Prevent querying of restricted query values from the instant extended JS api.

BUG=170785
TEST=NONE


Review URL: https://chromiumcodereview.appspot.com/12319108

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@187654 0039d316-1c4b-4281-b951-d872f2087c98

6 files changed, 104 insertions, 1 deletions

diff --git a/chrome/browser/instant/instant_controller.h b/chrome/browser/instant/instant_controller.h
index 208dccb..b58e0d5 100644
--- a/chrome/browser/instant/instant_controller.h
+++ b/chrome/browser/instant/instant_controller.h
@@ -198,6 +198,7 @@ class InstantController : public InstantPage::Delegate,
   FRIEND_TEST_ALL_PREFIXES(InstantTest, InstantOverlayRefresh);
   FRIEND_TEST_ALL_PREFIXES(InstantExtendedTest, ExtendedModeIsOn);
   FRIEND_TEST_ALL_PREFIXES(InstantExtendedTest, MostVisited);
+  FRIEND_TEST_ALL_PREFIXES(InstantExtendedTest, RestrictedItemReadback);
   FRIEND_TEST_ALL_PREFIXES(InstantExtendedTest, OmniboxFocusLoadsInstant);
   FRIEND_TEST_ALL_PREFIXES(InstantExtendedTest,
                            OmniboxTextUponFocusedCommittedSERP);
diff --git a/chrome/browser/instant/instant_extended_browsertest.cc b/chrome/browser/instant/instant_extended_browsertest.cc
index d38d02b..9489350 100644
--- a/chrome/browser/instant/instant_extended_browsertest.cc
+++ b/chrome/browser/instant/instant_extended_browsertest.cc
@@ -6,6 +6,10 @@
 
 #include "base/prefs/pref_service.h"
 #include "base/string_util.h"
+#include "base/stringprintf.h"
+#include "base/utf_string_conversions.h"
+#include "chrome/browser/autocomplete/autocomplete_match.h"
+#include "chrome/browser/autocomplete/autocomplete_provider.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/favicon/favicon_tab_helper.h"
@@ -1091,3 +1095,75 @@ IN_PROC_BROWSER_TEST_F(InstantExtendedTest, DISABLED_TransientEntryRemoved) {
       active_tab->GetController().GetLastCommittedEntry();
   EXPECT_TRUE(EndsWith(committed_entry->GetURL().spec(), "#q=query", true));
 }
+
+IN_PROC_BROWSER_TEST_F(InstantExtendedTest, RestrictedItemReadback) {
+  // Initialize Instant.
+  ASSERT_NO_FATAL_FAILURE(SetupInstant(browser()));
+  FocusOmniboxAndWaitForInstantSupport();
+
+  // Get a handle to the NTP and the current state of the JS.
+  ASSERT_NE(static_cast<InstantNTP*>(NULL), instant()->ntp());
+  content::WebContents* preview_tab = instant()->ntp()->contents();
+  EXPECT_TRUE(preview_tab);
+
+  // Manufacture a few autocomplete results and get them down to the page.
+  std::vector<InstantAutocompleteResult> autocomplete_results;
+  for (int i = 0; i < 3; ++i) {
+    std::string description(base::StringPrintf("Test Description %d", i));
+    std::string url(base::StringPrintf("http://www.testurl%d.com", i));
+
+    InstantAutocompleteResult res;
+    res.provider = ASCIIToUTF16(AutocompleteProvider::TypeToString(
+        AutocompleteProvider::TYPE_BUILTIN));
+    res.type = ASCIIToUTF16(AutocompleteMatch::TypeToString(
+        AutocompleteMatch::SEARCH_WHAT_YOU_TYPED)),
+    res.description = ASCIIToUTF16(description);
+    res.destination_url = ASCIIToUTF16(url);
+    res.transition = content::PAGE_TRANSITION_TYPED;
+    res.relevance = 42 + i;
+
+    autocomplete_results.push_back(res);
+  }
+  instant()->overlay()->SendAutocompleteResults(autocomplete_results);
+
+  // Apparently, one needs to access nativeSuggestions before
+  // apiHandle.setRestrictedValue can work.
+  EXPECT_TRUE(ExecuteScript("var foo = apiHandle.nativeSuggestions;"));
+
+  const char kQueryString[] = "Hippos go berzerk!";
+
+  // First set the query text to a non restricted value and ensure it can be
+  // read back.
+  std::ostringstream stream;
+  stream << "apiHandle.setValue('" << kQueryString << "');";
+  EXPECT_TRUE(ExecuteScript(stream.str()));
+
+  std::string result;
+  EXPECT_TRUE(GetStringFromJS(instant()->GetOverlayContents(),
+                              "apiHandle.value",
+                              &result));
+  EXPECT_EQ(kQueryString, result);
+
+  // Set the query text to the first restricted autocomplete item.
+  int rid = 0;
+  stream.str(std::string());
+  stream << "apiHandle.setRestrictedValue(" << rid << ")";
+  EXPECT_TRUE(ExecuteScript(stream.str()));
+
+  // Expect that we now receive the empty string when reading the value back.
+  EXPECT_TRUE(GetStringFromJS(instant()->GetOverlayContents(),
+                              "apiHandle.value",
+                              &result));
+  EXPECT_EQ("", result);
+
+  // Now set the query text to a non restricted value and ensure that the
+  // visibility has been reset and the string can again be read back.
+  stream.str(std::string());
+  stream << "apiHandle.setValue('" << kQueryString << "');";
+  EXPECT_TRUE(ExecuteScript(stream.str()));
+
+  EXPECT_TRUE(GetStringFromJS(instant()->GetOverlayContents(),
+                              "apiHandle.value",
+                              &result));
+  EXPECT_EQ(kQueryString, result);
+}
diff --git a/chrome/renderer/resources/extensions/searchbox_api.js b/chrome/renderer/resources/extensions/searchbox_api.js
index 24b2bc1..7b04950 100644
--- a/chrome/renderer/resources/extensions/searchbox_api.js
+++ b/chrome/renderer/resources/extensions/searchbox_api.js
@@ -248,6 +248,7 @@ if (!chrome.embeddedSearch) {
       this.setValue = function(text, type) {
         SetQuery(text, type);
       };
+      // Must access nativeSuggestions before calling setRestrictedValue.
       this.setRestrictedValue = function(autocompleteResultId) {
         SetQueryFromAutocompleteResult(autocompleteResultId);
       };
diff --git a/chrome/renderer/searchbox/searchbox.cc b/chrome/renderer/searchbox/searchbox.cc
index 83a9bd5..f5aba95 100644
--- a/chrome/renderer/searchbox/searchbox.cc
+++ b/chrome/renderer/searchbox/searchbox.cc
@@ -23,7 +23,8 @@ SearchBox::SearchBox(content::RenderView* render_view)
       last_results_base_(0),
       is_key_capture_enabled_(false),
       display_instant_results_(false),
-      omnibox_font_size_(0) {
+      omnibox_font_size_(0),
+      last_restricted_id_(0) {
 }
 
