From a145ee4668e6ce091552fec304e5cad0f9606322 Mon Sep 17 00:00:00 2001
From: Tom Anderson <thomasanderson@chromium.org>
Date: Thu, 28 May 2026 06:10:08 -0700
Subject: [PATCH] Ozone: Add process-global drag-and-drop state guard

In Linux/Ozone platforms (e.g. Ozone/X11), the drag-and-drop
implementation previously lacked a process-global guard to prevent
concurrent or re-entrant drag-and-drop operations across different
top-level windows. Instead, it relied solely on instance-scoped DCHECKs.
This allowed a compromised renderer to asynchronously initiate a second
drag operation via IPC while a legitimate drag-and-drop was in flight,
stealing ownership of the global XdndSelection atom and hijacking the
event dispatcher.

This CL implements a process-global drag guard `g_is_dragging` and a
`base::AutoReset<bool>` scope in `DesktopDragDropClientOzone::StartDragAndDrop`
to reject concurrent/re-entrant drag attempts with `DragOperation::kNone`.
This aligns the Ozone platform with the existing Windows implementation.

Fixed: 517103584
Change-Id: I9673e57ec2aaae2f36cc20f4223d58240264098c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7879779
Commit-Queue: Allen Bauer <kylixrd@chromium.org>
Auto-Submit: Thomas Anderson <thomasanderson@chromium.org>
Reviewed-by: Allen Bauer <kylixrd@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1637643}
---

diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc
index e5a7bd2f..d341b848 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone.cc
@@ -7,6 +7,7 @@
 #include <memory>
 #include <utility>
 
+#include "base/auto_reset.h"
 #include "base/functional/bind.h"
 #include "base/functional/callback_helpers.h"
 #include "base/scoped_observation.h"
@@ -30,6 +31,13 @@
 
 using ::ui::mojom::DragOperation;
 
+// Process-global re-entrancy guard. DesktopDragDropClientOzone is per
+// top-level window, so the per-instance drag_context_ check below does not
+// catch a second window starting a drag while the first window's nested
+// RunMoveLoop is pumping tasks. On X11 that lets a compromised renderer steal
+// the global XdndSelection mid-drag. Mirrors desktop_drag_drop_client_win.cc.
+bool g_is_dragging = false;
+
 // The minimum alpha required so we would treat the pixel as visible.
 constexpr uint32_t kMinAlpha = 32;
 
@@ -142,6 +150,13 @@
     return DragOperation::kNone;
   }
 
+  // A renderer can send LocalFrameHost::StartDragging at any time, so reject
+  // (rather than CHECK) re-entrant drags from a second top-level window.
+  if (g_is_dragging) {
+    return DragOperation::kNone;
+  }
+  base::AutoReset<bool> drag_scoper(&g_is_dragging, true);
+
   DCHECK(!drag_context_);
   drag_context_ = std::make_unique<DragContext>();
 
diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
index b7516bb77..769cd0b 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
@@ -166,6 +166,10 @@
     drop_handler->OnDragLeave();
   }
 
+  void set_callback_during_drag(base::RepeatingClosure callback) {
+    callback_during_drag_ = std::move(callback);
+  }
+
   void CloseDrag(DragOperation operation) {
     std::move(drag_finished_callback_).Run(operation);
     drag_loop_quit_closure_.Run();
@@ -174,6 +178,9 @@
   void ProcessDrag(std::unique_ptr<OSExchangeData> data, int operation) {
     std::move(drag_started_callback_).Run();
     OnDragEnter(kStartDragLocation, std::move(data), operation);
+    if (callback_during_drag_) {
+      callback_during_drag_.Run();
+    }
     int updated_operation = OnDragMotion(kStartDragLocation, operation);
     OnDragDrop();
     OnDragLeave();
@@ -185,6 +192,7 @@
   WmDragHandler::DragFinishedCallback drag_finished_callback_;
   std::unique_ptr<ui::OSExchangeData> source_data_;
   base::RepeatingClosure drag_loop_quit_closure_;
+  base::RepeatingClosure callback_during_drag_;
   int modifiers_ = 0;
 };
 
