Prevent drag-and-drop events from firing over cross-site, same-page frames. (Mac)

content/browser/web_contents/web_drag_dest_mac.h

Index: content/browser/web_contents/web_drag_dest_mac.h
diff --git a/content/browser/web_contents/web_drag_dest_mac.h b/content/browser/web_contents/web_drag_dest_mac.h
index cab64ff4d55cd5187c015a0ac1fa6a853c68b687..9cabfb7f5246d92ea9147f03b10bd58bde034133 100644
--- a/content/browser/web_contents/web_drag_dest_mac.h
+++ b/content/browser/web_contents/web_drag_dest_mac.h
@@ -7,6 +7,7 @@
 #include <memory>
 
 #include "base/strings/string16.h"
+#include "content/browser/loader/global_routing_id.h"
 #include "content/common/content_export.h"
 #include "content/public/common/drop_data.h"
 #include "ui/gfx/geometry/point.h"
@@ -44,6 +45,14 @@ CONTENT_EXPORT
   // during a drag, we need to re-send the DragEnter message.
   RenderViewHostIdentifier currentRVH_;
 
+  // Tracks the IDs of the source RenderProcessHost and RenderViewHost from
+  // which the current drag originated. These are set in setDragStartTrackers(),

[Avi (use Gerrit), 2016/12/15 19:40:08]

"....These are set in -setDragStartTrackersForProcess:, and are used..."

[paulmeyer, 2016/12/15 20:02:51]

Done.

+  // and are used to ensure that drag events do not fire over a cross-site frame
+  // (with respect to the source frame) in the same page (see crbug.com/666858).
+  // See WebContentsViewAura::drag_start_process_id_ for additional information.
+  int dragStartProcessID_;
+  content::GlobalRoutingID dragStartViewID_;
+
   // The data for the current drag, or NULL if none is in progress.
   std::unique_ptr<content::DropData> dropData_;
 
@@ -79,6 +88,14 @@ CONTENT_EXPORT
 GetRenderWidgetHostAtPoint:(const NSPoint&)viewPoint
              transformedPt:(gfx::Point*)transformedPt;
 
+// Sets |dragStartProcessID_| and |dragStartViewID_|.
+- (void)setDragStartTrackers:(int)processID;

[Avi (use Gerrit), 2016/12/15 19:40:08]

setDragStartTrackersForProcess:(int)processID

[paulmeyer, 2016/12/15 20:02:51]

Done.

+
+// Returns whether |targetRWH| is a valid RenderWidgetHost to be dragging
+// over. This enforces that same-page, cross-site drags are not allowed. See
+// crbug.com/666858.
+- (bool)isValidDragTarget:(content::RenderWidgetHostImpl*)targetRWH;
+
 @end
 
 // Public use only for unit tests.