From 9d784c291714b703b16185e69860a3797de85b6c Mon Sep 17 00:00:00 2001
From: Henrique Nakashima <hnakashima@chromium.org>
Date: Thu, 20 Sep 2018 21:32:36 +0000
Subject: Make potentially dangerous Actions require a user click.

URI and SubmitForm actions are only handled if the event was
ButtonUp or ButtonDown.

Bug: 851821
Change-Id: If6eb0ff44f6d62ac6df50b552c0bdc582885ab5d
Reviewed-on: https://pdfium-review.googlesource.com/42731
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
---
 fpdfsdk/cpdfsdk_actionhandler.cpp | 31 +++++++++++++++++++------------
 1 file changed, 19 insertions(+), 12 deletions(-)

(limited to 'fpdfsdk/cpdfsdk_actionhandler.cpp')

diff --git a/fpdfsdk/cpdfsdk_actionhandler.cpp b/fpdfsdk/cpdfsdk_actionhandler.cpp
index f951bfb9fe..f98585f2a1 100644
--- a/fpdfsdk/cpdfsdk_actionhandler.cpp
+++ b/fpdfsdk/cpdfsdk_actionhandler.cpp
@@ -82,7 +82,7 @@ bool CPDFSDK_ActionHandler::DoAction_BookMark(
     CPDF_AAction::AActionType type,
     CPDFSDK_FormFillEnvironment* pFormFillEnv) {
   std::set<const CPDF_Dictionary*> visited;
-  return ExecuteBookMark(action, pFormFillEnv, pBookMark, &visited);
+  return ExecuteBookMark(action, type, pFormFillEnv, pBookMark, &visited);
 }
 
 bool CPDFSDK_ActionHandler::DoAction_Screen(
@@ -96,9 +96,10 @@ bool CPDFSDK_ActionHandler::DoAction_Screen(
 
 bool CPDFSDK_ActionHandler::DoAction_Link(
     const CPDF_Action& action,
+    CPDF_AAction::AActionType type,
     CPDFSDK_FormFillEnvironment* pFormFillEnv) {
   std::set<const CPDF_Dictionary*> visited;
-  return ExecuteLinkAction(action, pFormFillEnv, &visited);
+  return ExecuteLinkAction(action, type, pFormFillEnv, &visited);
 }
 
 bool CPDFSDK_ActionHandler::DoAction_Field(
@@ -130,7 +131,8 @@ bool CPDFSDK_ActionHandler::ExecuteDocumentOpenAction(
         RunDocumentOpenJavaScript(pFormFillEnv, L"", swJS);
     }
   } else {
-    DoAction_NoJs(action, pFormFillEnv);
+    DoAction_NoJs(action, CPDF_AAction::AActionType::DocumentOpen,
+                  pFormFillEnv);
   }
 
   for (int32_t i = 0, sz = action.GetSubActionsCount(); i < sz; i++) {
@@ -144,6 +146,7 @@ bool CPDFSDK_ActionHandler::ExecuteDocumentOpenAction(
 
 bool CPDFSDK_ActionHandler::ExecuteLinkAction(
     const CPDF_Action& action,
+    CPDF_AAction::AActionType eType,
     CPDFSDK_FormFillEnvironment* pFormFillEnv,
     std::set<const CPDF_Dictionary*>* visited) {
   const CPDF_Dictionary* pDict = action.GetDict();
@@ -159,12 +162,12 @@ bool CPDFSDK_ActionHandler::ExecuteLinkAction(
                          context->OnLink_MouseUp(pFormFillEnv);
                        });
   } else {
-    DoAction_NoJs(action, pFormFillEnv);
+    DoAction_NoJs(action, eType, pFormFillEnv);
   }
 
   for (int32_t i = 0, sz = action.GetSubActionsCount(); i < sz; i++) {
     CPDF_Action subaction = action.GetSubAction(i);
-    if (!ExecuteLinkAction(subaction, pFormFillEnv, visited))
+    if (!ExecuteLinkAction(subaction, eType, pFormFillEnv, visited))
       return false;
   }
 
