ServiceWorker: Reject overly long scope/script URLs

content/child/service_worker/service_worker_dispatcher.cc

Index: content/child/service_worker/service_worker_dispatcher.cc
diff --git a/content/child/service_worker/service_worker_dispatcher.cc b/content/child/service_worker/service_worker_dispatcher.cc
index 131b714acb6c5e7cecb8197590af6ca31e29daa2..c82b9ffd8a25e0dcc2a7ee30ec79b648605981f7 100644
--- a/content/child/service_worker/service_worker_dispatcher.cc
+++ b/content/child/service_worker/service_worker_dispatcher.cc
@@ -14,6 +14,7 @@
 #include "content/child/thread_safe_sender.h"
 #include "content/child/webmessageportchannel_impl.h"
 #include "content/common/service_worker/service_worker_messages.h"
+#include "content/public/common/url_utils.h"
 #include "third_party/WebKit/public/platform/WebServiceWorkerProviderClient.h"
 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 
@@ -78,6 +79,18 @@ void ServiceWorkerDispatcher::RegisterServiceWorker(
     const GURL& script_url,
     WebServiceWorkerProvider::WebServiceWorkerCallbacks* callbacks) {
   DCHECK(callbacks);
+
+  if (pattern.possibly_invalid_spec().size() > GetMaxURLChars() ||
+      script_url.possibly_invalid_spec().size() > GetMaxURLChars()) {
+    scoped_ptr<WebServiceWorkerProvider::WebServiceWorkerCallbacks>
+        owned_callbacks(callbacks);
+    scoped_ptr<WebServiceWorkerError>  error(

[falken, 2014/06/20 03:09:21]

extra space here

[jsbell, 2014/06/20 17:05:25]

Done.

+        new WebServiceWorkerError(WebServiceWorkerError::ErrorTypeSecurity,
+                                  "URL too long"));
+    callbacks->onError(error.release());
+    return;
+  }
+
   int request_id = pending_callbacks_.Add(callbacks);
   thread_safe_sender_->Send(new ServiceWorkerHostMsg_RegisterServiceWorker(
       CurrentWorkerId(), request_id, provider_id, pattern, script_url));
@@ -88,6 +101,17 @@ void ServiceWorkerDispatcher::UnregisterServiceWorker(
     const GURL& pattern,
     WebServiceWorkerProvider::WebServiceWorkerCallbacks* callbacks) {
   DCHECK(callbacks);
+
+  if (pattern.possibly_invalid_spec().size() > GetMaxURLChars()) {
+    scoped_ptr<WebServiceWorkerProvider::WebServiceWorkerCallbacks>
+        owned_callbacks(callbacks);
+    scoped_ptr<WebServiceWorkerError>  error(

[falken, 2014/06/20 03:09:21]

ditto

[jsbell, 2014/06/20 17:05:25]

Done.

+        new WebServiceWorkerError(WebServiceWorkerError::ErrorTypeSecurity,
+                                  "URL too long"));
+    callbacks->onError(error.release());
+    return;
+  }
+
   int request_id = pending_callbacks_.Add(callbacks);
   thread_safe_sender_->Send(new ServiceWorkerHostMsg_UnregisterServiceWorker(
       CurrentWorkerId(), request_id, provider_id, pattern));