Web MIDI API: reject sysex permissions on non-secure schemes

chrome/browser/content_settings/permission_context_base_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/content_settings/permission_context_base.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "chrome/browser/content_settings/permission_queue_controller.h"
 #include "chrome/browser/infobars/infobar_service.h"
@@ skipping 160 matching lines @@
     EXPECT_TRUE(permission_context.permission_set());
     EXPECT_FALSE(permission_context.permission_granted());
     EXPECT_TRUE(permission_context.tab_context_updated());
 
     ContentSetting setting =
         profile()->GetHostContentSettingsMap()->GetContentSetting(
             url.GetOrigin(), url.GetOrigin(), type, std::string());
     EXPECT_EQ(CONTENT_SETTING_ASK, setting);
   }
 
+  void TestRequestPermissionNonSecureUrl(ContentSettingsType type) {
+    TestPermissionContext permission_context(profile(), type);
+    GURL url("http://www.google.com");
+    content::WebContentsTester::For(web_contents())->NavigateAndCommit(url);
+
+    const PermissionRequestID id(
+        web_contents()->GetRenderProcessHost()->GetID(),
+        web_contents()->GetRenderViewHost()->GetRoutingID(),
+        -1, GURL());
+    permission_context.RequestPermission(
+        web_contents(),
+        id, url, true,
+        base::Bind(&TestPermissionContext::TrackPermissionDecision,
+                   base::Unretained(&permission_context)));
+
+    EXPECT_TRUE(permission_context.permission_set());
+    EXPECT_FALSE(permission_context.permission_granted());
+    EXPECT_TRUE(permission_context.tab_context_updated());
+
+    ContentSetting setting =
+        profile()->GetHostContentSettingsMap()->GetContentSetting(
+            url.GetOrigin(), url.GetOrigin(), type, std::string());
+    EXPECT_EQ(CONTENT_SETTING_ASK, setting);
+  }
+
   void TestGrantAndRevoke_TestContent(ContentSettingsType type,
                                       ContentSetting expected_default) {
     TestPermissionContext permission_context(profile(), type);
-    GURL url("http://www.google.com");
+    GURL url("https://www.google.com");
     content::WebContentsTester::For(web_contents())->NavigateAndCommit(url);
 
     const PermissionRequestID id(
         web_contents()->GetRenderProcessHost()->GetID(),
         web_contents()->GetRenderViewHost()->GetRoutingID(),
         -1, GURL());
     permission_context.RequestPermission(
         web_contents(),
         id, url, true,
         base::Bind(&TestPermissionContext::TrackPermissionDecision,
@@ skipping 55 matching lines @@
   TestRequestPermissionInvalidUrl(CONTENT_SETTINGS_TYPE_GEOLOCATION);
   TestRequestPermissionInvalidUrl(CONTENT_SETTINGS_TYPE_NOTIFICATIONS);
   TestRequestPermissionInvalidUrl(CONTENT_SETTINGS_TYPE_MIDI_SYSEX);
   TestRequestPermissionInvalidUrl(CONTENT_SETTINGS_TYPE_PUSH_MESSAGING);
 #if defined(OS_ANDROID) || defined(OS_CHROMEOS)
   TestRequestPermissionInvalidUrl(
       CONTENT_SETTINGS_TYPE_PROTECTED_MEDIA_IDENTIFIER);
 #endif
 }
 
+// Simulates non-secure requesting URL.
+// Web MIDI permission should be denied for non-secure origin.
 // Simulates granting and revoking of permissions.
+TEST_F(PermissionContextBaseTests, TestNonSecureRequestingUrl) {
+  TestRequestPermissionNonSecureUrl(CONTENT_SETTINGS_TYPE_MIDI_SYSEX);
+}
+
 TEST_F(PermissionContextBaseTests, TestGrantAndRevoke) {
   TestGrantAndRevoke_TestContent(CONTENT_SETTINGS_TYPE_GEOLOCATION,
                                  CONTENT_SETTING_ASK);
   TestGrantAndRevoke_TestContent(CONTENT_SETTINGS_TYPE_MIDI_SYSEX,
                                  CONTENT_SETTING_ASK);
 #if defined(OS_ANDROID)
   TestGrantAndRevoke_TestContent(
       CONTENT_SETTINGS_TYPE_PROTECTED_MEDIA_IDENTIFIER, CONTENT_SETTING_ASK);
 #endif
   // TODO(timvolodine): currently no test for
@@ skipping 15 matching lines @@
 #endif
   TestGrantAndRevoke_TestContent(CONTENT_SETTINGS_TYPE_MIDI_SYSEX,
                                  CONTENT_SETTING_ASK);
   TestGrantAndRevoke_TestContent(CONTENT_SETTINGS_TYPE_PUSH_MESSAGING,
                                  CONTENT_SETTING_ASK);
 #if defined(OS_ANDROID)
   TestGrantAndRevoke_TestContent(
       CONTENT_SETTINGS_TYPE_PROTECTED_MEDIA_IDENTIFIER, CONTENT_SETTING_ASK);
 #endif
 }