ChromeFrame uses the IPC automation channel to talk to Chrome. The IPC messages sent by ChromeFrame

are handled by the AutomationProvider class in Chrome, which also handles other IPC's not used by
ChromeFrame. 

We now have a new class ChromeFrameAutomationProvider which derives from the AutomationProvider 
class and validates that incoming IPC messages are valid ChromeFrame messages.

Bug=29931
Test=Covered by unit test

Review URL: http://codereview.chromium.org/476008

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@34290 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 155 insertions, 2 deletions

diff --git a/chrome/browser/automation/automation_provider_unittest.cc b/chrome/browser/automation/automation_provider_unittest.cc
new file mode 100644
index 0000000..356d0f4
--- /dev/null
+++ b/chrome/browser/automation/automation_provider_unittest.cc
@@ -0,0 +1,32 @@
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/automation/chrome_frame_automation_provider.h"
+#include "ipc/ipc_message.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+class MockChromeFrameAutomationProvider
+    : public ChromeFrameAutomationProvider {
+ public:
+  explicit MockChromeFrameAutomationProvider(Profile* profile)
+      : ChromeFrameAutomationProvider(profile) {}
+
+  virtual ~MockChromeFrameAutomationProvider() {}
+
+  MOCK_METHOD1(OnUnhandledMessage,
+               void (const IPC::Message& message));  // NOLINT
+};
+
+TEST(AutomationProviderTest, TestInvalidChromeFrameMessage) {
+  IPC::Message bad_msg(1, -1, IPC::Message::PRIORITY_NORMAL);
+
+  scoped_refptr<MockChromeFrameAutomationProvider>
+      mock(new MockChromeFrameAutomationProvider(NULL));
+
+  EXPECT_CALL(*mock, OnUnhandledMessage(testing::Property(&IPC::Message::type,
+                                        -1))).Times(1);
+  mock->OnMessageReceived(bad_msg);
+}
+
diff --git a/chrome/browser/automation/chrome_frame_automation_provider.cc b/chrome/browser/automation/chrome_frame_automation_provider.cc
new file mode 100644
index 0000000..08b5d5c
--- /dev/null
+++ b/chrome/browser/automation/chrome_frame_automation_provider.cc
@@ -0,0 +1,73 @@
+// Copyright (c) 2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/automation/chrome_frame_automation_provider.h"
+#include "chrome/browser/profile.h"
+#include "chrome/browser/profile_manager.h"
+#include "chrome/test/automation/automation_messages.h"
+#include "ipc/ipc_message.h"
+#include "ipc/ipc_channel.h"
+
+ChromeFrameAutomationProvider::ChromeFrameAutomationProvider(Profile* profile)
+    : AutomationProvider(profile) {}
+
+void ChromeFrameAutomationProvider::OnMessageReceived(
+    const IPC::Message& message) {
+  if (IsValidMessage(message.type())) {
+    AutomationProvider::OnMessageReceived(message);
+  } else {
+    OnUnhandledMessage(message);
+  }
+}
+
+void ChromeFrameAutomationProvider::OnUnhandledMessage(
+    const IPC::Message& message) {
+  NOTREACHED() << __FUNCTION__
+               << " Unhandled message type: "
+               << message.type();
+}
+
+bool ChromeFrameAutomationProvider::IsValidMessage(uint32 type) {
+  bool is_valid_message = false;
+
+  switch (type) {
+    case AutomationMsg_CreateExternalTab::ID:
+    case AutomationMsg_ConnectExternalTab::ID:
+#if defined(OS_WIN)
+    case AutomationMsg_ProcessUnhandledAccelerator::ID:
+    case AutomationMsg_TabReposition::ID:
+    case AutomationMsg_ForwardContextMenuCommandToChrome::ID:
+#endif  // defined(OS_WIN)
+    case AutomationMsg_NavigateInExternalTab::ID:
+    case AutomationMsg_NavigateExternalTabAtIndex::ID:
+    case AutomationMsg_Find::ID:
+    case AutomationMsg_InstallExtension::ID:
+    case AutomationMsg_LoadExpandedExtension::ID:
