bluetooth: Implement allowed devices map

content/browser/bluetooth/bluetooth_dispatcher_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // ID Not In Map Note:
 // A service, characteristic, or descriptor ID not in the corresponding
 // BluetoothDispatcherHost map [service_to_device_, characteristic_to_service_,
 // descriptor_to_characteristic_] implies a hostile renderer because a renderer
 // obtains the corresponding ID from this class and it will be added to the map
 // at that time.
@@ skipping 321 matching lines @@
   // Clear adapter, releasing observer references.
   set_adapter(scoped_refptr<device::BluetoothAdapter>());
 }
 
 // Stores information associated with an in-progress requestDevice call. This
 // will include the state of the active chooser dialog in a future patch.
 struct BluetoothDispatcherHost::RequestDeviceSession {
  public:
   RequestDeviceSession(int thread_id,
                        int request_id,
+                       url::Origin origin,
                        const std::vector<BluetoothScanFilter>& filters,
                        const std::vector<BluetoothUUID>& optional_services)
       : thread_id(thread_id),
         request_id(request_id),
+        origin(origin),
         filters(filters),
         optional_services(optional_services) {}
 
   void AddFilteredDevice(const device::BluetoothDevice& device) {
     if (chooser && MatchesFilters(device, filters)) {
       chooser->AddDevice(device.GetAddress(), device.GetName());
     }
   }
 
   scoped_ptr<device::BluetoothDiscoveryFilter> ComputeScanFilter() const {
     std::set<BluetoothUUID> services;
     for (const BluetoothScanFilter& filter : filters) {
       services.insert(filter.services.begin(), filter.services.end());
     }
     scoped_ptr<device::BluetoothDiscoveryFilter> discovery_filter(
         new device::BluetoothDiscoveryFilter(
             device::BluetoothDiscoveryFilter::TRANSPORT_DUAL));
     for (const BluetoothUUID& service : services) {
       discovery_filter->AddUUID(service);
     }
     return discovery_filter;
   }
 
   const int thread_id;
   const int request_id;
+  const url::Origin origin;
   const std::vector<BluetoothScanFilter> filters;
   const std::vector<BluetoothUUID> optional_services;
   scoped_ptr<BluetoothChooser> chooser;
   scoped_ptr<device::BluetoothDiscoverySession> discovery_session;
 };
 
 struct BluetoothDispatcherHost::CacheQueryResult {
   CacheQueryResult()
       : device(nullptr),
         service(nullptr),
@@ skipping 132 matching lines @@
     if (session->chooser) {
       session->chooser->RemoveDevice(device->GetAddress());
     }
   }
 }
 
 void BluetoothDispatcherHost::GattServicesDiscovered(
     device::BluetoothAdapter* adapter,
     device::BluetoothDevice* device) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  const std::string& device_id = device->GetAddress();
-  VLOG(1) << "Services discovered for device: " << device_id;
+  const std::string& device_address = device->GetAddress();
+  VLOG(1) << "Services discovered for device: " << device_address;
 
-  auto iter = pending_primary_services_requests_.find(device_id);
+  auto iter = pending_primary_services_requests_.find(device_address);
   if (iter == pending_primary_services_requests_.end()) {
     return;
   }
   std::vector<PrimaryServicesRequest> requests;
   requests.swap(iter->second);
   pending_primary_services_requests_.erase(iter);
 
   for (const PrimaryServicesRequest& request : requests) {
     std::vector<BluetoothGattService*> services =
         GetPrimaryServicesByUUID(device, request.service_uuid);
     switch (request.func) {
       case PrimaryServicesRequest::GET_PRIMARY_SERVICE:
         if (!services.empty()) {
           AddToServicesMapAndSendGetPrimaryServiceSuccess(
               *services[0], request.thread_id, request.request_id);
         } else {
           VLOG(1) << "No service found";
           RecordGetPrimaryServiceOutcome(
               UMAGetPrimaryServiceOutcome::NOT_FOUND);
           Send(new BluetoothMsg_GetPrimaryServiceError(
               request.thread_id, request.request_id,
               WebBluetoothError::ServiceNotFound));
         }
         break;
       case PrimaryServicesRequest::GET_PRIMARY_SERVICES:
         NOTIMPLEMENTED();
         break;
     }
   }
-  DCHECK(!ContainsKey(pending_primary_services_requests_, device_id))
+  DCHECK(!ContainsKey(pending_primary_services_requests_, device_address))
       << "Sending get-service responses unexpectedly queued another request.";
 }
 
