Add a configurable parse-depth limit when parsing JFV headers, and use it for Feature-Policy Header

third_party/WebKit/Source/platform/feature_policy/FeaturePolicy.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "platform/feature_policy/FeaturePolicy.h"
 
 #include "platform/json/JSONValues.h"
 #include "platform/network/HTTPParsers.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityOrigin.h"
@@ skipping 180 matching lines @@
 std::unique_ptr<FeaturePolicy> FeaturePolicy::createFromParentPolicy(
     const FeaturePolicy* parent,
     RefPtr<SecurityOrigin> currentOrigin) {
   return createFromParentPolicy(parent, std::move(currentOrigin),
                                 getDefaultFeatureList());
 }
 
 void FeaturePolicy::setHeaderPolicy(const String& policy,
                                     Vector<String>* messages) {
   DCHECK(m_headerWhitelists.isEmpty());
-  std::unique_ptr<JSONArray> policyJSON = parseJSONHeader(policy);
+  // Use a reasonable parse depth limit; the actual maximum depth is only going
+  // to be 4 for a valid policy, but we'll give the featurePolicyParser a chance
+  // to report more specific errors, unless the string is really invalid.
+  std::unique_ptr<JSONArray> policyJSON = parseJSONHeader(policy, 50);
   if (!policyJSON) {
     if (messages)
       messages->append("Unable to parse header");
     return;
   }
   m_headerWhitelists = parseFeaturePolicyFromJson(
       std::move(policyJSON), m_origin, m_features, messages);
 }
 
 bool FeaturePolicy::isFeatureEnabledForOrigin(
@@ skipping 43 matching lines @@
     sb.append("  ");
     sb.append(whitelist.key->featureName);
     sb.append(": ");
     sb.append(whitelist.value->toString());
     sb.append("\n");
   }
   return sb.toString();
 }
 
 }  // namespace blink