From 4f438153a3d245c1440addd3ddec2763b00bdb4b Mon Sep 17 00:00:00 2001
From: Alex Rudenko <alexrudenko@chromium.org>
Date: Wed, 19 Aug 2026 12:33:39 +0200
Subject: [PATCH] Validate keyboard shortcuts in ExtensionServer

Fixed: 548611433
Change-Id: I9ec9d54b62cc988ecefe032065b9a8c675bb645f
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/8250963
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Auto-Submit: Alex Rudenko <alexrudenko@chromium.org>
Commit-Queue: Alex Rudenko <alexrudenko@chromium.org>
---
diff --git a/front_end/models/extensions/ExtensionAPI.ts b/front_end/models/extensions/ExtensionAPI.ts
index bc7cf00..c3e900b 100644
--- a/front_end/models/extensions/ExtensionAPI.ts
+++ b/front_end/models/extensions/ExtensionAPI.ts
@@ -247,9 +247,20 @@
     scriptUrl: string;
     ranges: PublicAPI.Chrome.DevTools.NamedFunctionRange[];
   }
+  export interface ForwardKeyboardEventRequestEntry {
+    eventType: string;
+    ctrlKey: boolean;
+    altKey: boolean;
+    metaKey: boolean;
+    shiftKey: boolean;
+    key: string;
+    code: string;
+    keyCode: number;
+    location: number;
+  }
   interface ForwardKeyboardEventRequest {
     command: Commands.ForwardKeyboardEvent;
-    entries: Array<KeyboardEventInit&{eventType: string}>;
+    entries: ForwardKeyboardEventRequestEntry[];
   }
   interface GetHARRequest {
     command: Commands.GetHAR;
@@ -1553,52 +1564,52 @@
     return inspectedTabId;
   }
 
-  let keyboardEventRequestQueue: KeyboardEventInit&Array<{eventType: string}> = [];
+  let keyboardEventRequestQueue: PrivateAPI.ForwardKeyboardEventRequestEntry[] = [];
   let forwardTimer: ReturnType<typeof setTimeout>|undefined;
   function forwardKeyboardEvent(event: KeyboardEvent): void {
-    // Check if the event should be forwarded.
-    // This is a workaround for crbug.com/923338.
-    const focused = document.activeElement;
-    if (focused) {
-      const isInput =
-          focused.nodeName === 'INPUT' || focused.nodeName === 'TEXTAREA' || (focused as HTMLElement).isContentEditable;
-      if (isInput && !(event.ctrlKey || event.altKey || event.metaKey)) {
-        return;
-      }
-    }
-
-    let modifiers = 0;
-    if (event.shiftKey) {
-      modifiers |= 1;
-    }
-    if (event.ctrlKey) {
-      modifiers |= 2;
-    }
-    if (event.altKey) {
-      modifiers |= 4;
-    }
-    if (event.metaKey) {
-      modifiers |= 8;
-    }
-    const num = (event.keyCode & 255) | (modifiers << 8);
-    // We only care about global hotkeys, not about random text
-    if (!keysToForwardSet.has(num)) {
-      return;
-    }
-    event.preventDefault();
-    const requestPayload = {
+    const requestPayload: Readonly<PrivateAPI.ForwardKeyboardEventRequestEntry> = Object.freeze({
       eventType: event.type,
       ctrlKey: event.ctrlKey,
       altKey: event.altKey,
       metaKey: event.metaKey,
       shiftKey: event.shiftKey,
-      // @ts-expect-error keyIdentifier is a deprecated non-standard property that typescript doesn't know about.
-      keyIdentifier: event.keyIdentifier,
       key: event.key,
       code: event.code,
-      location: event.location,
       keyCode: event.keyCode,
-    };
+      location: event.location,
+    });
+
+    // Check if the event should be forwarded.
+    // This is a workaround for crbug.com/923338.
