Add is_main_frame parameter to ScriptCommandCallback

For compatibility, make all callbacks return false when is_main_frame is
false (current behavior).

Bug: 823285
Cq-Include-Trybots: luci.chromium.try:ios-simulator-full-configs;master.tryserver.chromium.mac:ios-simulator-cronet
Change-Id: I0bd4c7d1561df87f80c88b37e2342e4589a1fd24
Reviewed-on: https://chromium-review.googlesource.com/1105989Reviewed-by: John Wu <jzw@chromium.org>
Reviewed-by: Sylvain Defresne <sdefresne@chromium.org>
Reviewed-by: Mike Dougherty <michaeldo@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Commit-Queue: Olivier Robin <olivierrobin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569236}

components/translate/ios/browser/language_detection_controller.h

@@ -54,7 +54,8 @@ class LanguageDetectionController : public web::WebStateObserver {
   // |interacting| is true if the user is currently interacting with the page.
   bool OnTextCaptured(const base::DictionaryValue& value,
                       const GURL& url,
-                      bool interacting);
+                      bool interacting,
+                      bool is_main_frame);
 
   // Completion handler used to retrieve the text buffered by the
   // JsLanguageDetectionManager.

components/translate/ios/browser/language_detection_controller.mm

@@ -73,7 +73,12 @@ void LanguageDetectionController::StartLanguageDetection() {
 bool LanguageDetectionController::OnTextCaptured(
     const base::DictionaryValue& command,
     const GURL& url,
-    bool interacting) {
+    bool interacting,
+    bool is_main_frame) {
+  if (!is_main_frame) {
+    // Translate is only supported on main frame.
+    return false;
+  }
   std::string textCapturedCommand;
   if (!command.GetString("command", &textCapturedCommand) ||
       textCapturedCommand != "languageDetection.textCaptured" ||

components/translate/ios/browser/language_detection_controller_unittest.mm

@@ -85,7 +85,8 @@ TEST_F(LanguageDetectionControllerTest, OnTextCaptured) {
   command.SetInteger("captureTextTime", 10);
   command.SetString("htmlLang", kRootLanguage);
   command.SetString("httpContentLanguage", kContentLanguage);
-  controller()->OnTextCaptured(command, GURL("http://google.com"), false);
+  controller()->OnTextCaptured(command, GURL("http://google.com"),
+                               /*interacting=*/false, /*is_main_frame=*/true);
 
   const LanguageDetectionDetails* const details = this->details();
   EXPECT_NE(nullptr, details);
@@ -112,7 +113,8 @@ TEST_F(LanguageDetectionControllerTest, MissingHttpContentLanguage) {
   command.SetInteger("captureTextTime", 10);
   command.SetString("htmlLang", "");
   command.SetString("httpContentLanguage", "");
-  controller()->OnTextCaptured(command, GURL("http://google.com"), false);
+  controller()->OnTextCaptured(command, GURL("http://google.com"),
+                               /*interacting=*/false, /*is_main_frame=*/true);
 
   const LanguageDetectionDetails* const details = this->details();
   EXPECT_NE(nullptr, details);

components/translate/ios/browser/translate_controller.h

@@ -73,6 +73,8 @@ class TranslateController : public web::WebStateObserver {
  private:
   FRIEND_TEST_ALL_PREFIXES(TranslateControllerTest,
                            OnJavascriptCommandReceived);
+  FRIEND_TEST_ALL_PREFIXES(TranslateControllerTest,
+                           OnIFrameJavascriptCommandReceived);
   FRIEND_TEST_ALL_PREFIXES(TranslateControllerTest,
                            OnTranslateScriptReadyTimeoutCalled);
   FRIEND_TEST_ALL_PREFIXES(TranslateControllerTest,
@@ -83,7 +85,8 @@ class TranslateController : public web::WebStateObserver {
   // Called when a JavaScript command is received.
   bool OnJavascriptCommandReceived(const base::DictionaryValue& command,
                                    const GURL& url,
-                                   bool interacting);
+                                   bool interacting,
+                                   bool is_main_frame);
   // Methods to handle specific JavaScript commands.
   // Return false if the command is invalid.
   bool OnTranslateReady(const base::DictionaryValue& command);

