Rendering the image in the sandbox for security

chrome/browser/ui/android/context_menu_helper.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/android/context_menu_helper.h"
 
 #include <stdint.h>
 
 #include <vector>
 
 #include "base/android/callback_android.h"
 #include "base/android/jni_string.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "chrome/browser/android/download/download_controller_base.h"
+#include "chrome/browser/image_decoder.h"
 #include "chrome/browser/ui/tab_contents/core_tab_helper.h"
 #include "chrome/common/thumbnail_capturer.mojom.h"
 #include "components/data_reduction_proxy/core/common/data_reduction_proxy_headers.h"
 #include "content/public/browser/android/content_view_core.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/context_menu_params.h"
 #include "jni/ContextMenuHelper_jni.h"
 #include "jni/ContextMenuParams_jni.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/WebKit/public/web/WebContextMenuData.h"
+#include "ui/gfx/android/java_bitmap.h"
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/geometry/size.h"
 
 using base::android::ConvertJavaStringToUTF8;
 using base::android::ConvertUTF8ToJavaString;
 using base::android::ConvertUTF16ToJavaString;
 using base::android::JavaParamRef;
 
 DEFINE_WEB_CONTENTS_USER_DATA_KEY(ContextMenuHelper);
 
 const char kDataReductionProxyPassthroughHeader[] =
     "Chrome-Proxy-Accept-Transform: identity\r\n";
 
 namespace {
 
-void OnRetrieveImage(chrome::mojom::ThumbnailCapturerPtr thumbnail_capturer,
-                     const base::android::JavaRef<jobject>& jcallback,
-                     const std::vector<uint8_t>& thumbnail_data,
-                     const gfx::Size& original_size) {
+class ContextMenuHelperImageRequest : public ImageDecoder::ImageRequest {
+ public:
+  static void Start(const base::android::JavaRef<jobject>& jcallback,
+                    const std::vector<uint8_t>& thumbnail_data) {
+    ContextMenuHelperImageRequest* request =
+        new ContextMenuHelperImageRequest(jcallback);
+    ImageDecoder::Start(request, thumbnail_data);
+  }
+
+ protected:
+  void OnImageDecoded(const SkBitmap& decoded_image) override {
+    base::android::RunCallbackAndroid(jcallback_,
+                                      gfx::ConvertToJavaBitmap(&decoded_image));
+    delete this;
+  }
+
+  void OnDecodeImageFailed() override {
+    base::android::ScopedJavaLocalRef<jobject> j_bitmap;
+    base::android::RunCallbackAndroid(jcallback_, j_bitmap);
+    delete this;
+  }
+
+ private:
+  ContextMenuHelperImageRequest(
+      const base::android::JavaRef<jobject>& jcallback)
+      : jcallback_(jcallback) {}
+
+  const base::android::ScopedJavaGlobalRef<jobject> jcallback_;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(ContextMenuHelperImageRequest);
+};
+
+void OnRetrieveImageForShare(
+    chrome::mojom::ThumbnailCapturerPtr thumbnail_capturer,
+    const base::android::JavaRef<jobject>& jcallback,
+    const std::vector<uint8_t>& thumbnail_data,
+    const gfx::Size& original_size) {
   base::android::RunCallbackAndroid(jcallback, thumbnail_data);
 }
 
+void OnRetrieveImageForContextMenu(
+    chrome::mojom::ThumbnailCapturerPtr thumbnail_capturer,
+    const base::android::JavaRef<jobject>& jcallback,
+    const std::vector<uint8_t>& thumbnail_data,
+    const gfx::Size& original_size) {
+  ContextMenuHelperImageRequest::Start(jcallback, thumbnail_data);
+}
+
 }  // namespace
 
 ContextMenuHelper::ContextMenuHelper(content::WebContents* web_contents)
     : web_contents_(web_contents) {
   JNIEnv* env = base::android::AttachCurrentThread();
   java_obj_.Reset(
       env,
       Java_ContextMenuHelper_create(env, reinterpret_cast<long>(this)).obj());
   DCHECK(!java_obj_.is_null());
 }
@@ skipping 95 matching lines @@
                                        const JavaParamRef<jobject>& obj) {
   content::RenderFrameHost* render_frame_host =
       content::RenderFrameHost::FromID(render_process_id_, render_frame_id_);
   if (!render_frame_host)
     return;
 
   CoreTabHelper::FromWebContents(web_contents_)->SearchByImageInNewTab(
       render_frame_host, context_menu_params_.src_url);
 }
 
-void ContextMenuHelper::RetrieveImage(JNIEnv* env,
-                                      const JavaParamRef<jobject>& obj,
-                                      const JavaParamRef<jobject>& jcallback,
-                                      jint max_dimen_px) {
+void ContextMenuHelper::RetrieveImageForShare(
+    JNIEnv* env,
+    const JavaParamRef<jobject>& obj,
+    const JavaParamRef<jobject>& jcallback,
+    jint max_dimen_px) {
+  RetrieveImageInternal(env, base::Bind(&OnRetrieveImageForShare), jcallback,
+                        max_dimen_px);
+}
+
+void ContextMenuHelper::RetrieveImageForContextMenu(
+    JNIEnv* env,
+    const JavaParamRef<jobject>& obj,
+    const JavaParamRef<jobject>& jcallback,
+    jint max_dimen_px) {
+  RetrieveImageInternal(env, base::Bind(&OnRetrieveImageForContextMenu),
+                        jcallback, max_dimen_px);
+}
+
+void ContextMenuHelper::RetrieveImageInternal(
+    JNIEnv* env,
+    const ImageRetrieveCallback& retrieve_callback,
+    const JavaParamRef<jobject>& jcallback,
+    jint max_dimen_px) {
   content::RenderFrameHost* render_frame_host =
       content::RenderFrameHost::FromID(render_process_id_, render_frame_id_);
   if (!render_frame_host)
     return;
 
   chrome::mojom::ThumbnailCapturerPtr thumbnail_capturer;
   render_frame_host->GetRemoteInterfaces()->GetInterface(&thumbnail_capturer);
-  // Bind the InterfacePtr into the callback so that it's kept alive until
-  // there's either a connection error or a response.
+  // Bind the InterfacePtr into the callback so that it's kept alive
+  // until there's either a connection error or a response.
   auto* thumbnail_capturer_proxy = thumbnail_capturer.get();
   thumbnail_capturer_proxy->RequestThumbnailForContextNode(
       0, gfx::Size(max_dimen_px, max_dimen_px),
-      base::Bind(&OnRetrieveImage, base::Passed(&thumbnail_capturer),
+      base::Bind(retrieve_callback, base::Passed(&thumbnail_capturer),
                  base::android::ScopedJavaGlobalRef<jobject>(env, jcallback)));
 }
 
 bool RegisterContextMenuHelper(JNIEnv* env) {
   return RegisterNativesImpl(env);
 }