[Payments] Implement openWindow for service worker based payment handler

third_party/WebKit/Source/modules/payments/PaymentRequestEvent.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/payments/PaymentRequestEvent.h"
 
+#include "bindings/core/v8/ScriptPromiseResolver.h"
+#include "core/dom/DOMException.h"
+#include "core/workers/WorkerGlobalScope.h"
+#include "core/workers/WorkerLocation.h"
 #include "modules/serviceworkers/RespondWithObserver.h"
+#include "modules/serviceworkers/ServiceWorkerGlobalScopeClient.h"
+#include "modules/serviceworkers/ServiceWorkerWindowClientCallback.h"
+#include "platform/wtf/PtrUtil.h"
 #include "platform/wtf/text/AtomicString.h"
 
 namespace blink {
 
 PaymentRequestEvent* PaymentRequestEvent::Create(
     const AtomicString& type,
     const PaymentAppRequest& app_request,
     RespondWithObserver* respond_with_observer,
     WaitUntilObserver* wait_until_observer) {
   return new PaymentRequestEvent(type, app_request, respond_with_observer,
@@ skipping 28 matching lines @@
 
 const HeapVector<PaymentDetailsModifier>& PaymentRequestEvent::modifiers()
     const {
   return modifiers_;
 }
 
 const String& PaymentRequestEvent::instrumentKey() const {
   return instrument_key_;
 }
 
+ScriptPromise PaymentRequestEvent::openWindow(ScriptState* script_state,
+                                              const String& url) {
+  ScriptPromiseResolver* resolver = ScriptPromiseResolver::Create(script_state);
+  ScriptPromise promise = resolver->Promise();
+  ExecutionContext* context = ExecutionContext::From(script_state);
+
+  KURL parsed_url_to_open =
+      KURL(ToWorkerGlobalScope(context)->location()->Url(), url);
+  if (!parsed_url_to_open.IsValid()) {
+    resolver->Reject(V8ThrowException::CreateTypeError(
+        script_state->GetIsolate(), "'" + url + "' is not a valid URL."));
+    return promise;
+  }
+
+  if (!context->GetSecurityOrigin()->CanDisplay(parsed_url_to_open)) {
+    resolver->Reject(V8ThrowException::CreateTypeError(
+        script_state->GetIsolate(),
+        "'" + parsed_url_to_open.ElidedString() + "' cannot be opened."));
+    return promise;
+  }
+
+  if (!context->GetSecurityOrigin()->CanAccess(
+          SecurityOrigin::Create(parsed_url_to_open).Get())) {
+    resolver->Reject(DOMException::Create(
+        kSecurityError,
+        "'" + parsed_url_to_open.ElidedString() + "' is not allowed."));
+    return promise;
+  }

[please use gerrit instead, 2017/06/01 17:50:37]

Which one of these checks prevents a SW from https://a.com to open a window with
https://b.com URL?

[gogerald1, 2017/06/02 03:33:11]

CanAccess

+
+  if (!context->IsWindowInteractionAllowed()) {
+    resolver->Reject(DOMException::Create(kInvalidAccessError,
+                                          "Not allowed to open a window."));
+    return promise;
+  }
+  context->ConsumeWindowInteraction();
+
+  // TODO(gogerald): Use full url instead of origin for redirect_url to figure
+  // out the exact payment request web page, like used in createPopupCustomTab
+  // in TabDelegate.java for Android.
+  ServiceWorkerGlobalScopeClient::From(context)->OpenWindowForPaymentHandle(

[please use gerrit instead, 2017/06/01 17:50:37]

OpenWindowForPaymentHandler -- need "r" at the end of the method name.

[gogerald1, 2017/06/02 03:33:11]

Done.

+      KURL(kParsedURLString, top_level_origin_), parsed_url_to_open,
+      WTF::MakeUnique<NavigateClientCallback>(resolver));
+  return promise;
+}
+
 void PaymentRequestEvent::respondWith(ScriptState* script_state,
                                       ScriptPromise script_promise,
                                       ExceptionState& exception_state) {
   stopImmediatePropagation();
   if (observer_) {
     observer_->RespondWith(script_state, script_promise, exception_state);
   }
 }
 
 DEFINE_TRACE(PaymentRequestEvent) {
@@ skipping 12 matching lines @@
       top_level_origin_(app_request.topLevelOrigin()),
       payment_request_origin_(app_request.paymentRequestOrigin()),
       payment_request_id_(app_request.paymentRequestId()),
       method_data_(std::move(app_request.methodData())),
       total_(app_request.total()),
       modifiers_(app_request.modifiers()),
       instrument_key_(app_request.instrumentKey()),
       observer_(respond_with_observer) {}
 
 }  // namespace blink