Index: content/browser/devtools/protocol/input_handler.cc |
diff --git a/content/browser/devtools/protocol/input_handler.cc b/content/browser/devtools/protocol/input_handler.cc |
index cadff830717077c5d4a4ca6d0716f6fec6032d4e..967dd2cd21e0a91ca65631cfd8d26ecea4d3a5ba 100644 |
--- a/content/browser/devtools/protocol/input_handler.cc |
+++ b/content/browser/devtools/protocol/input_handler.cc |
@@ -475,6 +475,11 @@ void InputHandler::SynthesizePinchGesture( |
gesture_params.scale_factor = scale_factor; |
gesture_params.anchor = CssPixelsToPointF(x, y, page_scale_factor_); |
+ if (!PointIsWithinContents(gesture_params.anchor)) { |
+ callback->sendFailure(Response::InvalidParams("Position out of bounds")); |
+ return; |
+ } |
+ |
gesture_params.relative_pointer_speed_in_pixels_s = |
relative_speed.fromMaybe(kDefaultRelativeSpeed); |
@@ -516,11 +521,16 @@ void InputHandler::SynthesizeScrollGesture( |
const int kDefaultSpeed = 800; |
gesture_params.anchor = CssPixelsToPointF(x, y, page_scale_factor_); |
+ if (!PointIsWithinContents(gesture_params.anchor)) { |
+ callback->sendFailure(Response::InvalidParams("Position out of bounds")); |
+ return; |
+ } |
+ |
gesture_params.prevent_fling = |
prevent_fling.fromMaybe(kDefaultPreventFling); |
gesture_params.speed_in_pixels_s = speed.fromMaybe(kDefaultSpeed); |
- if (x_distance.fromJust() || y_distance.fromJust()) { |
+ if (x_distance.isJust() || y_distance.isJust()) { |
gesture_params.distances.push_back( |
CssPixelsToVector2dF(x_distance.fromMaybe(0), |
y_distance.fromMaybe(0), page_scale_factor_)); |
@@ -610,6 +620,11 @@ void InputHandler::SynthesizeTapGesture( |
const int kDefaultTapCount = 1; |
gesture_params.position = CssPixelsToPointF(x, y, page_scale_factor_); |
+ if (!PointIsWithinContents(gesture_params.position)) { |
+ callback->sendFailure(Response::InvalidParams("Position out of bounds")); |
+ return; |
+ } |
+ |
gesture_params.duration_ms = duration.fromMaybe(kDefaultDuration); |
if (!StringToGestureSourceType( |
@@ -645,5 +660,11 @@ void InputHandler::ClearPendingKeyAndMouseCallbacks() { |
pending_mouse_callbacks_.clear(); |
} |
+bool InputHandler::PointIsWithinContents(gfx::PointF point) const { |
+ gfx::Rect bounds = host_->GetView()->GetViewBounds(); |
+ bounds -= bounds.OffsetFromOrigin(); // Translate the bounds to (0,0). |
+ return bounds.Contains(point.x(), point.y()); |
+} |
+ |
} // namespace protocol |
} // namespace content |