From 51be7f568ef9213f56b17fe0855fc735f677f272 Mon Sep 17 00:00:00 2001
From: mark a. foltz <mfoltz@chromium.org>
Date: Tue, 31 Mar 2026 14:44:07 -0700
Subject: [PATCH] [Media Router] Add URL validation to ReconnectPresentation.

This change adds a call to IsValidPresentationUrl in
ControllerPresentationServiceDelegateImpl::ReconnectPresentation to
ensure that only supported URL schemes are processed.

Previously, ReconnectPresentation lacked validation for the
presentation_urls parameter, allowing a compromised renderer to initiate
unauthorized desktop or cross-tab capture by sending a malicious URN
(e.g., 'urn:x-org.chromium.media:source:desktop:screen:0:0'). By
injecting such a URN with a presentation ID of 'auto-join', an attacker
could bypass the desktop picker UI and escalate an active tab-mirroring
session into a full-screen capture session.

This fix mirrors the validation logic already present in
StartPresentation.

AI disclosure: Prepared with gemini_cli

Fixed: 496399759
Change-Id: I5be5a81b35a0d1fd41de33adecac70bb0e7545c3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7718183
Reviewed-by: Muyao Xu <muyaoxu@google.com>
Commit-Queue: Mark Foltz <mfoltz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1608112}
---

diff --git a/components/media_router/browser/presentation/controller_presentation_service_delegate_impl.cc b/components/media_router/browser/presentation/controller_presentation_service_delegate_impl.cc
index 3cf3b468..7107be1 100644
--- a/components/media_router/browser/presentation/controller_presentation_service_delegate_impl.cc
+++ b/components/media_router/browser/presentation/controller_presentation_service_delegate_impl.cc
@@ -510,6 +510,13 @@
     return;
   }
 
+  if (!std::ranges::all_of(presentation_urls, IsValidPresentationUrl)) {
+    std::move(error_cb).Run(
+        PresentationError(PresentationErrorType::NO_PRESENTATION_FOUND,
+                          "Invalid presentation URL."));
+    return;
+  }
+
   auto* local_presentation_manager =
       LocalPresentationManagerFactory::GetOrCreateForWebContents(
           &GetWebContents());
diff --git a/components/media_router/browser/presentation/controller_presentation_service_delegate_impl_unittest.cc b/components/media_router/browser/presentation/controller_presentation_service_delegate_impl_unittest.cc
index 866b0d45..bf93ee2e 100644
--- a/components/media_router/browser/presentation/controller_presentation_service_delegate_impl_unittest.cc
+++ b/components/media_router/browser/presentation/controller_presentation_service_delegate_impl_unittest.cc
@@ -805,6 +805,38 @@
           &MockCreatePresentationConnectionCallbacks::OnCreateConnectionError,
           base::Unretained(&mock_create_connection_callbacks)));
 }
+
+TEST_F(ControllerPresentationServiceDelegateImplTest,
+       ReconnectPresentationWithInvalidUrl) {
+  content::WebContentsTester::For(GetWebContents())
+      ->NavigateAndCommit(GURL(kFrameUrl));
+
+  MockCreatePresentationConnectionCallbacks mock_create_connection_callbacks;
+  const std::string kPresentationId("auto-join");
+
+  // A URN that should be blocked.
+  const GURL invalid_url("urn:x-org.chromium.media:source:desktop:screen:0:0");
+  content::PresentationRequest invalid_request(
+      {main_frame_process_id_, main_frame_routing_id_}, {invalid_url},
+      frame_origin_);
+
+  // JoinRouteInternal should NOT be called.
+  EXPECT_CALL(*router_, JoinRouteInternal(_, _, _, _, _, _)).Times(0);
+
+  // Error callback should be called.
+  EXPECT_CALL(mock_create_connection_callbacks, OnCreateConnectionError(_))
+      .Times(1);
+
+  delegate_impl_->ReconnectPresentation(
+      invalid_request, kPresentationId,
+      base::BindOnce(
+          &MockCreatePresentationConnectionCallbacks::OnCreateConnectionSuccess,
+          base::Unretained(&mock_create_connection_callbacks)),
+      base::BindOnce(
+          &MockCreatePresentationConnectionCallbacks::OnCreateConnectionError,
+          base::Unretained(&mock_create_connection_callbacks)));
+}
+
 #endif  // !BUILDFLAG(IS_ANDROID)
 
 }  // namespace media_router

diff --git a/components/media_router/browser/presentation/controller_presentation_service_delegate_impl_unittest.cc b/components/media_router/browser/presentation/controller_presentation_service_delegate_impl_unittest.cc
index 866b0d45..bf93ee2e 100644
--- a/components/media_router/browser/presentation/controller_presentation_service_delegate_impl_unittest.cc
+++ b/components/media_router/browser/presentation/controller_presentation_service_delegate_impl_unittest.cc
@@ -805,6 +805,38 @@
           &MockCreatePresentationConnectionCallbacks::OnCreateConnectionError,
           base::Unretained(&mock_create_connection_callbacks)));
 }
+
+TEST_F(ControllerPresentationServiceDelegateImplTest,
+       ReconnectPresentationWithInvalidUrl) {
+  content::WebContentsTester::For(GetWebContents())
+      ->NavigateAndCommit(GURL(kFrameUrl));
+
+  MockCreatePresentationConnectionCallbacks mock_create_connection_callbacks;
+  const std::string kPresentationId("auto-join");
+
+  // A URN that should be blocked.
+  const GURL invalid_url("urn:x-org.chromium.media:source:desktop:screen:0:0");
+  content::PresentationRequest invalid_request(
+      {main_frame_process_id_, main_frame_routing_id_}, {invalid_url},
+      frame_origin_);
+
+  // JoinRouteInternal should NOT be called.
+  EXPECT_CALL(*router_, JoinRouteInternal(_, _, _, _, _, _)).Times(0);
+
+  // Error callback should be called.
+  EXPECT_CALL(mock_create_connection_callbacks, OnCreateConnectionError(_))
+      .Times(1);
+
+  delegate_impl_->ReconnectPresentation(
+      invalid_request, kPresentationId,
+      base::BindOnce(
+          &MockCreatePresentationConnectionCallbacks::OnCreateConnectionSuccess,
+          base::Unretained(&mock_create_connection_callbacks)),
+      base::BindOnce(
+          &MockCreatePresentationConnectionCallbacks::OnCreateConnectionError,
+          base::Unretained(&mock_create_connection_callbacks)));
+}
+
 #endif  // !BUILDFLAG(IS_ANDROID)
 
 }  // namespace media_router