+    const targetDocument = targetWindowForTest?.document ?? document;
+    const focused = targetDocument.activeElement;
+    if (focused) {
+      const isInput =
+          focused.nodeName === 'INPUT' || focused.nodeName === 'TEXTAREA' || (focused as HTMLElement).isContentEditable;
+      if (isInput && !(requestPayload.ctrlKey || requestPayload.altKey || requestPayload.metaKey)) {
+        return;
+      }
+    }
+
+    let modifiers = 0;
+    if (requestPayload.shiftKey) {
+      modifiers |= 1;
+    }
+    if (requestPayload.ctrlKey) {
+      modifiers |= 2;
+    }
+    if (requestPayload.altKey) {
+      modifiers |= 4;
+    }
+    if (requestPayload.metaKey) {
+      modifiers |= 8;
+    }
+    const num = (requestPayload.keyCode & 255) | (modifiers << 8);
+    // We only care about global hotkeys, not about random text
+    if (!keysToForwardSet.has(num)) {
+      return;
+    }
+    event.preventDefault();
     keyboardEventRequestQueue.push(requestPayload);
     if (!forwardTimer) {
       forwardTimer = globalThis.setTimeout(forwardEventQueue, 0);
@@ -1612,7 +1623,7 @@
     keyboardEventRequestQueue = [];
   }
 
-  document.addEventListener('keydown', forwardKeyboardEvent, false);
+  (targetWindowForTest?.document ?? document).addEventListener('keydown', forwardKeyboardEvent, false);
 
   function ExtensionServerClient(this: APIImpl.ExtensionServerClient, targetWindow: Window): void {
     this._callbacks = {};
diff --git a/front_end/panels/common/ExtensionServer.test.ts b/front_end/panels/common/ExtensionServer.test.ts
index f29b4b6..8acfd48 100644
--- a/front_end/panels/common/ExtensionServer.test.ts
+++ b/front_end/panels/common/ExtensionServer.test.ts
@@ -2243,4 +2243,408 @@
                                                    });
     });
   });
+
+  describe('forwardKeyboardEvent', () => {
+    interface ForwardedKeyboardEvent extends KeyboardEvent {
+      // eslint-disable-next-line @typescript-eslint/naming-convention
+      __keyCode?: number;
+    }
+
+    interface WindowWithOptionalChrome {
+      chrome?: Partial<Chrome.DevTools.Chrome>;
+    }
+
+    interface TestExtensionServerClient {
+      sendRequest: sinon.SinonStub;
+    }
+
+    it('dispatches allowed global shortcut keys', () => {
+      const server = PanelCommon.ExtensionServer.ExtensionServer.instance();
+      const shortcutKey = UI.KeyboardShortcut.KeyboardShortcut.makeKey('P', UI.KeyboardShortcut.Modifiers.Ctrl.value);
+      sinon.stub(UI.ShortcutRegistry.ShortcutRegistry.instance(), 'globalShortcutKeys').returns([shortcutKey]);
+
+      const dispatchedEvents: KeyboardEvent[] = [];
+      const listener = (event: Event) => dispatchedEvents.push(event as KeyboardEvent);
+      document.addEventListener('keydown', listener);
+
+      try {
+        const result = server.onForwardKeyboardEventForTest({
+          command: Extensions.ExtensionAPI.PrivateAPI.Commands.ForwardKeyboardEvent,
+          entries: [{
+            eventType: 'keydown',
+            ctrlKey: true,
+            altKey: false,
+            metaKey: false,
+            shiftKey: false,
+            key: 'p',
+            code: 'KeyP',
+            keyCode: 80,
+            location: 0,
+          }],
+        });
+
+        assert.isUndefined(result);
+        assert.lengthOf(dispatchedEvents, 1);
+        const [event] = dispatchedEvents;
+        assert.strictEqual(event.type, 'keydown');
+        assert.isTrue(event.ctrlKey);
+        assert.isFalse(event.altKey);
+        assert.strictEqual(event.key, 'p');
+        assert.strictEqual(event.code, 'KeyP');
+        assert.strictEqual((event as ForwardedKeyboardEvent).__keyCode, 80);
+      } finally {
+        document.removeEventListener('keydown', listener);
+      }
+    });
+
