Web MIDI API: reject sysex permissions on non-secure schemes

Web MIDI API: reject sysex permissions on non-secure schemes

Since sysex messages are so powerful, Chrome does not allow sysex
permission for any requests from non-secure schemes.

TEST=manual check with simple page, and embedded iframe page.
BUG=470170
Committed: https://crrev.com/9eb573f4ea26fbc1ad3ba3d1988d5227b80fed36
Cr-Commit-Position: refs/heads/master@{#322761}

[Takashi Toyoshima, 2015-03-27 04:47:35]

toyoshim@chromium.org changed reviewers:
+ bauerb@chromium.org, markusheintz@chromium.org

[Takashi Toyoshima, 2015-03-27 04:51:20]

Hi, please take a look.

[markusheintz_, 2015-03-27 10:04:07]

markusheintz@chromium.org changed reviewers:
+ msramek@chromium.org

[markusheintz_, 2015-03-27 10:04:25]

On 2015/03/27 04:51:20, Takashi Toyoshima (chromium) wrote:
> Hi, please take a look.

LGTM

[msramek, 2015-03-27 11:48:10]

LGTM.

Note that it is still possible to set non-secure origin exceptions through the
the settings UI: chrome://settings/contentExceptions#midi-sysex

Please consider adding a similar protection there, or simply disable editing as
we do with some other types, such as geolocation or fullscreen.

[Takashi Toyoshima, 2015-03-27 12:22:15]

msramek: ok, I'll fix it in the next CL. I'll keep 470170 open until the next CL
is landed.

[Takashi Toyoshima, 2015-03-27 12:22:22]

The CQ bit was checked by toyoshim@chromium.org

[commit-bot: I haz the power, 2015-03-27 12:22:41]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1039123002/1

[commit-bot: I haz the power, 2015-03-27 13:07:13]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-03-27 13:07:14]

Try jobs failed on following builders:
  linux_chromium_chromeos_ozone_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Takashi Toyoshima, 2015-03-30 03:59:30]

The CQ bit was checked by toyoshim@chromium.org

[commit-bot: I haz the power, 2015-03-30 03:59:38]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1039123002/1

[commit-bot: I haz the power, 2015-03-30 05:05:36]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-03-30 05:05:37]

Try jobs failed on following builders:
  linux_chromium_chromeos_ozone_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Takashi Toyoshima, 2015-03-30 05:31:20]

Change the order to check the scheme just before checking stored content
settings so that it can reject safely even if the settings are mistakenly
modified.

Also, the test failures were the real. I changed the test to use https so that
the test still passes on the Web MIDI permission, and added a separate test for
http so to check Web MIDI permission is rejected on non-secure URL.

Markus: can you double check this again?

[markusheintz_, 2015-03-30 09:27:23]

LGTM with one nit

https://codereview.chromium.org/1039123002/diff/20001/chrome/browser/content_...
File chrome/browser/content_settings/permission_context_base.cc (right):

https://codereview.chromium.org/1039123002/diff/20001/chrome/browser/content_...
chrome/browser/content_settings/permission_context_base.cc:107: // Web MIDI API
does not allow any permissions for non secure schemes.
The Web MIDI API is not available for origin with non secure schemes. Access to
the MIDI API is blocked.

[Takashi Toyoshima, 2015-03-30 09:47:26]

https://codereview.chromium.org/1039123002/diff/20001/chrome/browser/content_...
File chrome/browser/content_settings/permission_context_base.cc (right):

https://codereview.chromium.org/1039123002/diff/20001/chrome/browser/content_...
chrome/browser/content_settings/permission_context_base.cc:107: // Web MIDI API
does not allow any permissions for non secure schemes.
On 2015/03/30 09:27:23, markusheintz_ wrote:
> The Web MIDI API is not available for origin with non secure schemes. Access
to
> the MIDI API is blocked.

Done.

[Takashi Toyoshima, 2015-03-30 09:47:31]

The CQ bit was checked by toyoshim@chromium.org

[Takashi Toyoshima, 2015-03-30 09:47:31]

The patchset sent to the CQ was uploaded after l-g-t-m from
msramek@chromium.org, markusheintz@chromium.org
Link to the patchset: https://codereview.chromium.org/1039123002/#ps40001
(title: "update test comment")

[commit-bot: I haz the power, 2015-03-30 09:47:53]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1039123002/40001

[commit-bot: I haz the power, 2015-03-30 10:39:47]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2015-03-30 10:40:18]

Patchset 3 (id:??) landed as
https://crrev.com/9eb573f4ea26fbc1ad3ba3d1988d5227b80fed36
Cr-Commit-Position: refs/heads/master@{#322761}