ServiceWorker: Reject overly long scope/script URLs

content/child/service_worker/service_worker_dispatcher.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/service_worker/service_worker_dispatcher.h"
 
 #include "base/lazy_instance.h"
 #include "base/stl_util.h"
 #include "base/threading/thread_local.h"
 #include "content/child/child_thread.h"
 #include "content/child/service_worker/service_worker_handle_reference.h"
 #include "content/child/service_worker/service_worker_provider_context.h"
 #include "content/child/service_worker/web_service_worker_impl.h"
 #include "content/child/thread_safe_sender.h"
 #include "content/child/webmessageportchannel_impl.h"
 #include "content/common/service_worker/service_worker_messages.h"
+#include "content/public/common/url_utils.h"
 #include "third_party/WebKit/public/platform/WebServiceWorkerProviderClient.h"
 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 
 using blink::WebServiceWorkerError;
 using blink::WebServiceWorkerProvider;
 using base::ThreadLocalPointer;
 
 namespace content {
 
 namespace {
@@ skipping 44 matching lines @@
 bool ServiceWorkerDispatcher::Send(IPC::Message* msg) {
   return thread_safe_sender_->Send(msg);
 }
 
 void ServiceWorkerDispatcher::RegisterServiceWorker(
     int provider_id,
     const GURL& pattern,
     const GURL& script_url,
     WebServiceWorkerProvider::WebServiceWorkerCallbacks* callbacks) {
   DCHECK(callbacks);
+
+  if (pattern.possibly_invalid_spec().size() > GetMaxURLChars() ||
+      script_url.possibly_invalid_spec().size() > GetMaxURLChars()) {
+    scoped_ptr<WebServiceWorkerProvider::WebServiceWorkerCallbacks>
+        owned_callbacks(callbacks);
+    scoped_ptr<WebServiceWorkerError> error(new WebServiceWorkerError(
+        WebServiceWorkerError::ErrorTypeSecurity, "URL too long"));
+    callbacks->onError(error.release());
+    return;
+  }
+
   int request_id = pending_callbacks_.Add(callbacks);
   thread_safe_sender_->Send(new ServiceWorkerHostMsg_RegisterServiceWorker(
       CurrentWorkerId(), request_id, provider_id, pattern, script_url));
 }
 
 void ServiceWorkerDispatcher::UnregisterServiceWorker(
     int provider_id,
     const GURL& pattern,
     WebServiceWorkerProvider::WebServiceWorkerCallbacks* callbacks) {
   DCHECK(callbacks);
+
+  if (pattern.possibly_invalid_spec().size() > GetMaxURLChars()) {
+    scoped_ptr<WebServiceWorkerProvider::WebServiceWorkerCallbacks>
+        owned_callbacks(callbacks);
+    scoped_ptr<WebServiceWorkerError> error(new WebServiceWorkerError(
+        WebServiceWorkerError::ErrorTypeSecurity, "URL too long"));
+    callbacks->onError(error.release());
+    return;
+  }
+
   int request_id = pending_callbacks_.Add(callbacks);
   thread_safe_sender_->Send(new ServiceWorkerHostMsg_UnregisterServiceWorker(
       CurrentWorkerId(), request_id, provider_id, pattern));
 }
 
 void ServiceWorkerDispatcher::AddProviderContext(
     ServiceWorkerProviderContext* provider_context) {
   DCHECK(provider_context);
   int provider_id = provider_context->provider_id();
   DCHECK(!ContainsKey(provider_contexts_, provider_id));
@@ skipping 107 matching lines @@
     int thread_id,
     int request_id,
     WebServiceWorkerError::ErrorType error_type,
     const base::string16& message) {
   WebServiceWorkerProvider::WebServiceWorkerCallbacks* callbacks =
       pending_callbacks_.Lookup(request_id);
   DCHECK(callbacks);
   if (!callbacks)
     return;
 
-  scoped_ptr<WebServiceWorkerError>  error(
+  scoped_ptr<WebServiceWorkerError> error(
       new WebServiceWorkerError(error_type, message));
   callbacks->onError(error.release());
   pending_callbacks_.Remove(request_id);
 }
 
 void ServiceWorkerDispatcher::OnServiceWorkerStateChanged(
     int thread_id,
     int handle_id,
     blink::WebServiceWorkerState state) {
   WorkerObjectMap::iterator worker = service_workers_.find(handle_id);
@@ skipping 84 matching lines @@
   DCHECK(!ContainsKey(service_workers_, handle_id));
   service_workers_[handle_id] = worker;
 }
 
 void ServiceWorkerDispatcher::RemoveServiceWorker(int handle_id) {
   DCHECK(ContainsKey(service_workers_, handle_id));
   service_workers_.erase(handle_id);
 }
 
 }  // namespace content