Require secure contexts and user gestures to use WebUSB.

third_party/WebKit/Source/modules/webusb/USB.cpp

Index: third_party/WebKit/Source/modules/webusb/USB.cpp
diff --git a/third_party/WebKit/Source/modules/webusb/USB.cpp b/third_party/WebKit/Source/modules/webusb/USB.cpp
index 213b3aafac20515ab5b5c62d925ec6fb1ae8b177..af7db9038a6d486143eafd36824f0cacad61da16 100644
--- a/third_party/WebKit/Source/modules/webusb/USB.cpp
+++ b/third_party/WebKit/Source/modules/webusb/USB.cpp
@@ -18,6 +18,7 @@
 #include "modules/webusb/USBDeviceFilter.h"
 #include "modules/webusb/USBDeviceRequestOptions.h"
 #include "modules/webusb/USBError.h"
+#include "platform/UserGestureIndicator.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebVector.h"
 #include "public/platform/modules/webusb/WebUSBClient.h"
@@ -93,6 +94,10 @@ ScriptPromise USB::getDevices(ScriptState* scriptState)
     if (!m_client)
         return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(NotSupportedError));
 
+    String errorMessage;
+    if (!scriptState->executionContext()->isSecureContext(errorMessage))
+        return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(SecurityError, errorMessage));
+
     ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
     ScriptPromise promise = resolver->promise();
     m_client->getDevices(new CallbackPromiseAdapter<DeviceArray, USBError>(resolver));
@@ -105,6 +110,13 @@ ScriptPromise USB::requestDevice(ScriptState* scriptState, const USBDeviceReques
     if (!m_client)
         return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(NotSupportedError));
 
+    String errorMessage;
+    if (!scriptState->executionContext()->isSecureContext(errorMessage))
+        return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(SecurityError, errorMessage));
+
+    if (!UserGestureIndicator::consumeUserGesture())
+        return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(SecurityError, "Must be handling a user gesture to show a permission request."));
+
     ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
     ScriptPromise promise = resolver->promise();