[Payments] Implement openWindow for service worker based payment handler

chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.chrome.browser.payments;
 
 import android.app.Activity;
 import android.content.Context;
 import android.content.Intent;
 import android.graphics.Bitmap;
@@ skipping 239 matching lines @@
     private final TabModelObserver mTabModelObserver = new EmptyTabModelObserver() {
         @Override
         public void didSelectTab(Tab tab, TabSelectionType type, int lastId) {
             if (tab == null || tab.getId() != lastId) onDismiss();
         }
     };
 
     private final Handler mHandler = new Handler();
     private final RenderFrameHost mRenderFrameHost;
     private final WebContents mWebContents;
+    private final String mTopLevelUrl;
     private final String mTopLevelOrigin;
-    private final String mPaymentRequestOrigin;
+    private final String mPaymentRequestUrl;
     private final String mMerchantName;
     @Nullable
     private final byte[][] mCertificateChain;
     private final AddressEditor mAddressEditor;
     private final CardEditor mCardEditor;
     private final JourneyLogger mJourneyLogger;
     private final boolean mIsIncognito;
 
     private PaymentRequestClient mClient;
     private boolean mIsCurrentPaymentRequestShowing;
@@ skipping 86 matching lines @@
      * Builds the PaymentRequest service implementation.
      *
      * @param renderFrameHost The host of the frame that has invoked the PaymentRequest API.
      */
     public PaymentRequestImpl(RenderFrameHost renderFrameHost) {
         assert renderFrameHost != null;
 
         mRenderFrameHost = renderFrameHost;
         mWebContents = WebContentsStatics.fromRenderFrameHost(renderFrameHost);
 
-        mPaymentRequestOrigin = UrlFormatter.formatUrlForSecurityDisplay(
-                mRenderFrameHost.getLastCommittedURL(), true);
-        mTopLevelOrigin =
-                UrlFormatter.formatUrlForSecurityDisplay(mWebContents.getLastCommittedUrl(), true);
+        mPaymentRequestUrl = mRenderFrameHost.getLastCommittedURL();
+        mTopLevelUrl = mWebContents.getLastCommittedUrl();
+        mTopLevelOrigin = UrlFormatter.formatUrlForSecurityDisplay(mTopLevelUrl, true);
 
         mMerchantName = mWebContents.getTitle();
 
         mCertificateChain = CertificateChainHelper.getCertificateChain(mWebContents);
 
         mApps = new ArrayList<>();
 
         mAddressEditor = new AddressEditor();
         mCardEditor = new CardEditor(mWebContents, mAddressEditor, sObserverForTest);
 
@@ skipping 324 matching lines @@
             if (appMethods == null || !app.supportsMethodsAndData(appMethods)) {
                 mPendingApps.remove(app);
             } else {
                 mArePaymentMethodsSupported = true;
                 mMerchantSupportsAutofillPaymentInstruments |= app instanceof AutofillPaymentApp;
                 queryApps.put(app, appMethods);
             }
         }
 
         if (queryApps.isEmpty()) {
-            CanMakePaymentQuery query = sCanMakePaymentQueries.get(mPaymentRequestOrigin);
+            CanMakePaymentQuery query = sCanMakePaymentQueries.get(mPaymentRequestUrl);

[please use gerrit instead, 2017/05/25 17:56:13]

canMakePayment() queries should be throttled based on the origin of the iframe,
not based on the URL. That way, https://evil.com cannot abuse the queries by
opening sub-iframes from different URLS on the same origin, e.g.,
https://evil.com/check-visa.html and https://evil.com/check-mastercard.html.

Therefore, you need to keep around mPaymentRequestOrigin variable for use with
sCanMakePaymentQueries.

[gogerald1, 2017/05/29 22:13:16]

my bad, payment request handler do require origin instead of url, so I will keep
origin here.
However our current format of origin is not standard, we could look it later.

             if (query != null && query.matchesPaymentMethods(mMethodData)) {
                 query.notifyObserversOfResponse(mCanMakePayment);
             }
         }
 
         if (disconnectIfNoPaymentMethodsSupported()) return;
 
         // Query instruments after mMerchantSupportsAutofillPaymentInstruments has been initialized,
         // so a fast response from a non-autofill payment app at the front of the app list does not
         // cause NOT_SUPPORTED payment rejection.
         for (Map.Entry<PaymentApp, Map<String, PaymentMethodData>> q : queryApps.entrySet()) {
-            q.getKey().getInstruments(q.getValue(), mTopLevelOrigin, mPaymentRequestOrigin,
+            q.getKey().getInstruments(q.getValue(), mTopLevelUrl, mPaymentRequestUrl,

[please use gerrit instead, 2017/05/25 17:56:13]

Please rename these parameters in PaymentApp.java and update their comments.
That way, whoever is working on PaymentApp.java will know to expect the full URL
instead of only origin.

[gogerald1, 2017/05/29 22:13:16]

Done.

                     mCertificateChain, mRawTotal, this);
         }
     }
 
     /** Filter out merchant method data that's not relevant to a payment app. Can return null. */
     private static Map<String, PaymentMethodData> filterMerchantMethodData(
             Map<String, PaymentMethodData> merchantMethodData, Set<String> appMethods) {
         Map<String, PaymentMethodData> result = null;
         for (String method : appMethods) {
             if (merchantMethodData.containsKey(method)) {
@@ skipping 551 matching lines @@
         Map<String, PaymentDetailsModifier> modifiers = new HashMap<>();
         for (String instrumentMethodName : instrument.getInstrumentMethodNames()) {
             if (mMethodData.containsKey(instrumentMethodName)) {
                 methodData.put(instrumentMethodName, mMethodData.get(instrumentMethodName));
             }
             if (mModifiers != null && mModifiers.containsKey(instrumentMethodName)) {
                 modifiers.put(instrumentMethodName, mModifiers.get(instrumentMethodName));
             }
         }
 
-        instrument.invokePaymentApp(mId, mMerchantName, mTopLevelOrigin, mPaymentRequestOrigin,
+        instrument.invokePaymentApp(mId, mMerchantName, mTopLevelUrl, mPaymentRequestUrl,

[please use gerrit instead, 2017/05/25 17:56:13]

Please update the names and comments of these parameters in
PaymentInstrument.java.