 void BluetoothDispatcherHost::GattCharacteristicValueChanged(
     device::BluetoothAdapter* adapter,
     device::BluetoothGattCharacteristic* characteristic,
     const std::vector<uint8_t>& value) {
   VLOG(1) << "Characteristic updated: " << characteristic->GetIdentifier();
   auto iter =
       active_characteristic_threads_.find(characteristic->GetIdentifier());
@@ skipping 84 matching lines @@
   // The renderer should never send empty filters.
   if (HasEmptyOrInvalidFilter(filters)) {
     bad_message::ReceivedBadMessage(this,
                                     bad_message::BDH_EMPTY_OR_INVALID_FILTERS);
     return;
   }
 
   // Create storage for the information that backs the chooser, and show the
   // chooser.
   RequestDeviceSession* const session = new RequestDeviceSession(
-      thread_id, request_id, filters, optional_services);
+      thread_id, request_id, render_frame_host->GetLastCommittedOrigin(),
+      filters, optional_services);
   int chooser_id = request_device_sessions_.Add(session);
 
   BluetoothChooser::EventHandler chooser_event_handler =
       base::Bind(&BluetoothDispatcherHost::OnBluetoothChooserEvent,
                  weak_ptr_on_ui_thread_, chooser_id);
   if (WebContents* web_contents =
           WebContents::FromRenderFrameHost(render_frame_host)) {
     if (WebContentsDelegate* delegate = web_contents->GetDelegate()) {
       session->chooser = delegate->RunBluetoothChooser(
           web_contents, chooser_event_handler,
+          // TODO(ortuno): Replace with GetLastCommittedOrigin.
+          // http://crbug.com/577451
           render_frame_host->GetLastCommittedURL().GetOrigin());
     }
   }
   if (!session->chooser) {
     LOG(WARNING)
         << "No Bluetooth chooser implementation; falling back to first device.";
     session->chooser.reset(
         new FirstDeviceBluetoothChooser(chooser_event_handler));
   }
 
@@ skipping 21 matching lines @@
     session->chooser->SetAdapterPresence(
         BluetoothChooser::AdapterPresence::POWERED_OFF);
     return;
   }
 
   StartDeviceDiscovery(session, chooser_id);
 }
 
 void BluetoothDispatcherHost::OnConnectGATT(int thread_id,
                                             int request_id,
+                                            int frame_routing_id,
                                             const std::string& device_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(UMAWebBluetoothFunction::CONNECT_GATT);
   const base::TimeTicks start_time = base::TimeTicks::Now();
 
-  // TODO(ortuno): Right now it's pointless to check if the domain has access to
-  // the device, because any domain can connect to any device. But once
-  // permissions are implemented we should check that the domain has access to
-  // the device. https://crbug.com/484745
-
-  const CacheQueryResult query_result = QueryCacheForDevice(device_id);
+  const CacheQueryResult query_result =
+      QueryCacheForDevice(GetOrigin(frame_routing_id), device_id);
 
   if (query_result.outcome != CacheQueryOutcome::SUCCESS) {
     RecordConnectGATTOutcome(query_result.outcome);
     Send(new BluetoothMsg_ConnectGATTError(thread_id, request_id,
                                            query_result.GetWebError()));
     return;
   }
 
   query_result.device->CreateGattConnection(
       base::Bind(&BluetoothDispatcherHost::OnGATTConnectionCreated,
                  weak_ptr_on_ui_thread_, thread_id, request_id, device_id,
                  start_time),
       base::Bind(&BluetoothDispatcherHost::OnCreateGATTConnectionError,
                  weak_ptr_on_ui_thread_, thread_id, request_id, device_id,
                  start_time));
 }
 
 void BluetoothDispatcherHost::OnGetPrimaryService(
     int thread_id,
     int request_id,
+    int frame_routing_id,
     const std::string& device_id,
     const std::string& service_uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(UMAWebBluetoothFunction::GET_PRIMARY_SERVICE);
   RecordGetPrimaryServiceService(BluetoothUUID(service_uuid));
 