@@ -560,4 +568,27 @@
   EXPECT_EQ(1, dragdrop_delegate_->num_exits());
 }
 
+TEST_F(DesktopDragDropClientOzoneTest, RejectReentrantDrag) {
+  // Set up a callback to be run while the drag is active.
+  platform_window_->set_callback_during_drag(base::BindRepeating(
+      [](DesktopDragDropClientOzoneTest* test) {
+        // Attempt to start a second drag operation while the first is active.
+        DragOperation reentrant_operation =
+            test->StartDragAndDrop(ui::DragDropTypes::DRAG_COPY);
+        // The reentrant drag should be rejected and return kNone.
+        EXPECT_EQ(DragOperation::kNone, reentrant_operation);
+      },
+      base::Unretained(this)));
+
+  // Set the operation which the destination can accept.
+  dragdrop_delegate_->SetOperation(DragOperation::kCopy);
+
+  // Start the first drag and drop.
+  DragOperation operation = StartDragAndDrop(ui::DragDropTypes::DRAG_COPY |
+                                             ui::DragDropTypes::DRAG_MOVE);
+
+  // The first drag should succeed and complete as expected.
+  EXPECT_EQ(DragOperation::kCopy, operation);
+}
+
 }  // namespace views

diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
index b7516bb77..769cd0b 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_ozone_unittest.cc
@@ -166,6 +166,10 @@
     drop_handler->OnDragLeave();
   }
 
+  void set_callback_during_drag(base::RepeatingClosure callback) {
+    callback_during_drag_ = std::move(callback);
+  }
+
   void CloseDrag(DragOperation operation) {
     std::move(drag_finished_callback_).Run(operation);
     drag_loop_quit_closure_.Run();
@@ -174,6 +178,9 @@
   void ProcessDrag(std::unique_ptr<OSExchangeData> data, int operation) {
     std::move(drag_started_callback_).Run();
     OnDragEnter(kStartDragLocation, std::move(data), operation);
+    if (callback_during_drag_) {
+      callback_during_drag_.Run();
+    }
     int updated_operation = OnDragMotion(kStartDragLocation, operation);
     OnDragDrop();
     OnDragLeave();
@@ -185,6 +192,7 @@
   WmDragHandler::DragFinishedCallback drag_finished_callback_;
   std::unique_ptr<ui::OSExchangeData> source_data_;
   base::RepeatingClosure drag_loop_quit_closure_;
+  base::RepeatingClosure callback_during_drag_;
   int modifiers_ = 0;
 };
 
@@ -560,4 +568,27 @@
   EXPECT_EQ(1, dragdrop_delegate_->num_exits());
 }
 
+TEST_F(DesktopDragDropClientOzoneTest, RejectReentrantDrag) {
+  // Set up a callback to be run while the drag is active.
+  platform_window_->set_callback_during_drag(base::BindRepeating(
+      [](DesktopDragDropClientOzoneTest* test) {
+        // Attempt to start a second drag operation while the first is active.
+        DragOperation reentrant_operation =
+            test->StartDragAndDrop(ui::DragDropTypes::DRAG_COPY);
+        // The reentrant drag should be rejected and return kNone.
+        EXPECT_EQ(DragOperation::kNone, reentrant_operation);
+      },
+      base::Unretained(this)));
+
+  // Set the operation which the destination can accept.
+  dragdrop_delegate_->SetOperation(DragOperation::kCopy);
+
+  // Start the first drag and drop.
+  DragOperation operation = StartDragAndDrop(ui::DragDropTypes::DRAG_COPY |
+                                             ui::DragDropTypes::DRAG_MOVE);
+
+  // The first drag should succeed and complete as expected.
+  EXPECT_EQ(DragOperation::kCopy, operation);
+}
+
 }  // namespace views