From a34728fb28d14bc2c8fb1bf3f23d34b8e0763261 Mon Sep 17 00:00:00 2001
From: Mohamed Adel <adelm@google.com>
Date: Wed, 01 Jul 2026 16:29:53 -0700
Subject: [PATCH] [Android] Require a registered session for receiveFile

Unlike the other CustomTabsService entry points, receiveFile did not
check that the caller had completed first run or that the supplied
session token had been registered via newSession() before opening the
supplied URI and decoding it as a TWA splash image in
CustomTabsClientFileProcessor.

Bring it in line with warmup/mayLaunchUrl/updateVisuals etc:
* CustomTabsConnectionServiceImpl.receiveFile now returns false
  before first run completes.
* CustomTabsConnection.receiveFile now requires the session to
  be known to ClientManager before any file is opened.

Add Robolectric coverage for receiveFile that exercises both the
rejected (unregistered session) and accepted (registered session) paths.

TAG=agy
CONV=aba571cb-6002-44d9-a887-67df13c38ac3

Bug: b:497940451
Change-Id: Ifdbf0a8b86c3a9bdaa3d444956cd7e56fa0384f4
Fixed: 497940451
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8032890
Commit-Queue: Moe Adel <adelm@google.com>
Auto-Submit: Moe Adel <adelm@google.com>
Reviewed-by: Joel Tan-Aristy <jtanaristy@google.com>
Cr-Commit-Position: refs/heads/main@{#1655817}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
index 5688cf5b..bf36da7d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
@@ -2155,8 +2155,10 @@
             logCall("receiveFile()", false);
             return false;
         }
+        SessionHolder<?> session = new SessionHolder<>(sessionToken);
+        if (!mClientManager.isSessionValid(session)) return false;
         return CustomTabsClientFileProcessor.getInstance()
-                .processFile(new SessionHolder<>(sessionToken), uri, purpose, extras);
+                .processFile(session, uri, purpose, extras);
     }
 
     public void setCustomTabIsInForeground(
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionServiceImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionServiceImpl.java
index ffceaff..a1ab4a9d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionServiceImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionServiceImpl.java
@@ -131,6 +131,7 @@
     @Override
     protected boolean receiveFile(
             CustomTabsSessionToken sessionToken, Uri uri, int purpose, @Nullable Bundle extras) {
+        if (!isFirstRunDone()) return false;
         return mConnection.receiveFile(sessionToken, uri, purpose, extras);
     }
 
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionUnitTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionUnitTest.java
index b63618d2..eb39946e 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionUnitTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionUnitTest.java
@@ -374,6 +374,7 @@
     @Config(sdk = {BaseRobolectricTestRunner.MIN_SDK, 35})
     @Test
     public void receiveFile_CallerWithUriPermission() throws IOException {
+        initSession();
         Uri uri = registerSplashImageProvider();
         setCallerUriPermission(PackageManager.PERMISSION_GRANTED);
 
@@ -387,5 +388,20 @@
         assertNotNull(SplashImageHolder.getInstance().takeImage(mSessionHolder));
     }
 
+    @Config(sdk = {BaseRobolectricTestRunner.MIN_SDK, 35})
+    @Test
+    public void receiveFile_SessionNotRegistered() throws IOException {
+        Uri uri = registerSplashImageProvider();
+        setCallerUriPermission(PackageManager.PERMISSION_GRANTED);
+
+        assertFalse(
+                mConnection.receiveFile(
+                        mSession,
+                        uri,
+                        CustomTabsService.FILE_PURPOSE_TRUSTED_WEB_ACTIVITY_SPLASH_IMAGE,
+                        Bundle.EMPTY));
+        assertFalse(TestSplashImageContentProvider.sOpened);
+        assertNull(SplashImageHolder.getInstance().takeImage(mSessionHolder));
+    }
     // TODO(https://crrev.com/c/4118209) Add more tests for Feature enabling/disabling.
 }