-  // TODO(ortuno): Check if device_id is in "allowed devices"
-  // https://crbug.com/493459
   // TODO(ortuno): Check if service_uuid is in "allowed services"
   // https://crbug.com/493460
 
-  const CacheQueryResult query_result = QueryCacheForDevice(device_id);
+  const CacheQueryResult query_result =
+      QueryCacheForDevice(GetOrigin(frame_routing_id), device_id);
 
   if (query_result.outcome != CacheQueryOutcome::SUCCESS) {
     RecordGetPrimaryServiceOutcome(query_result.outcome);
     Send(new BluetoothMsg_GetPrimaryServiceError(thread_id, request_id,
                                                  query_result.GetWebError()));
     return;
   }
 
   // There are four possibilities here:
   // 1. Services not discovered and service present in |device|: Send back the
@@ skipping 23 matching lines @@
     VLOG(1) << "Service not found in device.";
     RecordGetPrimaryServiceOutcome(UMAGetPrimaryServiceOutcome::NOT_FOUND);
     Send(new BluetoothMsg_GetPrimaryServiceError(
         thread_id, request_id, WebBluetoothError::ServiceNotFound));
     return;
   }
 
   VLOG(1) << "Adding service request to pending requests.";
   // 4.
   AddToPendingPrimaryServicesRequest(
-      device_id,
+      query_result.device->GetAddress(),
       PrimaryServicesRequest(thread_id, request_id, service_uuid,
                              PrimaryServicesRequest::GET_PRIMARY_SERVICE));
 }
 
 void BluetoothDispatcherHost::OnGetCharacteristic(
     int thread_id,
     int request_id,
+    int frame_routing_id,
     const std::string& service_instance_id,
     const std::string& characteristic_uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(UMAWebBluetoothFunction::GET_CHARACTERISTIC);
   RecordGetCharacteristicCharacteristic(characteristic_uuid);
 
   const CacheQueryResult query_result =
-      QueryCacheForService(service_instance_id);
+      QueryCacheForService(GetOrigin(frame_routing_id), service_instance_id);
 
   if (query_result.outcome == CacheQueryOutcome::BAD_RENDERER) {
     return;
   }
 
   if (query_result.outcome != CacheQueryOutcome::SUCCESS) {
     RecordGetCharacteristicOutcome(query_result.outcome);
     Send(new BluetoothMsg_GetCharacteristicError(thread_id, request_id,
                                                  query_result.GetWebError()));
     return;
@@ skipping 22 matching lines @@
     }
   }
   RecordGetCharacteristicOutcome(UMAGetCharacteristicOutcome::NOT_FOUND);
   Send(new BluetoothMsg_GetCharacteristicError(
       thread_id, request_id, WebBluetoothError::CharacteristicNotFound));
 }
 
 void BluetoothDispatcherHost::OnReadValue(
     int thread_id,
     int request_id,
+    int frame_routing_id,
     const std::string& characteristic_instance_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(
       UMAWebBluetoothFunction::CHARACTERISTIC_READ_VALUE);
 
-  const CacheQueryResult query_result =
-      QueryCacheForCharacteristic(characteristic_instance_id);
+  const CacheQueryResult query_result = QueryCacheForCharacteristic(
+      GetOrigin(frame_routing_id), characteristic_instance_id);
 
   if (query_result.outcome == CacheQueryOutcome::BAD_RENDERER) {
     return;
   }
 
   if (query_result.outcome != CacheQueryOutcome::SUCCESS) {
     RecordCharacteristicReadValueOutcome(query_result.outcome);
     Send(new BluetoothMsg_ReadCharacteristicValueError(
         thread_id, request_id, query_result.GetWebError()));
     return;
   }
 
   query_result.characteristic->ReadRemoteCharacteristic(
       base::Bind(&BluetoothDispatcherHost::OnCharacteristicValueRead,
                  weak_ptr_on_ui_thread_, thread_id, request_id),
       base::Bind(&BluetoothDispatcherHost::OnCharacteristicReadValueError,
                  weak_ptr_on_ui_thread_, thread_id, request_id));
 }
 
 void BluetoothDispatcherHost::OnWriteValue(
     int thread_id,
     int request_id,
+    int frame_routing_id,
     const std::string& characteristic_instance_id,
     const std::vector<uint8_t>& value) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(
       UMAWebBluetoothFunction::CHARACTERISTIC_WRITE_VALUE);
 