components/translate/ios/browser/translate_controller.mm

@@ -74,7 +74,12 @@ void TranslateController::SetJsTranslateManagerForTesting(
 bool TranslateController::OnJavascriptCommandReceived(
     const base::DictionaryValue& command,
     const GURL& url,
-    bool interacting) {
+    bool interacting,
+    bool is_main_frame) {
+  if (!is_main_frame) {
+    // Translate is only supported on main frame.
+    return false;
+  }
   const base::Value* value = nullptr;
   command.Get("command", &value);
   if (!value) {

components/translate/ios/browser/translate_controller_unittest.mm

@@ -72,11 +72,24 @@ class TranslateControllerTest : public PlatformTest,
 TEST_F(TranslateControllerTest, OnJavascriptCommandReceived) {
   base::DictionaryValue malformed_command;
   EXPECT_FALSE(translate_controller_->OnJavascriptCommandReceived(
-      malformed_command, GURL("http://google.com"), false));
+      malformed_command, GURL("http://google.com"), /*interacting*/ false,
+      /*is_main_frame=*/true));
+}
+
+// Tests that OnJavascriptCommandReceived() returns false to iframe commands.
+TEST_F(TranslateControllerTest, OnIFrameJavascriptCommandReceived) {
+  base::DictionaryValue command;
+  command.SetString("command", "translate.ready");
+  command.SetBoolean("timeout", true);
+  command.SetDouble("loadTime", .0);
+  command.SetDouble("readyTime", .0);
+  EXPECT_FALSE(translate_controller_->OnJavascriptCommandReceived(
+      command, GURL("http://google.com"), /*interacting*/ false,
+      /*is_main_frame=*/false));
 }
 
 // Tests that OnTranslateScriptReady() is called when a timeout message is
-// recieved from the JS side.
+// received from the JS side.
 TEST_F(TranslateControllerTest, OnTranslateScriptReadyTimeoutCalled) {
   base::DictionaryValue command;
   command.SetString("command", "translate.ready");
@@ -84,7 +97,8 @@ TEST_F(TranslateControllerTest, OnTranslateScriptReadyTimeoutCalled) {
   command.SetDouble("loadTime", .0);
   command.SetDouble("readyTime", .0);
   EXPECT_TRUE(translate_controller_->OnJavascriptCommandReceived(
-      command, GURL("http://google.com"), false));
+      command, GURL("http://google.com"), /*interacting*/ false,
+      /*is_main_frame=*/true));
   EXPECT_TRUE(on_script_ready_called_);
   EXPECT_FALSE(on_translate_complete_called_);
   EXPECT_FALSE(success_);
@@ -103,7 +117,8 @@ TEST_F(TranslateControllerTest, OnTranslateScriptReadyCalled) {
   command.SetDouble("loadTime", some_load_time);
   command.SetDouble("readyTime", some_ready_time);
   EXPECT_TRUE(translate_controller_->OnJavascriptCommandReceived(
-      command, GURL("http://google.com"), false));
+      command, GURL("http://google.com"), /*interacting*/ false,
+      /*is_main_frame=*/true));
   EXPECT_TRUE(on_script_ready_called_);
   EXPECT_FALSE(on_translate_complete_called_);
   EXPECT_TRUE(success_);
@@ -124,7 +139,8 @@ TEST_F(TranslateControllerTest, TranslationSuccess) {
   command.SetString("originalPageLanguage", some_original_language);
   command.SetDouble("translationTime", some_translation_time);
   EXPECT_TRUE(translate_controller_->OnJavascriptCommandReceived(
-      command, GURL("http://google.com"), false));
+      command, GURL("http://google.com"), /*interacting*/ false,
+      /*is_main_frame=*/true));
   EXPECT_FALSE(on_script_ready_called_);
   EXPECT_TRUE(on_translate_complete_called_);
   EXPECT_TRUE(success_);
@@ -139,7 +155,8 @@ TEST_F(TranslateControllerTest, TranslationFailure) {
   command.SetString("command", "translate.status");
   command.SetBoolean("success", false);
   EXPECT_TRUE(translate_controller_->OnJavascriptCommandReceived(
-      command, GURL("http://google.com"), false));
+      command, GURL("http://google.com"), /*interacting*/ false,
+      /*is_main_frame=*/true));
   EXPECT_FALSE(on_script_ready_called_);
   EXPECT_TRUE(on_translate_complete_called_);
   EXPECT_FALSE(success_);

