODUCTION,
+  TEST
+};
+
+enum AndroidPayCardNetwork {
+  AMEX,
+  DISCOVER,
+  MASTERCARD,
+  VISA
+};
+
+enum AndroidPayTokenization {
+  UNSPECIFIED,
+  GATEWAY_TOKEN,
+  NETWORK_TOKEN
+};
+
+struct AndroidPayTokenizationParameter {
+  string? key;
+  string? value;
+};
+
 struct PaymentMethodData {
   array<string> supported_methods;
+
   // A JSON string built by the renderer from a JavaScript object that the
   // merchant website provides. The renderer uses
-  // blink::JSONObject::toJSONString() to generate this string. The browser
-  // parses the string via JSONObject(JsonSanitizer.sanitize(stringified_data))
-  // and passes a part of the JSON object to the payment app, for example
-  // Android Pay. There's no one format for this object, so richer types cannot
-  // be used. A simple example:
+  // blink::JSONObject::toJSONString() to generate this string. The browser does
+  // not parse the string and passes it as-is directly to payment apps. There's
+  // no one format for this object, so richer types cannot be used. A simple
+  // example:
   //
   // {"gateway": "stripe"}
   string stringified_data;
+
+  // Android Pay specific method data is parsed in the renderer.
+  // https://developers.google.com/web/fundamentals/getting-started/primers/payment-request/android-pay
+  // TODO(rouslan): Stop parsing Android Pay data. http://crbug.com/620173
+  AndroidPayEnvironment environment;
+  string? merchant_name;
+  string? merchant_id;
+  array<AndroidPayCardNetwork> allowed_card_networks;
+  AndroidPayTokenization tokenization_type;
+  array<AndroidPayTokenizationParameter> parameters;
 };
 
 enum PaymentComplete {