PPB_TCPSocket_Private/PPB_UDPSocket_Private are exposed to Browser

content/public/common/content_switches.h

Index: content/public/common/content_switches.h
diff --git a/content/public/common/content_switches.h b/content/public/common/content_switches.h
index d1d805f16d11b516b6191267dfe15a69bdf76310..4af30f9d3c15eeb9a749bc6740ff19537118a01a 100644
--- a/content/public/common/content_switches.h
+++ b/content/public/common/content_switches.h
@@ -14,6 +14,8 @@
 namespace switches {
 
 CONTENT_EXPORT extern const char kAllowFileAccessFromFiles[];
+// TODO(dpolukhin): this doesn't belong in content.
+CONTENT_EXPORT extern const char kAllowNaClSocketAPI[];

[darin (slow to review), 2011/12/02 20:34:42]

Is this really the NaCl socket API?  The socket API is part of Pepper.  Should
this be kAllowPepperSocketAPI instead?

What is NaCl-specific about this CL?

[yzshen1, 2011/12/02 21:19:27]

When the socket API is used by non-NaCl pepper plugins (Flapper), we don't
restrict it to a set of selective origins. So it seems appropriate to have NaCl
in the name.

But I think it is better not to enforce the origin restriction in render view.
It will affect not only NaCl, but also other in-process pepper plugins.

[Dmitry Polukhin, 2011/12/05 11:29:06]

Actually I think that TCP/UDP should be exposed to limited list of trusted
plugins. I think it's dangerous to give these interfaces to all trusted plugins
(some of these interface have Flash, i.e. it should be enforced that only Flash
uses them).

As for enforcement in render, I think it is better to do in browser during
processing TCPSocket_Create/UDPSocket_Create. I tried to do it but failed to do
it easy because Pepper message filter in browser miss context what page sent the
request (or which exactly plugin did it).

 extern const char kAllowSandboxDebugging[];
 extern const char kAuditHandles[];
 extern const char kAuditAllHandles[];