ios/chrome/browser/passwords/credential_manager.h

@@ -35,7 +35,8 @@ class CredentialManager {
   // PreventSilentAccess on CredentialManagerImpl.
   bool HandleScriptCommand(const base::DictionaryValue& json,
                            const GURL& origin_url,
-                           bool user_is_interacting);
+                           bool user_is_interacting,
+                           bool is_main_frame);
 
   // Passed as callback to CredentialManagerImpl::Get.
   void SendGetResponse(

ios/chrome/browser/passwords/credential_manager.mm

@@ -43,7 +43,12 @@ CredentialManager::~CredentialManager() {
 
 bool CredentialManager::HandleScriptCommand(const base::DictionaryValue& json,
                                             const GURL& origin_url,
-                                            bool user_is_interacting) {
+                                            bool user_is_interacting,
+                                            bool is_main_frame) {
+  if (!is_main_frame) {
+    // Credentials manager is only supported on main frame.
+    return false;
+  }
   double promise_id_double = -1;
   // |promiseId| field should be an integer value, but since JavaScript has only
   // one type for numbers (64-bit float), all numbers in the messages are sent

ios/chrome/browser/passwords/password_controller.mm

@@ -363,12 +363,16 @@ bool GetPageURLAndCheckTrustLevel(web::WebState* web_state, GURL* page_url) {
     }
 
     __weak PasswordController* weakSelf = self;
-    auto callback = base::BindRepeating(^bool(const base::DictionaryValue& JSON,
-                                              const GURL& originURL,
-                                              bool userIsInteracting) {
-      // |originURL| and |isInteracting| aren't used.
-      return [weakSelf handleScriptCommand:JSON];
-    });
+    auto callback = base::BindRepeating(
+        ^bool(const base::DictionaryValue& JSON, const GURL& originURL,
+              bool interacting, bool isMainFrame) {
+          if (!isMainFrame) {
+            // Passwords is only supported on main frame.
+            return false;
+          }
+          // |originURL| and |isInteracting| aren't used.
+          return [weakSelf handleScriptCommand:JSON];
+        });
     webState_->AddScriptCommandCallback(callback, kCommandPrefix);
   }
   return self;

ios/chrome/browser/translate/js_language_detection_manager_unittest.mm

@@ -272,8 +272,9 @@ class JsLanguageDetectionManagerDetectLanguageTest
   }
   // Called when "languageDetection" command is received.
   bool CommandReceived(const base::DictionaryValue& command,
-                       const GURL&,
-                       bool) {
+                       const GURL& url,
+                       bool interacting,
+                       bool is_main_frame) {
     commands_received_.push_back(command.CreateDeepCopy());
     return true;
   }

ios/chrome/browser/ui/contextual_search/contextual_search_controller.mm

@@ -439,7 +439,11 @@ dismissPaneWithJavascriptCompletionHandler:(ProceduralBlock)completionHandler
       __weak ContextualSearchController* weakSelf = self;
       auto callback = base::BindRepeating(
           ^bool(const base::DictionaryValue& JSON, const GURL& originURL,
-                bool userIsInteracting) {
+                bool userIsInteracting, bool isMainFrame) {
+            if (!isMainFrame) {
+              // Contextual search is only supported on main frame.
+              return false;
+            }
             ContextualSearchController* strongSelf = weakSelf;
             // |originURL| and |isInteracting| aren't used.
             return [strongSelf handleScriptCommand:JSON];

