Validate input from devtools channel to ensure that position is valid.

content/browser/devtools/protocol/input_handler.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/devtools/protocol/input_handler.h"
 
 #include <stddef.h>
 
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 457 matching lines @@
   if (!host_ || !host_->GetRenderWidgetHost()) {
     callback->sendFailure(Response::InternalError());
     return;
   }
 
   SyntheticPinchGestureParams gesture_params;
   const int kDefaultRelativeSpeed = 800;
 
   gesture_params.scale_factor = scale_factor;
   gesture_params.anchor = CssPixelsToPointF(x, y, page_scale_factor_);
+  if (!PointIsWithinContents(gesture_params.anchor)) {
+    callback->sendFailure(Response::InvalidParams("Position out of bounds"));
+    return;
+  }
+
   gesture_params.relative_pointer_speed_in_pixels_s =
       relative_speed.fromMaybe(kDefaultRelativeSpeed);
 
   if (!StringToGestureSourceType(
       std::move(gesture_source_type),
       gesture_params.gesture_source_type)) {
     callback->sendFailure(
         Response::InvalidParams("Unknown gestureSourceType"));
     return;
   }
@@ skipping 21 matching lines @@
   if (!host_ || !host_->GetRenderWidgetHost()) {
     callback->sendFailure(Response::InternalError());
     return;
   }
 
   SyntheticSmoothScrollGestureParams gesture_params;
   const bool kDefaultPreventFling = true;
   const int kDefaultSpeed = 800;
 
   gesture_params.anchor = CssPixelsToPointF(x, y, page_scale_factor_);
+  if (!PointIsWithinContents(gesture_params.anchor)) {
+    callback->sendFailure(Response::InvalidParams("Position out of bounds"));
+    return;
+  }
+
   gesture_params.prevent_fling =
       prevent_fling.fromMaybe(kDefaultPreventFling);
   gesture_params.speed_in_pixels_s = speed.fromMaybe(kDefaultSpeed);
 
-  if (x_distance.fromJust() || y_distance.fromJust()) {
+  if (x_distance.isJust() || y_distance.isJust()) {
     gesture_params.distances.push_back(
         CssPixelsToVector2dF(x_distance.fromMaybe(0),
                              y_distance.fromMaybe(0), page_scale_factor_));
   }
 
   if (x_overscroll.isJust() || y_overscroll.isJust()) {
     gesture_params.distances.push_back(CssPixelsToVector2dF(
         -x_overscroll.fromMaybe(0), -y_overscroll.fromMaybe(0),
         page_scale_factor_));
   }
@@ skipping 69 matching lines @@
   if (!host_ || !host_->GetRenderWidgetHost()) {
     callback->sendFailure(Response::InternalError());
     return;
   }
 
   SyntheticTapGestureParams gesture_params;
   const int kDefaultDuration = 50;
   const int kDefaultTapCount = 1;
 
   gesture_params.position = CssPixelsToPointF(x, y, page_scale_factor_);
+  if (!PointIsWithinContents(gesture_params.position)) {
+    callback->sendFailure(Response::InvalidParams("Position out of bounds"));
+    return;
+  }
+
   gesture_params.duration_ms = duration.fromMaybe(kDefaultDuration);
 
   if (!StringToGestureSourceType(
       std::move(gesture_source_type),
       gesture_params.gesture_source_type)) {
     callback->sendFailure(
         Response::InvalidParams("Unknown gestureSourceType"));
     return;
   }
 
@@ skipping 15 matching lines @@
 
 void InputHandler::ClearPendingKeyAndMouseCallbacks() {
   for (auto& callback : pending_key_callbacks_)
     callback->sendSuccess();
   pending_key_callbacks_.clear();
   for (auto& callback : pending_mouse_callbacks_)
     callback->sendSuccess();
   pending_mouse_callbacks_.clear();
 }
 
+bool InputHandler::PointIsWithinContents(gfx::PointF point) const {
+  gfx::Rect bounds = host_->GetView()->GetViewBounds();
+  bounds -= bounds.OffsetFromOrigin();  // Translate the bounds to (0,0).
+  return bounds.Contains(point.x(), point.y());
+}
+
 }  // namespace protocol
 }  // namespace content