+    case AutomationMsg_SetEnableExtensionAutomation::ID:
+    case AutomationMsg_SetInitialFocus::ID:
+    case AutomationMsg_SetPageFontSize::ID:
+    case AutomationMsg_SetProxyConfig::ID:
+    case AutomationMsg_Cut::ID:
+    case AutomationMsg_Copy::ID:
+    case AutomationMsg_Paste::ID:
+    case AutomationMsg_SelectAll::ID:
+    case AutomationMsg_ReloadAsync::ID:
+    case AutomationMsg_StopAsync::ID:
+    case AutomationMsg_PrintAsync::ID:
+    case AutomationMsg_HandleUnused::ID:
+    case AutomationMsg_HandleMessageFromExternalHost::ID:
+    case AutomationMsg_RequestStarted::ID:
+    case AutomationMsg_RequestData::ID:
+    case AutomationMsg_RequestEnd::ID: {
+      is_valid_message = true;
+      break;
+    }
+
+    default:
+      break;
+  }
+
+  return is_valid_message;
+}
+
diff --git a/chrome/browser/automation/chrome_frame_automation_provider.h b/chrome/browser/automation/chrome_frame_automation_provider.h
new file mode 100644
index 0000000..0ab6a8f
--- /dev/null
+++ b/chrome/browser/automation/chrome_frame_automation_provider.h
@@ -0,0 +1,41 @@
+// Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This implements a browser-side endpoint for ChromeFrame UI automation
+// activity. The client-side endpoint is implemented by
+// ChromeFrameAutomationClient.
+// The entire lifetime of this object should be contained within that of
+// the BrowserProcess
+
+#ifndef CHROME_BROWSER_AUTOMATION_CHROME_FRAME_AUTOMATION_PROVIDER_H_
+#define CHROME_BROWSER_AUTOMATION_CHROME_FRAME_AUTOMATION_PROVIDER_H_
+
+#include "base/basictypes.h"
+#include "base/scoped_ptr.h"
+#include "chrome/browser/automation/automation_provider.h"
+
+class Profile;
+
+// This class services automation IPC requests coming in from ChromeFrame
+// instances.
+class ChromeFrameAutomationProvider : public AutomationProvider {
+ public:
+  explicit ChromeFrameAutomationProvider(Profile* profile);
+
+  // IPC::Channel::Listener overrides.
+  virtual void OnMessageReceived(const IPC::Message& message);
+
+ protected:
+  // This function is called when we receive an invalid message type.
+  virtual void OnUnhandledMessage(const IPC::Message& message);
+
+  // Returns true if the message received is a valid chrome frame message.
+  bool IsValidMessage(uint32 type);
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(ChromeFrameAutomationProvider);
+};
+
+#endif  // CHROME_BROWSER_AUTOMATION_CHROME_FRAME_AUTOMATION_PROVIDER_H_
+
diff --git a/chrome/browser/browser_init.cc b/chrome/browser/browser_init.cc
index 1241f0a..8dee0dc 100644
--- a/chrome/browser/browser_init.cc
+++ b/chrome/browser/browser_init.cc
@@ -10,6 +10,7 @@
 #include "base/path_service.h"
 #include "base/sys_info.h"
 #include "chrome/browser/automation/automation_provider.h"
+#include "chrome/browser/automation/chrome_frame_automation_provider.h"
 #include "chrome/browser/browser_list.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/browser_window.h"
@@ -813,8 +814,14 @@ bool BrowserInit::ProcessCmdLineImpl(const CommandLine& command_line,
                  0);
     if (expected_tabs == 0)
       silent_launch = true;
-    CreateAutomationProvider<AutomationProvider>(automation_channel_id,
-                                                 profile, expected_tabs);
+
+    if (command_line.HasSwitch(switches::kChromeFrame)) {
+      CreateAutomationProvider<ChromeFrameAutomationProvider>(
+          automation_channel_id, profile, expected_tabs);
+    } else {
+      CreateAutomationProvider<AutomationProvider>(automation_channel_id,
+                                                   profile, expected_tabs);
+    }
   }
 
   if (command_line.HasSwitch(switches::kUseFlip)) {