ios/chrome/browser/ui/payments/payment_request_manager.mm

@@ -325,12 +325,16 @@ struct PendingPaymentResponse {
 
   if (_activeWebState) {
     __weak PaymentRequestManager* weakSelf = self;
-    auto callback = base::BindRepeating(^bool(const base::DictionaryValue& JSON,
-                                              const GURL& originURL,
-                                              bool userIsInteracting) {
-      // |originURL| and |userIsInteracting| aren't used.
-      return [weakSelf handleScriptCommand:JSON];
-    });
+    auto callback = base::BindRepeating(
+        ^bool(const base::DictionaryValue& JSON, const GURL& originURL,
+              bool interacting, bool isMainFrame) {
+          if (!isMainFrame) {
+            // Payment request is only supported on main frame.
+            return false;
+          }
+          // |originURL| and |userIsInteracting| aren't used.
+          return [weakSelf handleScriptCommand:JSON];
+        });
     _activeWebState->AddObserver(_activeWebStateObserver.get());
     _activeWebState->AddScriptCommandCallback(callback, kCommandPrefix);
 

ios/chrome/browser/web/print_tab_helper.h

@@ -37,7 +37,8 @@ class PrintTabHelper : public web::WebStateObserver,
   bool OnPrintCommand(web::WebState* web_state,
                       const base::DictionaryValue& command,
                       const GURL& page_url,
-                      bool user_initiated);
+                      bool user_initiated,
+                      bool is_main_frame);
 
   __weak id<WebStatePrinter> printer_;
 

ios/chrome/browser/web/print_tab_helper.mm

@@ -54,7 +54,12 @@ void PrintTabHelper::WebStateDestroyed(web::WebState* web_state) {
 bool PrintTabHelper::OnPrintCommand(web::WebState* web_state,
                                     const base::DictionaryValue& command,
                                     const GURL& page_url,
-                                    bool user_initiated) {
+                                    bool interacting,
+                                    bool is_main_frame) {
+  if (!is_main_frame) {
+    // Print is only supported on main frame.
+    return false;
+  }
   DCHECK(web_state);
   [printer_ printWebState:web_state];
   return true;

ios/web/public/test/earl_grey/web_view_actions.mm

@@ -95,12 +95,12 @@ bool AddVerifierToElementWithId(web::WebState* web_state,
 
   // The callback doesn't care about any of the parameters, just whether it is
   // called or not.
-  auto callback = base::BindRepeating(
-      ^bool(const base::DictionaryValue& /* json */,
-            const GURL& /* origin_url */, bool /* user_is_interacting */) {
-        *verified = true;
-        return true;
-      });
+  auto callback = base::BindRepeating(^bool(
+      const base::DictionaryValue& /* json */, const GURL& /* origin_url */,
+      bool /* user_is_interacting */, bool /* is_main_frame */) {
+    *verified = true;
+    return true;
+  });
 
   static_cast<web::WebStateImpl*>(web_state)->AddScriptCommandCallback(
       callback, kCallbackPrefix);

ios/web/public/web_state/web_state.h

@@ -241,9 +241,11 @@ class WebState : public base::SupportsUserData {
   // In particular the callback must return false if the command is unexpected
   // or ill-formatted.
   // The first parameter is the content of the command, the second parameter is
-  // the URL of the page, and the third parameter is a bool indicating if the
-  // user is currently interacting with the page.
-  typedef base::Callback<bool(const base::DictionaryValue&, const GURL&, bool)>
+  // the URL of the page, the third parameter is a bool indicating if the
+  // user is currently interacting with the page, the fourth parameter indicates
+  // if the message was sent from the main frame.
+  typedef base::RepeatingCallback<
+      bool(const base::DictionaryValue&, const GURL&, bool, bool)>
       ScriptCommandCallback;
 
   // Registers a callback that will be called when a command matching

ios/web/web_state/ui/crw_web_controller.mm

@@ -2322,8 +2322,8 @@ registerLoadRequestForURL:(const GURL&)requestURL
 
   SEL handler = [self selectorToHandleJavaScriptCommand:command];
   if (!handler) {
-    if (isMainFrame && self.webStateImpl->OnScriptCommandReceived(
-                           command, *message, originURL, userIsInteracting)) {
+    if (self.webStateImpl->OnScriptCommandReceived(
+            command, *message, originURL, userIsInteracting, isMainFrame)) {
       return YES;
     }
     // Message was either unexpected or not correctly handled.
@@ -2438,6 +2438,7 @@ registerLoadRequestForURL:(const GURL&)requestURL
 
