Commit message: None
CVE: CVE-2013-6643
CWE: CWE-287
Vulnerability description: The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubble_view.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers to trigger a sync with an arbitrary Google account by leveraging improper handling of the closing of an untrusted signin confirm dialog.

Project: Chrome

FormAttributeTargetObserver::FormAttributeTargetObserver(const AtomicString& id, FormAssociatedElement* element)
    : IdTargetObserver(toHTMLElement(element)->treeScope().idTargetObserverRegistry(), id)
    , m_element(element)
{
}

Project: Chrome

PassOwnPtr<FormAttributeTargetObserver> FormAttributeTargetObserver::create(const AtomicString& id, FormAssociatedElement* element)
{
    return adoptPtr(new FormAttributeTargetObserver(id, element));
}

Project: Chrome

bool FormAssociatedElement::customError() const
{
    const HTMLElement* element = toHTMLElement(this);
    return element->willValidate() && !m_customValidationMessage.isEmpty();
}

Project: Chrome

String FormAssociatedElement::customValidationMessage() const
{
    return m_customValidationMessage;
}

Project: Chrome

void FormAssociatedElement::didChangeForm()
{
}

Project: Chrome

void FormAssociatedElement::didMoveToNewDocument(Document& oldDocument)
{
    HTMLElement* element = toHTMLElement(this);
    if (element->fastHasAttribute(formAttr))
        m_formAttributeTargetObserver = nullptr;
}

Project: Chrome

HTMLFormElement* FormAssociatedElement::findAssociatedForm(const HTMLElement* element, HTMLFormElement* currentAssociatedForm)
{
    const AtomicString& formId(element->fastGetAttribute(formAttr));
    if (!formId.isNull() && element->inDocument()) {
        HTMLFormElement* newForm = 0;
        Element* newFormCandidate = element->treeScope().getElementById(formId);
        if (newFormCandidate && newFormCandidate->hasTagName(formTag))
            newForm = toHTMLFormElement(newFormCandidate);
        return newForm;
    }

    if (!currentAssociatedForm)
        return element->findFormAncestor();

    return currentAssociatedForm;
}

Project: Chrome

void FormAssociatedElement::formAttributeChanged()
{
    HTMLElement* element = toHTMLElement(this);
    if (!element->fastHasAttribute(formAttr)) {
        HTMLFormElement* originalForm = m_form;
        setForm(element->findFormAncestor());
        HTMLElement* element = toHTMLElement(this);
        if (m_form && m_form != originalForm && m_form->inDocument())
            element->document().didAssociateFormControl(element);
        m_formAttributeTargetObserver = nullptr;
    } else {
        resetFormOwner();
        if (element->inDocument())
            resetFormAttributeTargetObserver();
    }
}

Project: Chrome

void FormAssociatedElement::formAttributeTargetChanged()
{
    resetFormOwner();
}

Project: Chrome

void FormAssociatedElement::formWillBeDestroyed()
{
    ASSERT(m_form);
    if (!m_form)
        return;
    willChangeForm();
    m_form = 0;
    didChangeForm();
}

Project: Chrome

bool FormAssociatedElement::hasBadInput() const
{
    return false;
}

Project: Chrome

void FormAttributeTargetObserver::idTargetChanged()
{
    m_element->formAttributeTargetChanged();
}

Project: Chrome

void FormAssociatedElement::insertedInto(ContainerNode* insertionPoint)
{
    if (m_form && insertionPoint->highestAncestor() != m_form->highestAncestor())
        setForm(0);

    resetFormOwner();
    if (!insertionPoint->inDocument())
        return;

    HTMLElement* element = toHTMLElement(this);
    if (element->fastHasAttribute(formAttr))
        resetFormAttributeTargetObserver();
}

Project: Chrome

bool FormAssociatedElement::isFormControlElementWithState() const
{
    return false;
}

Project: Chrome

const AtomicString& FormAssociatedElement::name() const
{
    const AtomicString& name = toHTMLElement(this)->getNameAttribute();
    return name.isNull() ? emptyAtom : name;
}

Project: Chrome

bool FormAssociatedElement::patternMismatch() const
{
    return false;
}

Project: Chrome

bool FormAssociatedElement::rangeOverflow() const
{
    return false;
}

Project: Chrome

bool FormAssociatedElement::rangeUnderflow() const
{
    return false;
}

Project: Chrome

void FormAssociatedElement::removedFrom(ContainerNode* insertionPoint)
{
    HTMLElement* element = toHTMLElement(this);
    if (insertionPoint->inDocument() && element->fastHasAttribute(formAttr))
        m_formAttributeTargetObserver = nullptr;
    if (m_form && element->highestAncestor() != m_form->highestAncestor())
        setForm(0);
}

Project: Chrome

void FormAssociatedElement::resetFormAttributeTargetObserver()
{
    ASSERT(toHTMLElement(this)->inDocument());
    m_formAttributeTargetObserver = FormAttributeTargetObserver::create(toHTMLElement(this)->fastGetAttribute(formAttr), this);
}

Project: Chrome

void FormAssociatedElement::resetFormOwner()
{
    HTMLFormElement* originalForm = m_form;
    setForm(findAssociatedForm(toHTMLElement(this), m_form));
    HTMLElement* element = toHTMLElement(this);
    if (m_form && m_form != originalForm && m_form->inDocument())
        element->document().didAssociateFormControl(element);
}

Project: Chrome

void FormAssociatedElement::setCustomValidity(const String& error)
{
    m_customValidationMessage = error;
}

Project: Chrome

 void FormAssociatedElement::setForm(HTMLFormElement* newForm)
{
    if (m_form == newForm)
        return;
    willChangeForm();
    if (m_form)
        m_form->removeFormElement(this);
    m_form = newForm;
    if (m_form)
        m_form->registerFormElement(*this);
    didChangeForm();
}

Project: Chrome

bool FormAssociatedElement::stepMismatch() const
{
    return false;
}

Project: Chrome

const HTMLElement& toHTMLElement(const FormAssociatedElement& associatedElement)
{
    if (associatedElement.isFormControlElement())
        return toHTMLFormControlElement(associatedElement);
    return toHTMLObjectElement(associatedElement);
}

Project: Chrome

const HTMLElement* toHTMLElement(const FormAssociatedElement* associatedElement)
{
    ASSERT(associatedElement);
    return &toHTMLElement(*associatedElement);
}

Project: Chrome

HTMLElement* toHTMLElement(FormAssociatedElement* associatedElement)
{
    return const_cast<HTMLElement*>(toHTMLElement(static_cast<const FormAssociatedElement*>(associatedElement)));
}

Project: Chrome

HTMLElement& toHTMLElement(FormAssociatedElement& associatedElement)
{
    return const_cast<HTMLElement&>(toHTMLElement(static_cast<const FormAssociatedElement&>(associatedElement)));
}

Project: Chrome

bool FormAssociatedElement::tooLong() const
{
    return false;
}

Project: Chrome

bool FormAssociatedElement::valid() const
{
    bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow()
        || tooLong() || patternMismatch() || valueMissing() || hasBadInput() || customError();
    return !someError;
}

Project: Chrome

String FormAssociatedElement::validationMessage() const
{
    return customError() ? m_customValidationMessage : String();
}

Project: Chrome

ValidityState* FormAssociatedElement::validity()
{
    if (!m_validityState)
        m_validityState = ValidityState::create(this);

    return m_validityState.get();
}

Project: Chrome

bool FormAssociatedElement::valueMissing() const
{
    return false;
}

Project: Chrome

FormAssociatedElement::~FormAssociatedElement()
{
}