+    it('handles synthetic Escape key code', () => {
+      const server = PanelCommon.ExtensionServer.ExtensionServer.instance();
+      const escapeKey = UI.KeyboardShortcut.KeyboardShortcut.makeKey(27, UI.KeyboardShortcut.Modifiers.None.value);
+      sinon.stub(UI.ShortcutRegistry.ShortcutRegistry.instance(), 'globalShortcutKeys').returns([escapeKey]);
+
+      const dispatchedEvents: KeyboardEvent[] = [];
+      const listener = (event: Event) => dispatchedEvents.push(event as KeyboardEvent);
+      document.addEventListener('keydown', listener);
+
+      try {
+        const result = server.onForwardKeyboardEventForTest({
+          command: Extensions.ExtensionAPI.PrivateAPI.Commands.ForwardKeyboardEvent,
+          entries: [{
+            eventType: 'keydown',
+            ctrlKey: false,
+            altKey: false,
+            metaKey: false,
+            shiftKey: false,
+            key: Platform.KeyboardUtilities.ESCAPE_KEY,
+            code: 'Escape',
+            keyCode: 0,
+            location: 0,
+          }],
+        });
+
+        assert.isUndefined(result);
+        assert.lengthOf(dispatchedEvents, 1);
+        const [event] = dispatchedEvents;
+        assert.strictEqual((event as ForwardedKeyboardEvent).__keyCode, 27);
+      } finally {
+        document.removeEventListener('keydown', listener);
+      }
+    });
+
+    it('rejects keys that are not allowed global shortcuts', () => {
+      const server = PanelCommon.ExtensionServer.ExtensionServer.instance();
+      sinon.stub(UI.ShortcutRegistry.ShortcutRegistry.instance(), 'globalShortcutKeys').returns([]);
+
+      const dispatchedEvents: KeyboardEvent[] = [];
+      const listener = (event: Event) => dispatchedEvents.push(event as KeyboardEvent);
+      document.addEventListener('keydown', listener);
+
+      try {
+        const result = server.onForwardKeyboardEventForTest({
+          command: Extensions.ExtensionAPI.PrivateAPI.Commands.ForwardKeyboardEvent,
+          entries: [{
+            eventType: 'keydown',
+            ctrlKey: false,
+            altKey: false,
+            metaKey: false,
+            shiftKey: false,
+            key: 'a',
+            code: 'KeyA',
+            keyCode: 65,
+            location: 0,
+          }],
+        });
+
+        assertIsStatus(result);
+        assert.strictEqual(result.code, 'E_BADARG');
+        assert.lengthOf(dispatchedEvents, 0);
+      } finally {
+        document.removeEventListener('keydown', listener);
+      }
+    });
+
+    it('rejects malformed entries without dispatching events', () => {
+      const server = PanelCommon.ExtensionServer.ExtensionServer.instance();
+      const shortcutKey = UI.KeyboardShortcut.KeyboardShortcut.makeKey('P', UI.KeyboardShortcut.Modifiers.Ctrl.value);
+      sinon.stub(UI.ShortcutRegistry.ShortcutRegistry.instance(), 'globalShortcutKeys').returns([shortcutKey]);
+
+      const dispatchedEvents: KeyboardEvent[] = [];
+      const listener = (event: Event) => dispatchedEvents.push(event as KeyboardEvent);
+      document.addEventListener('keydown', listener);
+
+      try {
+        // Non-array entries
+        const result1 = server.onForwardKeyboardEventForTest({
+          command: Extensions.ExtensionAPI.PrivateAPI.Commands.ForwardKeyboardEvent,
+          entries: 'not an array' as unknown as Extensions.ExtensionAPI.PrivateAPI.ForwardKeyboardEventRequestEntry[],
+        });
+        assertIsStatus(result1);
+        assert.strictEqual(result1.code, 'E_BADARG');
+
+        // Invalid eventType
+        const result2 = server.onForwardKeyboardEventForTest({
+          command: Extensions.ExtensionAPI.PrivateAPI.Commands.ForwardKeyboardEvent,
+          entries: [{
+            eventType: 'keyup',
+            ctrlKey: true,
+            altKey: false,