 - (BOOL)handleChromeSendMessage:(base::DictionaryValue*)message
                         context:(NSDictionary*)context {
+  // Chrome message are only handled if sent from the main frame.
   if (![context[kIsMainFrame] boolValue])
     return NO;
   if (_webStateImpl->HasWebUI()) {
@@ -2454,7 +2455,8 @@ registerLoadRequestForURL:(const GURL&)requestURL
         return NO;
       }
       _webStateImpl->OnScriptCommandReceived(
-          messageContent, *message, currentURL, context[kUserIsInteractingKey]);
+          messageContent, *message, currentURL, context[kUserIsInteractingKey],
+          [context[kIsMainFrame] boolValue]);
       _webStateImpl->ProcessWebUIMessage(currentURL, messageContent,
                                          *arguments);
       return YES;

ios/web/web_state/web_state_impl.h

@@ -102,7 +102,8 @@ class WebStateImpl : public WebState, public NavigationManagerDelegate {
   bool OnScriptCommandReceived(const std::string& command,
                                const base::DictionaryValue& value,
                                const GURL& url,
-                               bool user_is_interacting);
+                               bool user_is_interacting,
+                               bool is_main_frame);
 
   void SetIsLoading(bool is_loading);
 

ios/web/web_state/web_state_impl.mm

@@ -199,7 +199,8 @@ void WebStateImpl::OnRenderProcessGone() {
 bool WebStateImpl::OnScriptCommandReceived(const std::string& command,
                                            const base::DictionaryValue& value,
                                            const GURL& url,
-                                           bool user_is_interacting) {
+                                           bool user_is_interacting,
+                                           bool is_main_frame) {
   size_t dot_position = command.find_first_of('.');
   if (dot_position == 0 || dot_position == std::string::npos)
     return false;
@@ -209,7 +210,7 @@ bool WebStateImpl::OnScriptCommandReceived(const std::string& command,
   if (it == script_command_callbacks_.end())
     return false;
 
-  return it->second.Run(value, url, user_is_interacting);
+  return it->second.Run(value, url, user_is_interacting, is_main_frame);
 }
 
 void WebStateImpl::SetIsLoading(bool is_loading) {

ios/web/web_state/web_state_impl_unittest.mm

@@ -173,12 +173,15 @@ bool HandleScriptCommand(bool* is_called,
                          bool should_handle,
                          base::DictionaryValue* expected_value,
                          const GURL& expected_url,
+                         bool expected_is_main_frame,
                          const base::DictionaryValue& value,
                          const GURL& url,
-                         bool user_is_interacting) {
+                         bool user_is_interacting,
+                         bool is_main_frame) {
   *is_called = true;
   EXPECT_TRUE(expected_value->Equals(&value));
   EXPECT_EQ(expected_url, url);
+  EXPECT_EQ(expected_is_main_frame, is_main_frame);
   return should_handle;
 }
 
@@ -789,7 +792,7 @@ TEST_F(WebStateImplTest, PolicyDeciderTest) {
 
 // Tests that script command callbacks are called correctly.
 TEST_F(WebStateImplTest, ScriptCommand) {
-  // Set up two script command callbacks.
+  // Set up three script command callbacks.
   const std::string kPrefix1("prefix1");
   const std::string kCommand1("prefix1.command1");
   base::DictionaryValue value_1;
@@ -797,7 +800,9 @@ TEST_F(WebStateImplTest, ScriptCommand) {
   const GURL kUrl1("http://foo");
   bool is_called_1 = false;
   web_state_->AddScriptCommandCallback(
-      base::Bind(&HandleScriptCommand, &is_called_1, true, &value_1, kUrl1),
+      base::BindRepeating(&HandleScriptCommand, &is_called_1,
+                          /*should_handle*/ true, &value_1, kUrl1,
+                          /*expected_is_main_frame*/ true),
       kPrefix1);
 
   const std::string kPrefix2("prefix2");
@@ -807,42 +812,76 @@ TEST_F(WebStateImplTest, ScriptCommand) {
   const GURL kUrl2("http://bar");
   bool is_called_2 = false;
   web_state_->AddScriptCommandCallback(
-      base::Bind(&HandleScriptCommand, &is_called_2, false, &value_2, kUrl2),
+      base::BindRepeating(&HandleScriptCommand, &is_called_2,
+                          /*should_handle*/ false, &value_2, kUrl2,
+                          /*expected_is_main_frame*/ true),
       kPrefix2);
 
