Web MIDI API: reject sysex permissions on non-secure schemes

chrome/browser/content_settings/permission_context_base.cc

Index: chrome/browser/content_settings/permission_context_base.cc
diff --git a/chrome/browser/content_settings/permission_context_base.cc b/chrome/browser/content_settings/permission_context_base.cc
index 8868965621f48d828be8e6e27fc5847e524ba4ba..6ce8d1295309dedfccffa65556387eb8cac015a8 100644
--- a/chrome/browser/content_settings/permission_context_base.cc
+++ b/chrome/browser/content_settings/permission_context_base.cc
@@ -104,6 +104,15 @@ void PermissionContextBase::DecidePermission(
     return;
   }
 
+  // The Web MIDI API is not available for origin with non secure schemes.
+  // Access to the MIDI API is blocked.
+  if (permission_type_ == CONTENT_SETTINGS_TYPE_MIDI_SYSEX &&
+      !requesting_origin.SchemeIsSecure()) {
+    NotifyPermissionSet(id, requesting_origin, embedding_origin, callback,
+                        false /* persist */, CONTENT_SETTING_BLOCK);
+    return;
+  }
+
   ContentSetting content_setting =
       profile_->GetHostContentSettingsMap()
           ->GetContentSettingAndMaybeUpdateLastUsage(