+            metaKey: false,
+            shiftKey: false,
+            key: 'p',
+            code: 'KeyP',
+            keyCode: 80,
+            location: 0,
+          }],
+        });
+        assertIsStatus(result2);
+        assert.strictEqual(result2.code, 'E_BADARG');
+
+        // Invalid property type (keyCode as string)
+        const result3 = server.onForwardKeyboardEventForTest({
+          command: Extensions.ExtensionAPI.PrivateAPI.Commands.ForwardKeyboardEvent,
+          entries: [{
+            eventType: 'keydown',
+            ctrlKey: true,
+            altKey: false,
+            metaKey: false,
+            shiftKey: false,
+            key: 'p',
+            code: 'KeyP',
+            keyCode: '80' as unknown as number,
+            location: 0,
+          }],
+        });
+        assertIsStatus(result3);
+        assert.strictEqual(result3.code, 'E_BADARGTYPE');
+
+        // Array with one valid and one invalid entry should dispatch nothing
+        const result4 = server.onForwardKeyboardEventForTest({
+          command: Extensions.ExtensionAPI.PrivateAPI.Commands.ForwardKeyboardEvent,
+          entries: [
+            {
+              eventType: 'keydown',
+              ctrlKey: true,
+              altKey: false,
+              metaKey: false,
+              shiftKey: false,
+              key: 'p',
+              code: 'KeyP',
+              keyCode: 80,
+              location: 0,
+            },
+            {
+              eventType: 'keydown',
+              ctrlKey: false,
+              altKey: false,
+              metaKey: false,
+              shiftKey: false,
+              key: 'q',
+              code: 'KeyQ',
+              keyCode: 81,
+              location: 0,
+            },
+          ],
+        });
+        assertIsStatus(result4);
+        assert.strictEqual(result4.code, 'E_BADARG');
+        assert.lengthOf(dispatchedEvents, 0);
+      } finally {
+        document.removeEventListener('keydown', listener);
+      }
+    });
+
+    it('extension client reads event properties once and forwards allowed shortcuts', async () => {
+      let sendRequestStub: sinon.SinonStub|undefined;
+      const shortcutKey = UI.KeyboardShortcut.KeyboardShortcut.makeKey('P', UI.KeyboardShortcut.Modifiers.Ctrl.value);
+
+      const fakeDocument = document.createElement('div');
+      const fakeWindow = {
+        postMessage: sinon.stub(),
+        addEventListener: sinon.stub(),
+        removeEventListener: sinon.stub(),
+        document: fakeDocument,
+      } as unknown as Window;
+
+      const windowWithChrome = window as unknown as WindowWithOptionalChrome;
+      const originalChrome = windowWithChrome.chrome;
+      delete windowWithChrome.chrome;
+
+      try {
+        self.injectedExtensionAPI(context.extensionDescriptor, 'main', 'dark',
+                                  [shortcutKey], (extensionServer: unknown) => {
+                                    const client = extensionServer as TestExtensionServerClient;
+                                    sendRequestStub = sinon.stub(client, 'sendRequest');
+                                  }, 1, fakeWindow);
+
+        assert.exists(sendRequestStub);
+
+        let keyReadCount = 0;
+        let ctrlKeyReadCount = 0;
+        let keyCodeReadCount = 0;
+
+        const keydownEvent = new KeyboardEvent('keydown', {
+          ctrlKey: true,
+          key: 'p',
+          code: 'KeyP',
+          keyCode: 80,
+        });
+
+        Object.defineProperty(keydownEvent, 'ctrlKey', {
+          get() {
+            ctrlKeyReadCount++;
+            return true;
+          },
+        });
+        Object.defineProperty(keydownEvent, 'key', {
+          get() {
+            keyReadCount++;
... (file diff truncated)