+  const std::string kPrefix3("prefix3");
+  const std::string kCommand3("prefix3.command3");
+  base::DictionaryValue value_3;
+  value_3.SetString("e", "f");
+  const GURL kUrl3("http://iframe");
+  bool is_called_3 = false;
+  web_state_->AddScriptCommandCallback(
+      base::BindRepeating(&HandleScriptCommand, &is_called_3,
+                          /*should_handle*/ true, &value_3, kUrl3,
+                          /*expected_is_main_frame*/ false),
+      kPrefix3);
+
   // Check that a irrelevant or invalid command does not trigger the callbacks.
-  EXPECT_FALSE(
-      web_state_->OnScriptCommandReceived("wohoo.blah", value_1, kUrl1, false));
+  EXPECT_FALSE(web_state_->OnScriptCommandReceived(
+      "wohoo.blah", value_1, kUrl1,
+      /*user_is_interacting*/ false, /*is_main_frame*/ true));
   EXPECT_FALSE(is_called_1);
   EXPECT_FALSE(is_called_2);
+  EXPECT_FALSE(is_called_3);
 
   EXPECT_FALSE(web_state_->OnScriptCommandReceived(
-      "prefix1ButMissingDot", value_1, kUrl1, false));
+      "prefix1ButMissingDot", value_1, kUrl1, /*user_is_interacting*/ false,
+      /*is_main_frame*/ true));
   EXPECT_FALSE(is_called_1);
   EXPECT_FALSE(is_called_2);
+  EXPECT_FALSE(is_called_3);
 
   // Check that only the callback matching the prefix is called, with the
   // expected parameters and return value;
-  EXPECT_TRUE(
-      web_state_->OnScriptCommandReceived(kCommand1, value_1, kUrl1, false));
+  EXPECT_TRUE(web_state_->OnScriptCommandReceived(kCommand1, value_1, kUrl1,
+                                                  /*user_is_interacting*/ false,
+                                                  /*is_main_frame*/ true));
   EXPECT_TRUE(is_called_1);
   EXPECT_FALSE(is_called_2);
+  EXPECT_FALSE(is_called_3);
+  is_called_1 = false;
+
+  // Check that sending message from iframe sets |is_main_frame| to false.
+  EXPECT_TRUE(web_state_->OnScriptCommandReceived(kCommand3, value_3, kUrl3,
+                                                  /*user_is_interacting*/ false,
+                                                  /*is_main_frame*/ false));
+  EXPECT_FALSE(is_called_1);
+  EXPECT_FALSE(is_called_2);
+  EXPECT_TRUE(is_called_3);
+  is_called_3 = false;
 
   // Remove the callback and check it is no longer called.
-  is_called_1 = false;
   web_state_->RemoveScriptCommandCallback(kPrefix1);
-  EXPECT_FALSE(
-      web_state_->OnScriptCommandReceived(kCommand1, value_1, kUrl1, false));
+  EXPECT_FALSE(web_state_->OnScriptCommandReceived(
+      kCommand1, value_1, kUrl1,
+      /*user_is_interacting*/ false, /*is_main_frame*/ true));
   EXPECT_FALSE(is_called_1);
   EXPECT_FALSE(is_called_2);
+  EXPECT_FALSE(is_called_3);
 
