Validate incoming window properties.

ui/aura/mus/property_converter.cc

Index: ui/aura/mus/property_converter.cc
diff --git a/ui/aura/mus/property_converter.cc b/ui/aura/mus/property_converter.cc
index 9787d57626460a43747f8f46791b4375c6aa97c7..e3801ca6bc96d9302cff6d04abcaac9545347790 100644
--- a/ui/aura/mus/property_converter.cc
+++ b/ui/aura/mus/property_converter.cc
@@ -27,27 +27,63 @@ std::unique_ptr<std::vector<uint8_t>> GetArray(Window* window,
       mojo::ConvertTo<std::vector<uint8_t>>(*value));
 }
 
+// A validator that always returns true regardless of its input.
+bool AlwaysTrue(int32_t value) {
+  return true;
+}
+
+bool ValidateResizeBehavior(int32_t value) {
+  // Resize behaviour is a 3 bitfield.
+  return value >= 0 && value <= 7;
+}
+
+bool ValidateShowState(int32_t value) {
+  return value == int32_t(ui::mojom::ShowState::DEFAULT) ||
+         value == int32_t(ui::mojom::ShowState::NORMAL) ||
+         value == int32_t(ui::mojom::ShowState::MINIMIZED) ||
+         value == int32_t(ui::mojom::ShowState::MAXIMIZED) ||
+         value == int32_t(ui::mojom::ShowState::INACTIVE) ||
+         value == int32_t(ui::mojom::ShowState::FULLSCREEN) ||
+         value == int32_t(ui::mojom::ShowState::DOCKED);
+}
+
 }  // namespace
 
+PropertyConverter::PrimitiveProperty::PrimitiveProperty() {}
+
+PropertyConverter::PrimitiveProperty::PrimitiveProperty(
+    const PrimitiveProperty& property) = default;
+
+PropertyConverter::PrimitiveProperty::~PrimitiveProperty() {}
+
+// static
+base::RepeatingCallback<bool(int32_t)> PropertyConverter::AcceptAnyValue() {
+  return base::Bind(&AlwaysTrue);
+}
+
 PropertyConverter::PropertyConverter() {
   // Add known aura properties with associated mus properties.
   RegisterProperty(client::kAlwaysOnTopKey,
-                   ui::mojom::WindowManager::kAlwaysOnTop_Property);
+                   ui::mojom::WindowManager::kAlwaysOnTop_Property,
+                   AcceptAnyValue());
   RegisterProperty(client::kAppIconKey,
                    ui::mojom::WindowManager::kAppIcon_Property);
   RegisterProperty(client::kAppIdKey,
                    ui::mojom::WindowManager::kAppID_Property);
   RegisterProperty(client::kImmersiveFullscreenKey,
-                   ui::mojom::WindowManager::kImmersiveFullscreen_Property);
+                   ui::mojom::WindowManager::kImmersiveFullscreen_Property,
+                   AcceptAnyValue());
   RegisterProperty(client::kNameKey, ui::mojom::WindowManager::kName_Property);
   RegisterProperty(client::kPreferredSize,
                    ui::mojom::WindowManager::kPreferredSize_Property);
   RegisterProperty(client::kResizeBehaviorKey,
-                   ui::mojom::WindowManager::kResizeBehavior_Property);
+                   ui::mojom::WindowManager::kResizeBehavior_Property,
+                   base::Bind(&ValidateResizeBehavior));
   RegisterProperty(client::kRestoreBoundsKey,
                    ui::mojom::WindowManager::kRestoreBounds_Property);
   RegisterProperty(client::kShowStateKey,
-                   ui::mojom::WindowManager::kShowState_Property);
+                   ui::mojom::WindowManager::kShowState_Property,
+                   base::Bind(&ValidateShowState));
   RegisterProperty(client::kWindowIconKey,
                    ui::mojom::WindowManager::kWindowIcon_Property);
   RegisterProperty(client::kTitleKey,
@@ -157,6 +193,9 @@ void PropertyConverter::SetPropertyFromTransportValue(
                  << transport_name;
         return;
       }
+      const int32_t v = *reinterpret_cast<const int32_t*>(&data->front());
+      if (!primitive_property.second.validator.Run(v))
+        return;
       const PrimitiveType value = mojo::ConvertTo<PrimitiveType>(*data);
       // TODO(msw): Should aura::Window just store all properties by name?
       window->SetPropertyInternal(
@@ -233,6 +272,10 @@ bool PropertyConverter::GetPropertyValueFromTransportValue(
   }
   for (const auto& primitive_property : primitive_properties_) {
     if (primitive_property.second.transport_name == transport_name) {
+      const int32_t v =
+          *reinterpret_cast<const int32_t*>(&transport_data.front());
+      if (!primitive_property.second.validator.Run(v))
+        return false;
       *value = mojo::ConvertTo<PrimitiveType>(transport_data);
       return true;
     }