[gogerald1, 2017/05/29 22:13:16]

Done.

                 mCertificateChain, Collections.unmodifiableMap(methodData), mRawTotal,
                 mRawLineItems, Collections.unmodifiableMap(modifiers), this);
 
         mJourneyLogger.setEventOccurred(JourneyLogger.EVENT_PAY_CLICKED);
         return !(instrument instanceof AutofillPaymentInstrument);
     }
 
     @Override
     public void onDismiss() {
         recordAbortReasonHistogram(PaymentRequestMetrics.ABORT_REASON_ABORTED_BY_USER);
@@ skipping 67 matching lines @@
         disconnectFromClientWithDebugMessage("Card and address settings clicked");
     }
 
     /**
      * Called by the merchant website to check if the user has complete payment instruments.
      */
     @Override
     public void canMakePayment() {
         if (mClient == null) return;
 
-        CanMakePaymentQuery query = sCanMakePaymentQueries.get(mPaymentRequestOrigin);
+        CanMakePaymentQuery query = sCanMakePaymentQueries.get(mPaymentRequestUrl);
         if (query == null) {
             // If there has not been a canMakePayment() query in the last 30 minutes, take a note
             // that one has happened just now. Remember the payment method names and the
             // corresponding data for the next 30 minutes. Forget about it after the 30 minute
             // period expires.
             query = new CanMakePaymentQuery(Collections.unmodifiableMap(mMethodData));
-            sCanMakePaymentQueries.put(mPaymentRequestOrigin, query);
+            sCanMakePaymentQueries.put(mPaymentRequestUrl, query);
             mHandler.postDelayed(new Runnable() {
                 @Override
                 public void run() {
-                    sCanMakePaymentQueries.remove(mPaymentRequestOrigin);
+                    sCanMakePaymentQueries.remove(mPaymentRequestUrl);
                 }
             }, CAN_MAKE_PAYMENT_QUERY_PERIOD_MS);
         } else if (shouldEnforceCanMakePaymentQueryQuota()
                 && !query.matchesPaymentMethods(Collections.unmodifiableMap(mMethodData))) {
             // If there has been a canMakePayment() query in the last 30 minutes, but the previous
             // payment method names and the corresponding data don't match, enforce the
             // canMakePayment() query quota (unless the quota is turned off).
             mClient.onCanMakePayment(CanMakePaymentQueryResult.QUERY_QUOTA_EXCEEDED);
             if (sObserverForTest != null) {
                 sObserverForTest.onPaymentRequestServiceCanMakePaymentQueryResponded();
             }
             return;
         }
 
         query.addObserver(this);
         if (isFinishedQueryingPaymentApps()) query.notifyObserversOfResponse(mCanMakePayment);
     }
 
     private void respondCanMakePaymentQuery(boolean response) {
         if (mClient == null) return;
 
         boolean isIgnoringQueryQuota = false;
         if (!shouldEnforceCanMakePaymentQueryQuota()) {
-            CanMakePaymentQuery query = sCanMakePaymentQueries.get(mPaymentRequestOrigin);
+            CanMakePaymentQuery query = sCanMakePaymentQueries.get(mPaymentRequestUrl);
             // The cached query may have expired between instantiation of PaymentRequest and
             // finishing the query of the payment apps.
             if (query != null) {
                 isIgnoringQueryQuota =
                         !query.matchesPaymentMethods(Collections.unmodifiableMap(mMethodData));
             }
         }
 
         if (mIsIncognito) {
             mClient.onCanMakePayment(CanMakePaymentQueryResult.CAN_MAKE_PAYMENT);
@@ skipping 123 matching lines @@
             if (first instanceof AutofillPaymentInstrument) {
                 AutofillPaymentInstrument creditCard = (AutofillPaymentInstrument) first;
                 if (creditCard.isComplete()) selection = 0;
             } else {
                 // If a payment app is available, then PaymentRequest.canMakePayment() returns true.
                 mCanMakePayment = true;
                 selection = 0;
             }
         }
 
-        CanMakePaymentQuery query = sCanMakePaymentQueries.get(mPaymentRequestOrigin);
+        CanMakePaymentQuery query = sCanMakePaymentQueries.get(mPaymentRequestUrl);
         if (query != null && query.matchesPaymentMethods(mMethodData)) {
             query.notifyObserversOfResponse(mCanMakePayment);
         }
 
         // The list of payment instruments is ready to display.
         List<PaymentInstrument> sortedInstruments = new ArrayList<>();
         for (List<PaymentInstrument> a : mPendingInstruments) {
             sortedInstruments.addAll(a);
         }
         mPaymentMethodsSection = new SectionInformation(
@@ skipping 287 matching lines @@
 
     /**
      * The frecency score is calculated according to use count and last use date. The formula is
      * the same as the one used in GetFrecencyScore in autofill_data_model.cc.
      */
     private static final double getFrecencyScore(int count, long date) {
         long currentTime = System.currentTimeMillis();
         return -Math.log((currentTime - date) / (24 * 60 * 60 * 1000) + 2) / Math.log(count + 2);
     }
 }