   // Check that a false return value is forwarded correctly.
-  EXPECT_FALSE(
-      web_state_->OnScriptCommandReceived(kCommand2, value_2, kUrl2, false));
+  EXPECT_FALSE(web_state_->OnScriptCommandReceived(
+      kCommand2, value_2, kUrl2,
+      /*user_is_interacting*/ false, /*is_main_frame*/ true));
   EXPECT_FALSE(is_called_1);
   EXPECT_TRUE(is_called_2);
+  EXPECT_FALSE(is_called_3);
 
   web_state_->RemoveScriptCommandCallback(kPrefix2);
+  web_state_->RemoveScriptCommandCallback(kPrefix3);
 }
 
 // Tests that WebState::CreateParams::created_with_opener is translated to

ios/web/web_state/web_state_unittest.mm

@@ -87,8 +87,9 @@ TEST_F(WebStateTest, LoadingProgress) {
 TEST_F(WebStateTest, OverridingWebKitObject) {
   // Add a script command handler.
   __block bool message_received = false;
-  const web::WebState::ScriptCommandCallback callback = base::BindRepeating(
-      ^bool(const base::DictionaryValue&, const GURL&, bool) {
+  const web::WebState::ScriptCommandCallback callback =
+      base::BindRepeating(^bool(const base::DictionaryValue&, const GURL&,
+                                /*interacted*/ bool, /*is_main_frame*/ bool) {
         message_received = true;
         return true;
       });
@@ -173,6 +174,78 @@ TEST_F(WebStateTest, Snapshot) {
   });
 }
 
+// Tests that message sent from main frame triggers the ScriptCommandCallback
+// with |is_main_frame| = true.
+TEST_F(WebStateTest, MessageFromMainFrame) {
+  // Add a script command handler.
+  __block bool message_received = false;
+  __block bool message_from_main_frame = false;
+  __block base::Value message_value;
+  const web::WebState::ScriptCommandCallback callback =
+      base::BindRepeating(^bool(const base::DictionaryValue& value, const GURL&,
+                                bool user_interacted, bool is_main_frame) {
+        message_received = true;
+        message_from_main_frame = is_main_frame;
+        message_value = value.Clone();
+        return true;
+      });
+  web_state()->AddScriptCommandCallback(callback, "test");
+
+  ASSERT_TRUE(LoadHtml(
+      "<script>"
+      "  __gCrWeb.message.invokeOnHost({'command': 'test.from-main-frame'});"
+      "</script>"));
+
+  WaitForCondition(^{
+    return message_received;
+  });
+  web_state()->RemoveScriptCommandCallback("test");
+  EXPECT_TRUE(message_from_main_frame);
+  EXPECT_TRUE(message_value.is_dict());
+  EXPECT_EQ(message_value.DictSize(), size_t(1));
+  base::Value* command = message_value.FindKey("command");
+  EXPECT_NE(command, nullptr);
+  EXPECT_TRUE(command->is_string());
+  EXPECT_EQ(command->GetString(), "test.from-main-frame");
+}
+
+// Tests that message sent from main frame triggers the ScriptCommandCallback
+// with |is_main_frame| = false.
+TEST_F(WebStateTest, MessageFromIFrame) {
+  // Add a script command handler.
+  __block bool message_received = false;
+  __block bool message_from_main_frame = false;
+  __block base::Value message_value;
+  const web::WebState::ScriptCommandCallback callback =
+      base::BindRepeating(^bool(const base::DictionaryValue& value, const GURL&,
+                                bool user_interacted, bool is_main_frame) {
+        message_received = true;
+        message_from_main_frame = is_main_frame;
+        message_value = value.Clone();
+        return true;
+      });
+  web_state()->AddScriptCommandCallback(callback, "test");
+
+  ASSERT_TRUE(LoadHtml(
+      "<iframe srcdoc='"
+      "<script>"
+      "  __gCrWeb.message.invokeOnHost({\"command\": \"test.from-iframe\"});"
+      "</script>"
+      "'/>"));
+
+  WaitForCondition(^{
+    return message_received;
+  });
+  web_state()->RemoveScriptCommandCallback("test");
+  EXPECT_FALSE(message_from_main_frame);
+  EXPECT_TRUE(message_value.is_dict());
+  EXPECT_EQ(message_value.DictSize(), size_t(1));
+  base::Value* command = message_value.FindKey("command");
+  EXPECT_NE(command, nullptr);
+  EXPECT_TRUE(command->is_string());
+  EXPECT_EQ(command->GetString(), "test.from-iframe");
+}
+
 // Tests that the web state has an opener after calling SetHasOpener().
 TEST_F(WebStateTest, SetHasOpener) {
   ASSERT_FALSE(web_state()->HasOpener());

ios/web/webui/crw_web_ui_manager.mm

@@ -75,10 +75,14 @@ const char kScriptCommandPrefix[] = "webui";
 