   // Length check per step 3 of writeValue algorithm:
   // https://webbluetoothchrome.github.io/web-bluetooth/#dom-bluetoothgattcharacteristic-writevalue
   // We perform the length check on the renderer side. So if we
   // get a value with length > 512, we can assume it's a hostile
   // renderer and kill it.
   if (value.size() > 512) {
     bad_message::ReceivedBadMessage(
         this, bad_message::BDH_INVALID_WRITE_VALUE_LENGTH);
     return;
   }
 
-  const CacheQueryResult query_result =
-      QueryCacheForCharacteristic(characteristic_instance_id);
+  const CacheQueryResult query_result = QueryCacheForCharacteristic(
+      GetOrigin(frame_routing_id), characteristic_instance_id);
 
   if (query_result.outcome == CacheQueryOutcome::BAD_RENDERER) {
     return;
   }
 
   if (query_result.outcome != CacheQueryOutcome::SUCCESS) {
     RecordCharacteristicWriteValueOutcome(query_result.outcome);
     Send(new BluetoothMsg_WriteCharacteristicValueError(
         thread_id, request_id, query_result.GetWebError()));
     return;
   }
 
   query_result.characteristic->WriteRemoteCharacteristic(
       value, base::Bind(&BluetoothDispatcherHost::OnWriteValueSuccess,
                         weak_ptr_on_ui_thread_, thread_id, request_id),
       base::Bind(&BluetoothDispatcherHost::OnWriteValueFailed,
                  weak_ptr_on_ui_thread_, thread_id, request_id));
 }
 
 void BluetoothDispatcherHost::OnStartNotifications(
     int thread_id,
     int request_id,
+    int frame_routing_id,
     const std::string& characteristic_instance_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(
       UMAWebBluetoothFunction::CHARACTERISTIC_START_NOTIFICATIONS);
 
   // BluetoothDispatcher will never send a request for a characteristic
   // already subscribed to notifications.
   if (characteristic_id_to_notify_session_.find(characteristic_instance_id) !=
       characteristic_id_to_notify_session_.end()) {
     bad_message::ReceivedBadMessage(
         this, bad_message::BDH_CHARACTERISTIC_ALREADY_SUBSCRIBED);
     return;
   }
 
   // TODO(ortuno): Check if notify/indicate bit is set.
   // http://crbug.com/538869
 
-  const CacheQueryResult query_result =
-      QueryCacheForCharacteristic(characteristic_instance_id);
+  const CacheQueryResult query_result = QueryCacheForCharacteristic(
+      GetOrigin(frame_routing_id), characteristic_instance_id);
 
   if (query_result.outcome == CacheQueryOutcome::BAD_RENDERER) {
     return;
   }
 
   if (query_result.outcome != CacheQueryOutcome::SUCCESS) {
     RecordStartNotificationsOutcome(query_result.outcome);
     Send(new BluetoothMsg_StartNotificationsError(thread_id, request_id,
                                                   query_result.GetWebError()));
     return;
   }
 
   query_result.characteristic->StartNotifySession(
       base::Bind(&BluetoothDispatcherHost::OnStartNotifySessionSuccess,
                  weak_ptr_factory_.GetWeakPtr(), thread_id, request_id),
       base::Bind(&BluetoothDispatcherHost::OnStartNotifySessionFailed,
                  weak_ptr_factory_.GetWeakPtr(), thread_id, request_id));
 }
 
 void BluetoothDispatcherHost::OnStopNotifications(
     int thread_id,
     int request_id,
+    int frame_routing_id,
     const std::string& characteristic_instance_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(
       UMAWebBluetoothFunction::CHARACTERISTIC_STOP_NOTIFICATIONS);
 
