Do not execute global commands on non-root targets

Bug: 1116444
Change-Id: Ic50dfc144f8024870131e7586b9dce2dff591e42
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2419712Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/master@{#808635}

content/browser/devtools/protocol/page_handler.cc

@@ -78,6 +78,8 @@ constexpr int kDefaultScreenshotQuality = 80;
 constexpr int kFrameRetryDelayMs = 100;
 constexpr int kCaptureRetryLimit = 2;
 constexpr int kMaxScreencastFramesInFlight = 2;
+constexpr char kCommandIsOnlyAvailableAtTopTarget[] =
+    "Command can only be executed on top-level targets";
 
 Binary EncodeImage(const gfx::Image& image,
                    const std::string& format,
@@ -168,6 +170,17 @@ void GetMetadataFromFrame(const media::VideoFrame& frame,
   *top_controls_visible_height = *frame.metadata()->top_controls_visible_height;
 }
 
+template <typename ProtocolCallback>
+bool CanExecuteGlobalCommands(
+    RenderFrameHost* host,
+    const std::unique_ptr<ProtocolCallback>& callback) {
+  if (!host || !host->GetParent())
+    return true;
+  callback->sendFailure(
+      Response::ServerError(kCommandIsOnlyAvailableAtTopTarget));
+  return false;
+}
+
 }  // namespace
 
 PageHandler::PageHandler(EmulationHandler* emulation_handler,
@@ -653,6 +666,8 @@ Response PageHandler::ResetNavigationHistory() {
 void PageHandler::CaptureSnapshot(
     Maybe<std::string> format,
     std::unique_ptr<CaptureSnapshotCallback> callback) {
+  if (!CanExecuteGlobalCommands(host_, callback))
+    return;
   std::string snapshot_format = format.fromMaybe(kMhtml);
   if (snapshot_format != kMhtml) {
     callback->sendFailure(Response::ServerError("Unsupported snapshot format"));
@@ -672,6 +687,8 @@ void PageHandler::CaptureScreenshot(
     callback->sendFailure(Response::InternalError());
     return;
   }
+  if (!CanExecuteGlobalCommands(host_, callback))
+    return;
   if (clip.isJust()) {
     if (clip.fromJust()->GetWidth() == 0) {
       callback->sendFailure(
@@ -928,6 +945,8 @@ Response PageHandler::SetDownloadBehavior(const std::string& behavior,
       host_ ? host_->GetProcess()->GetBrowserContext() : nullptr;
   if (!browser_context)
     return Response::ServerError("Could not fetch browser context");
+  if (host_ && host_->GetParent())
+    return Response::ServerError(kCommandIsOnlyAvailableAtTopTarget);
   return browser_handler_->DoSetDownloadBehavior(behavior, browser_context,
                                                  std::move(download_path));
 }
@@ -938,6 +957,8 @@ void PageHandler::GetAppManifest(
     callback->sendFailure(Response::ServerError("Cannot retrieve manifest"));
     return;
   }
+  if (!CanExecuteGlobalCommands(host_, callback))
+    return;
   ManifestManagerHost::GetOrCreateForCurrentDocument(host_->GetMainFrame())
       ->RequestManifestDebugInfo(base::BindOnce(&PageHandler::GotManifest,
                                                 weak_factory_.GetWeakPtr(),

third_party/blink/web_tests/http/tests/inspector-protocol/main-target-commands-expected.txt

+Tests for certain commands are only available at the top-level target
+Page.captureSnapshot: Command can only be executed on top-level targets
+Page.captureScreenshot: Command can only be executed on top-level targets
+Page.startScreencast: Internal error
+Page.setDownloadBehavior: Command can only be executed on top-level targets
+

third_party/blink/web_tests/http/tests/inspector-protocol/main-target-commands.js

+(async function(testRunner) {
+    const {session, dp} = await testRunner.startBlank('Tests for certain commands are only available at the top-level target');
+
+    await dp.Page.enable();
+    await dp.Target.setAutoAttach({autoAttach: true, waitForDebuggerOnStart: true, flatten: true});
+    dp.Page.navigate({url: testRunner.url('./resources/site_per_process_main.html')});
+
+    const {params} = await dp.Target.onceAttachedToTarget();
+    const childSession = session.createChild(params.sessionId);
+    const dp2 = childSession.protocol;
+    dp2.Page.enable();
+
+    async function checkCommand(method, params) {
+      const result = await childSession.sendCommand(method, params);
+
+      testRunner.log(`${method}: ` + (result.error ? result.error.message : 'FAIL: no error'));
+    }
+
+    await checkCommand('Page.captureSnapshot', {});
+    await checkCommand('Page.captureScreenshot', {});
+    await checkCommand('Page.startScreencast', {});
+    await checkCommand('Page.setDownloadBehavior', { behavior: 'deny'});
+
+    testRunner.completeTest();
+  })
\ No newline at end of file