[WebPayments] Desktop: Adding validation and binding checks

chrome/browser/payments/payment_request_impl.cc

Index: chrome/browser/payments/payment_request_impl.cc
diff --git a/chrome/browser/payments/payment_request_impl.cc b/chrome/browser/payments/payment_request_impl.cc
index 18ce94c9943265223a28fe8fa233fa974c7a5863..743ab19e26bf7dad196d9ced28889fdbc322523d 100644
--- a/chrome/browser/payments/payment_request_impl.cc
+++ b/chrome/browser/payments/payment_request_impl.cc
@@ -62,6 +62,9 @@ void PaymentRequestImpl::Init(
     payments::mojom::PaymentOptionsPtr options) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   client_ = std::move(client);
+}
+
+void PaymentRequestImpl::Show() {

[tmartino, 2016/12/12 19:35:30]

It seems like this needs to have a check to ensure it was Init'd first, yeah? Do
we have a policy on what should happen in this case? DCHECK? CHECK? Return with
no-op? Call OnError?

[please use gerrit instead, 2016/12/12 20:46:48]

------------------------------
Init():

Validate |details| using:

https://cs.chromium.org/chromium/src/components/payments/payment_details_vali...

If the |details| are invalid, make sure that |client->OnError(USER_CANCEL)| is
called and both pipes to the renderer are disconnected. The two pipes are
|binding_| and |client_|.

The renderer should not be sending invalid data, so this means the renderer has
been compromised.

------------------------------
Show():

If you don't have an open pipe to the renderer, return. There's nothing you can
do. (Don't show UI.)
------------------------------

[Mathieu, 2017/01/05 15:53:54]

Note that while some of this code has landed in another CL, Rouslan's comments
are still worth implementing.

   chrome::ShowPaymentRequestDialog(this);
 }