Only allow multiple action buttons in Custom Tabs for trusted intents.

Also, ignore any actions buttons beyond the first two (instead of
silently moving them to the secondary toolbar) if they are explicitly
meant to go to the primary toolbar.

Bug: 810854
Change-Id: I97d4730c884209848096e79e5f2bc414e051a8b1
Reviewed-on: https://chromium-review.googlesource.com/919087Reviewed-by: Yusuf Ozuysal <yusufo@chromium.org>
Commit-Queue: Bernhard Bauer <bauerb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#537277}

chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomButtonParams.java

@@ -154,9 +154,11 @@ public class CustomButtonParams {
     /**
      * Parses a list of {@link CustomButtonParams} from the intent sent by clients.
      * @param intent The intent sent by the client.
+     * @param isTrustedIntent whether the intent is trusted.
      * @return A list of parsed {@link CustomButtonParams}. Return an empty list if input is invalid
      */
-    public static List<CustomButtonParams> fromIntent(Context context, Intent intent) {
+    public static List<CustomButtonParams> fromIntent(
+            Context context, Intent intent, boolean isTrustedIntent) {
         List<CustomButtonParams> paramsList = new ArrayList<>(1);
         if (intent == null) return paramsList;
 

chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java

@@ -92,8 +92,8 @@ public class CustomTabIntentDataProvider extends BrowserSessionDataProvider {
 
     /**
      * Indicates the source where the Custom Tab is launched. This is only used for
-     * WebApp/WebAPK/TrustedWebActivity. The value is defined as {@link
-     * ActivityType#WebappActivity}.
+     * WebApp/WebAPK/TrustedWebActivity. The value is defined as
+     * {@link WebappActivity.ActivityType#WebappActivity}.
      */
     public static final String EXTRA_BROWSER_LAUNCH_SOURCE =
             "org.chromium.chrome.browser.customtabs.EXTRA_BROWSER_LAUNCH_SOURCE";
@@ -251,13 +251,16 @@ public class CustomTabIntentDataProvider extends BrowserSessionDataProvider {
      * {@link #mBottombarButtons} and {@link #mToolbarButtons}.
      */
     private void retrieveCustomButtons(Intent intent, Context context) {
-        mCustomButtonParams = CustomButtonParams.fromIntent(context, intent);
+        mCustomButtonParams = CustomButtonParams.fromIntent(context, intent, isTrustedIntent());
         if (mCustomButtonParams != null) {
             for (CustomButtonParams params : mCustomButtonParams) {
-                if (params.showOnToolbar() && mToolbarButtons.size() < MAX_CUSTOM_TOOLBAR_ITEMS) {
+                if (!params.showOnToolbar()) {
+                    mBottombarButtons.add(params);
+                } else if (mToolbarButtons.size() < MAX_CUSTOM_TOOLBAR_ITEMS) {
                     mToolbarButtons.add(params);
                 } else {
-                    mBottombarButtons.add(params);
+                    Log.w(TAG, "Only %d items are allowed in the toolbar",
+                            MAX_CUSTOM_TOOLBAR_ITEMS);
                 }
             }
         }