     __weak CRWWebUIManager* weakSelf = self;
     _webState->AddScriptCommandCallback(
-        base::BindRepeating(
-            ^bool(const base::DictionaryValue& message, const GURL&, bool) {
-              return [weakSelf handleWebUIJSMessage:message];
-            }),
+        base::BindRepeating(^bool(const base::DictionaryValue& message,
+                                  const GURL&, bool, bool isMainFrame) {
+          if (!isMainFrame) {
+            // WebUI only supports main frame.
+            return false;
+          }
+          return [weakSelf handleWebUIJSMessage:message];
+        }),
         kScriptCommandPrefix);
   }
   return self;

ios/web_view/internal/cwv_web_view.mm

@@ -433,13 +433,15 @@ static NSString* gUserAgentProduct = nil;
   CWVWebView* __weak weakSelf = self;
   const web::WebState::ScriptCommandCallback callback = base::BindRepeating(
       ^bool(const base::DictionaryValue& content, const GURL& mainDocumentURL,
-            bool userInteracting) {
+            bool userInteracting, bool isMainFrame) {
         NSDictionary* nsContent = NSDictionaryFromDictionaryValue(content);
         CWVScriptCommand* command = [[CWVScriptCommand alloc]
             initWithContent:nsContent
             mainDocumentURL:net::NSURLWithGURL(mainDocumentURL)
             userInteracting:userInteracting];
-        return [handler webView:weakSelf handleScriptCommand:command];
+        return [handler webView:weakSelf
+            handleScriptCommand:command
+                  fromMainFrame:isMainFrame];
       });
 
   std::string stdCommandPrefix = base::SysNSStringToUTF8(commandPrefix);

ios/web_view/public/cwv_script_command.h

@@ -37,7 +37,8 @@ CWV_EXPORT
 @protocol CWVScriptCommandHandler<NSObject>
 
 - (BOOL)webView:(CWVWebView*)webView
-    handleScriptCommand:(CWVScriptCommand*)command;
+    handleScriptCommand:(CWVScriptCommand*)command
+          fromMainFrame:(BOOL)fromMainFrame;
 
 @end
 

ios/web_view/shell/shell_view_controller.m

@@ -512,7 +512,8 @@ NSString* const kWebViewShellJavaScriptDialogTextFieldAccessibiltyIdentifier =
 #pragma mark CWVScriptCommandHandler
 
 - (BOOL)webView:(CWVWebView*)webView
-    handleScriptCommand:(nonnull CWVScriptCommand*)command {
+    handleScriptCommand:(nonnull CWVScriptCommand*)command
+          fromMainFrame:(BOOL)fromMainFrame {
   NSLog(@"%@ command.content=%@", NSStringFromSelector(_cmd), command.content);
   return YES;
 }

ios/web_view/test/web_view_script_command_inttest.mm

@@ -21,7 +21,8 @@
 @property(nonatomic) CWVScriptCommand* lastReceivedCommand;
 
 - (BOOL)webView:(CWVWebView*)webView
-    handleScriptCommand:(CWVScriptCommand*)command;
+    handleScriptCommand:(CWVScriptCommand*)command
+          fromMainFrame:(BOOL)fromMainFrame;
 
 @end
 
@@ -30,7 +31,8 @@
 @synthesize lastReceivedCommand = _lastReceivedCommand;
 
 - (BOOL)webView:(CWVWebView*)webView
-    handleScriptCommand:(CWVScriptCommand*)command {
+    handleScriptCommand:(CWVScriptCommand*)command
+          fromMainFrame:(BOOL)fromMainFrame {
   self.lastReceivedCommand = command;
   return YES;
 }