Some security checks around destruction/setting bounds.

mojo/services/public/cpp/view_manager/tests/view_manager_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/services/public/cpp/view_manager/view_manager.h"
 
 #include "base/bind.h"
 #include "base/logging.h"
 #include "mojo/services/public/cpp/view_manager/lib/view_manager_private.h"
 #include "mojo/services/public/cpp/view_manager/lib/view_manager_synchronizer.h"
@@ skipping 198 matching lines @@
   }
   if (views) {
     for (std::set<TransportViewId>::const_iterator it = views->begin();
           it != views->end(); ++it) {
       view_manager->GetViewById(*it)->AddObserver(&observer);
     }
   }
   DoRunLoop();
 }
 
+// Tracks a node's destruction. Query is_valid() for current state.
+class NodeTracker : public ViewTreeNodeObserver {
+ public:
+  explicit NodeTracker(ViewTreeNode* node) : node_(node) {
+    node_->AddObserver(this);
+  }
+  virtual ~NodeTracker() {
+    if (node_)
+      node_->RemoveObserver(this);
+  }
+
+  bool is_valid() const { return !!node_; }
+
+ private:
+  // Overridden from ViewTreeNodeObserver:
+  virtual void OnNodeDestroy(
+      ViewTreeNode* node,
+      ViewTreeNodeObserver::DispositionChangePhase phase) OVERRIDE {
+    if (phase != ViewTreeNodeObserver::DISPOSITION_CHANGED)
+      return;
+    DCHECK_EQ(node, node_);
+    node_ = NULL;
+  }
+
+  int id_;
+  ViewTreeNode* node_;
+
+  DISALLOW_COPY_AND_ASSIGN(NodeTracker);
+};
+
 }  // namespace
 
 // ViewManager -----------------------------------------------------------------
 
 // These tests model synchronization of two peer connections to the view manager
 // service, that are given access to some root node.
 
 class ViewManagerTest : public testing::Test {
  public:
   ViewManagerTest() : commit_count_(0) {}
@@ skipping 312 matching lines @@
 }
 
 // This test verifies that a node hierarchy constructed in one connection
 // becomes entirely visible to the second connection when the hierarchy is
 // attached.
 TEST_F(ViewManagerTest, MapSubtreeOnAttach) {
   ViewTreeNode* node1 = ViewTreeNode::Create(view_manager_1());
   ViewTreeNode* node11 = CreateNodeInParent(node1);
   View* view11 = View::Create(view_manager_1());
   node11->SetActiveView(view11);
+  gfx::Rect node11_bounds(800, 600);
+  node11->SetBounds(node11_bounds);
   WaitForAllChangesToBeAcked(view_manager_1());
 
   // Now attach this node tree to the root & wait for it to show up in the
   // second connection.
   view_manager_1()->tree()->AddChild(node1);
   WaitForTreeSizeToMatch(view_manager_2()->tree(), 3);
 
   ViewTreeNode* node11_2 = view_manager_2()->GetNodeById(node11->id());
   View* view11_2 = view_manager_2()->GetViewById(view11->id());
   EXPECT_TRUE(node11_2 != NULL);
   EXPECT_EQ(view11_2, node11_2->active_view());
+  EXPECT_EQ(node11_bounds, node11_2->bounds());
 }
 
 // Verifies that bounds changes applied to a node hierarchy in one connection
 // are reflected to another.
 TEST_F(ViewManagerTest, SetBounds) {
   ViewTreeNode* node1 = CreateNodeInParent(view_manager_1()->tree());
   WaitForTreeSizeToMatch(view_manager_2()->tree(), 2);
 
   ViewTreeNode* node1_2 = view_manager_2()->GetNodeById(node1->id());
   EXPECT_EQ(node1->bounds(), node1_2->bounds());
 
   node1->SetBounds(gfx::Rect(0, 0, 100, 100));
   WaitForBoundsToChange(node1_2);
   EXPECT_EQ(node1->bounds(), node1_2->bounds());
+}
 
+// Verifies that bounds changes applied to a node owned by a different
+// connection are refused.
+TEST_F(ViewManagerTest, SetBoundsSecurity) {
+  ViewTreeNode* node1 = CreateNodeInParent(view_manager_1()->tree());
+  node1->SetBounds(gfx::Rect(800, 600));
+  WaitForTreeSizeToMatch(view_manager_2()->tree(), 2);
 
+  ViewTreeNode* node1_2 = view_manager_2()->GetNodeById(node1->id());
+  node1_2->SetBounds(gfx::Rect(1024, 768));
+  // Bounds change should have been rejected.
+  EXPECT_EQ(node1->bounds(), node1_2->bounds());
+}
+
+// Verifies that a node can only be destroyed by the connection that created it.
+TEST_F(ViewManagerTest, DestroySecurity) {
+  ViewTreeNode* node1 = CreateNodeInParent(view_manager_1()->tree());
+  WaitForTreeSizeToMatch(view_manager_2()->tree(), 3);
+
+  ViewTreeNode* node1_2 = view_manager_2()->GetNodeById(node1->id());
+  NodeTracker tracker2(node1_2);
+  node1_2->Destroy();
+  // Node should not have been destroyed.
+  EXPECT_TRUE(tracker2.is_valid());
+
+  NodeTracker tracker1(node1);
+  node1->Destroy();
+  EXPECT_FALSE(tracker1.is_valid());
 }
 
 }  // namespace view_manager
 }  // namespace mojo