 SearchBox::~SearchBox() {
@@ -42,6 +43,10 @@ void SearchBox::SetSuggestions(
       render_view()->GetRoutingID(), render_view()->GetPageId(), suggestions));
 }
 
+void SearchBox::ClearQuery() {
+  query_.clear();
+}
+
 void SearchBox::ShowInstantOverlay(InstantShownReason reason,
                                    int height,
                                    InstantSizeUnits units) {
diff --git a/chrome/renderer/searchbox/searchbox.h b/chrome/renderer/searchbox/searchbox.h
index 1882729..af5042f 100644
--- a/chrome/renderer/searchbox/searchbox.h
+++ b/chrome/renderer/searchbox/searchbox.h
@@ -28,8 +28,15 @@ class SearchBox : public content::RenderViewObserver,
   virtual ~SearchBox();
 
   // Sends ChromeViewHostMsg_SetSuggestions to the browser.
+  // If |suggestions| is non-empty and the first element in |suggestions| is of
+  // type INSTANT_COMPLETE_REPLACE then this method will also update the current
+  // query text.
   void SetSuggestions(const std::vector<InstantSuggestion>& suggestions);
 
+  // Clears the current query text, used to ensure that restricted query strings
+  // are not retained.
+  void ClearQuery();
+
   // Sends ChromeViewHostMsg_ShowInstantOverlay to the browser.
   void ShowInstantOverlay(InstantShownReason reason,
                           int height,
@@ -135,6 +142,13 @@ class SearchBox : public content::RenderViewObserver,
   size_t omnibox_font_size_;
   std::vector<InstantMostVisitedItem> most_visited_items_;
 
+  // URL to Restricted Id mapping.
+  // TODO(dcblack): Unify this logic to work with both Most Visited and
+  // history suggestions.  (crbug/175768)
+  std::map<string16, int> url_to_restricted_id_map_;
+  std::map<int, string16> restricted_id_to_url_map_;
+  int last_restricted_id_;
+
   DISALLOW_COPY_AND_ASSIGN(SearchBox);
 };
 
diff --git a/chrome/renderer/searchbox/searchbox_extension.cc b/chrome/renderer/searchbox/searchbox_extension.cc
index 25c4e09..b0bbe44 100644
--- a/chrome/renderer/searchbox/searchbox_extension.cc
+++ b/chrome/renderer/searchbox/searchbox_extension.cc
@@ -873,6 +873,9 @@ v8::Handle<v8::Value>
   std::vector<InstantSuggestion> suggestions;
   suggestions.push_back(InstantSuggestion(text, behavior, type));
   SearchBox::Get(render_view)->SetSuggestions(suggestions);
+  // Clear the SearchBox's query text explicitly since this is a restricted
+  // value.
+  SearchBox::Get(render_view)->ClearQuery();
 
   return v8::Undefined();
 }
@@ -919,6 +922,9 @@ v8::Handle<v8::Value>
   std::vector<InstantSuggestion> suggestions;
   suggestions.push_back(InstantSuggestion(text, behavior, type));
   SearchBox::Get(render_view)->SetSuggestions(suggestions);
+  // Clear the SearchBox's query text explicitly since this is a restricted
+  // value.
+  SearchBox::Get(render_view)->ClearQuery();
 
   return v8::Undefined();
 }