Rendering the image in the sandbox for security

chrome/browser/ui/android/context_menu_helper.cc

Index: chrome/browser/ui/android/context_menu_helper.cc
diff --git a/chrome/browser/ui/android/context_menu_helper.cc b/chrome/browser/ui/android/context_menu_helper.cc
index 0d677d1e7007e6dc353d104179763c2a70974cda..efc1d4db992e670d56e8a6b52e27553df7f635c7 100644
--- a/chrome/browser/ui/android/context_menu_helper.cc
+++ b/chrome/browser/ui/android/context_menu_helper.cc
@@ -13,6 +13,7 @@
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "chrome/browser/android/download/download_controller_base.h"
+#include "chrome/browser/image_decoder.h"
 #include "chrome/browser/ui/tab_contents/core_tab_helper.h"
 #include "chrome/common/thumbnail_capturer.mojom.h"
 #include "components/data_reduction_proxy/core/common/data_reduction_proxy_headers.h"
@@ -24,6 +25,7 @@
 #include "jni/ContextMenuParams_jni.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/WebKit/public/web/WebContextMenuData.h"
+#include "ui/gfx/android/java_bitmap.h"
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/geometry/size.h"
 
@@ -39,13 +41,54 @@ const char kDataReductionProxyPassthroughHeader[] =
 
 namespace {
 
-void OnRetrieveImage(chrome::mojom::ThumbnailCapturerPtr thumbnail_capturer,
-                     const base::android::JavaRef<jobject>& jcallback,
-                     const std::vector<uint8_t>& thumbnail_data,
-                     const gfx::Size& original_size) {
+class ContextMenuHelperImageRequest : public ImageDecoder::ImageRequest {
+ public:
+  static void Start(const base::android::JavaRef<jobject>& jcallback,
+                    const std::vector<uint8_t>& thumbnail_data) {
+    ContextMenuHelperImageRequest* request =
+        new ContextMenuHelperImageRequest(jcallback);
+    ImageDecoder::Start(request, thumbnail_data);
+  }
+
+ protected:
+  void OnImageDecoded(const SkBitmap& decoded_image) override {
+    base::android::RunCallbackAndroid(jcallback_,
+                                      gfx::ConvertToJavaBitmap(&decoded_image));
+    delete this;
+  }
+
+  void OnDecodeImageFailed() override {
+    base::android::ScopedJavaLocalRef<jobject> j_bitmap;
+    base::android::RunCallbackAndroid(jcallback_, j_bitmap);
+    delete this;
+  }
+
+ private:
+  ContextMenuHelperImageRequest(
+      const base::android::JavaRef<jobject>& jcallback)
+      : jcallback_(jcallback) {}
+
+  const base::android::ScopedJavaGlobalRef<jobject> jcallback_;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(ContextMenuHelperImageRequest);
+};
+
+void OnRetrieveImageForShare(
+    chrome::mojom::ThumbnailCapturerPtr thumbnail_capturer,
+    const base::android::JavaRef<jobject>& jcallback,
+    const std::vector<uint8_t>& thumbnail_data,
+    const gfx::Size& original_size) {
   base::android::RunCallbackAndroid(jcallback, thumbnail_data);
 }
 
+void OnRetrieveImageForContextMenu(
+    chrome::mojom::ThumbnailCapturerPtr thumbnail_capturer,
+    const base::android::JavaRef<jobject>& jcallback,
+    const std::vector<uint8_t>& thumbnail_data,
+    const gfx::Size& original_size) {
+  ContextMenuHelperImageRequest::Start(jcallback, thumbnail_data);
+}
+
 }  // namespace
 
 ContextMenuHelper::ContextMenuHelper(content::WebContents* web_contents)
@@ -161,10 +204,29 @@ void ContextMenuHelper::SearchForImage(JNIEnv* env,
       render_frame_host, context_menu_params_.src_url);
 }
 
-void ContextMenuHelper::RetrieveImage(JNIEnv* env,
-                                      const JavaParamRef<jobject>& obj,
-                                      const JavaParamRef<jobject>& jcallback,
-                                      jint max_dimen_px) {
+void ContextMenuHelper::RetrieveImageForShare(
+    JNIEnv* env,
+    const JavaParamRef<jobject>& obj,
+    const JavaParamRef<jobject>& jcallback,
+    jint max_dimen_px) {
+  RetrieveImageInternal(env, base::Bind(&OnRetrieveImageForShare), jcallback,
+                        max_dimen_px);
+}
+
+void ContextMenuHelper::RetrieveImageForContextMenu(
+    JNIEnv* env,
+    const JavaParamRef<jobject>& obj,
+    const JavaParamRef<jobject>& jcallback,
+    jint max_dimen_px) {
+  RetrieveImageInternal(env, base::Bind(&OnRetrieveImageForContextMenu),
+                        jcallback, max_dimen_px);
+}
+
+void ContextMenuHelper::RetrieveImageInternal(
+    JNIEnv* env,
+    const ImageRetrieveCallback& retrieve_callback,
+    const JavaParamRef<jobject>& jcallback,
+    jint max_dimen_px) {
   content::RenderFrameHost* render_frame_host =
       content::RenderFrameHost::FromID(render_process_id_, render_frame_id_);
   if (!render_frame_host)
@@ -172,12 +234,12 @@ void ContextMenuHelper::RetrieveImage(JNIEnv* env,
 
   chrome::mojom::ThumbnailCapturerPtr thumbnail_capturer;
   render_frame_host->GetRemoteInterfaces()->GetInterface(&thumbnail_capturer);
-  // Bind the InterfacePtr into the callback so that it's kept alive until
-  // there's either a connection error or a response.
+  // Bind the InterfacePtr into the callback so that it's kept alive
+  // until there's either a connection error or a response.
   auto* thumbnail_capturer_proxy = thumbnail_capturer.get();
   thumbnail_capturer_proxy->RequestThumbnailForContextNode(
       0, gfx::Size(max_dimen_px, max_dimen_px),
-      base::Bind(&OnRetrieveImage, base::Passed(&thumbnail_capturer),
+      base::Bind(retrieve_callback, base::Passed(&thumbnail_capturer),
                  base::android::ScopedJavaGlobalRef<jobject>(env, jcallback)));
 }