@@ -190,7 +193,7 @@ bool CPDFSDK_ActionHandler::ExecuteDocumentPageAction(
         RunDocumentPageJavaScript(pFormFillEnv, type, swJS);
     }
   } else {
-    DoAction_NoJs(action, pFormFillEnv);
+    DoAction_NoJs(action, type, pFormFillEnv);
   }
 
   ASSERT(pFormFillEnv);
@@ -238,7 +241,7 @@ bool CPDFSDK_ActionHandler::ExecuteFieldAction(
       }
     }
   } else {
-    DoAction_NoJs(action, pFormFillEnv);
+    DoAction_NoJs(action, type, pFormFillEnv);
   }
 
   for (int32_t i = 0, sz = action.GetSubActionsCount(); i < sz; i++) {
@@ -267,7 +270,7 @@ bool CPDFSDK_ActionHandler::ExecuteScreenAction(
   if (action.GetType() == CPDF_Action::JavaScript)
     RunScriptForAction(action, pFormFillEnv, [](IJS_EventContext*) {});
   else
-    DoAction_NoJs(action, pFormFillEnv);
+    DoAction_NoJs(action, type, pFormFillEnv);
 
   for (int32_t i = 0, sz = action.GetSubActionsCount(); i < sz; i++) {
     CPDF_Action subaction = action.GetSubAction(i);
@@ -280,6 +283,7 @@ bool CPDFSDK_ActionHandler::ExecuteScreenAction(
 
 bool CPDFSDK_ActionHandler::ExecuteBookMark(
     const CPDF_Action& action,
+    CPDF_AAction::AActionType type,
     CPDFSDK_FormFillEnvironment* pFormFillEnv,
     CPDF_Bookmark* pBookmark,
     std::set<const CPDF_Dictionary*>* visited) {
@@ -296,12 +300,12 @@ bool CPDFSDK_ActionHandler::ExecuteBookMark(
                          context->OnBookmark_MouseUp(pBookmark);
                        });
   } else {
-    DoAction_NoJs(action, pFormFillEnv);
+    DoAction_NoJs(action, type, pFormFillEnv);
   }
 
   for (int32_t i = 0, sz = action.GetSubActionsCount(); i < sz; i++) {
     CPDF_Action subaction = action.GetSubAction(i);
-    if (!ExecuteBookMark(subaction, pFormFillEnv, pBookmark, visited))
+    if (!ExecuteBookMark(subaction, type, pFormFillEnv, pBookmark, visited))
       return false;
   }
 
@@ -310,6 +314,7 @@ bool CPDFSDK_ActionHandler::ExecuteBookMark(
 
 void CPDFSDK_ActionHandler::DoAction_NoJs(
     const CPDF_Action& action,
+    CPDF_AAction::AActionType type,
     CPDFSDK_FormFillEnvironment* pFormFillEnv) {
   ASSERT(pFormFillEnv);
 
@@ -318,7 +323,8 @@ void CPDFSDK_ActionHandler::DoAction_NoJs(
       DoAction_GoTo(pFormFillEnv, action);
       break;
     case CPDF_Action::URI:
-      DoAction_URI(pFormFillEnv, action);
+      if (CPDF_AAction::IsUserClick(type))
+        DoAction_URI(pFormFillEnv, action);
       break;
     case CPDF_Action::Hide:
       DoAction_Hide(action, pFormFillEnv);
@@ -327,7 +333,8 @@ void CPDFSDK_ActionHandler::DoAction_NoJs(
       DoAction_Named(pFormFillEnv, action);
       break;
     case CPDF_Action::SubmitForm:
-      DoAction_SubmitForm(action, pFormFillEnv);
+      if (CPDF_AAction::IsUserClick(type))
+        DoAction_SubmitForm(action, pFormFillEnv);
       break;
     case CPDF_Action::ResetForm:
       DoAction_ResetForm(action, pFormFillEnv);
-- 
cgit v1.2.3