+  // Check the origin is allowed to access the device. We perform this check in
+  // case a hostile renderer is trying to stop notifications for a device
+  // that the renderer is not allowed to access.
+  if (!CanFrameAccessCharacteristicInstance(frame_routing_id,
+                                            characteristic_instance_id)) {
+    return;
+  }
+
   auto notify_session_iter =
       characteristic_id_to_notify_session_.find(characteristic_instance_id);
   if (notify_session_iter == characteristic_id_to_notify_session_.end()) {
     Send(new BluetoothMsg_StopNotificationsSuccess(thread_id, request_id));
     return;
   }
   notify_session_iter->second->Stop(
       base::Bind(&BluetoothDispatcherHost::OnStopNotifySession,
                  weak_ptr_factory_.GetWeakPtr(), thread_id, request_id,
                  characteristic_instance_id));
 }
 
 void BluetoothDispatcherHost::OnRegisterCharacteristicObject(
     int thread_id,
+    int frame_routing_id,
     const std::string& characteristic_instance_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  // Make sure the origin is allowed to access the device.
+  if (!CanFrameAccessCharacteristicInstance(frame_routing_id,
+                                            characteristic_instance_id)) {
+    return;
+  }
   active_characteristic_threads_[characteristic_instance_id].insert(thread_id);
 }
 
 void BluetoothDispatcherHost::OnUnregisterCharacteristicObject(
     int thread_id,
+    int frame_routing_id,
     const std::string& characteristic_instance_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   auto active_iter =
       active_characteristic_threads_.find(characteristic_instance_id);
   if (active_iter == active_characteristic_threads_.end()) {
     return;
   }
   std::set<int>& thread_ids_set = active_iter->second;
   thread_ids_set.erase(thread_id);
   if (thread_ids_set.empty()) {
@@ skipping 105 matching lines @@
     VLOG(1) << "Bluetooth chooser denied permission";
     Send(new BluetoothMsg_RequestDeviceError(
         session->thread_id, session->request_id,
         WebBluetoothError::ChooserDeniedPermission));
     request_device_sessions_.Remove(chooser_id);
     return;
   }
   DCHECK_EQ(static_cast<int>(event),
             static_cast<int>(BluetoothChooser::Event::SELECTED));
 
+  // |device_id| is the Device Address that RequestDeviceSession passed to
+  // chooser->AddDevice().
   const device::BluetoothDevice* const device = adapter_->GetDevice(device_id);
   if (device == nullptr) {
     VLOG(1) << "Device " << device_id << " no longer in adapter";
     RecordRequestDeviceOutcome(UMARequestDeviceOutcome::CHOSEN_DEVICE_VANISHED);
     Send(new BluetoothMsg_RequestDeviceError(
         session->thread_id, session->request_id,
         WebBluetoothError::ChosenDeviceVanished));
     request_device_sessions_.Remove(chooser_id);
     return;
   }
 
   VLOG(1) << "Device: " << device->GetName();
   VLOG(1) << "UUIDs: ";
   for (BluetoothUUID uuid : device->GetUUIDs())
     VLOG(1) << "\t" << uuid.canonical_value();
 
+  const std::string& device_id_for_origin = allowed_devices_map_.AddDevice(
+      session->origin, device->GetAddress(), session->filters,
+      session->optional_services);
+
   content::BluetoothDevice device_ipc(
-      device->GetAddress(),  // id
+      device_id_for_origin,  // id
       device->GetName(),     // name
       content::BluetoothDevice::ValidatePower(
           device->GetInquiryTxPower()),  // tx_power
       content::BluetoothDevice::ValidatePower(
           device->GetInquiryRSSI()),  // rssi
       device->GetBluetoothClass(),    // device_class
       device->GetVendorIDSource(),    // vendor_id_source
       device->GetVendorID(),          // vendor_id
       device->GetProductID(),         // product_id
       device->GetDeviceID(),          // product_version
@@ skipping 32 matching lines @@
   // RecordConnectGATTOutcome is called by TranslateConnectError.
   Send(new BluetoothMsg_ConnectGATTError(thread_id, request_id,
                                          TranslateConnectError(error_code)));
 }
 
 void BluetoothDispatcherHost::AddToServicesMapAndSendGetPrimaryServiceSuccess(
     const device::BluetoothGattService& service,
     int thread_id,
     int request_id) {
   const std::string& service_identifier = service.GetIdentifier();
-  const std::string& device_id = service.GetDevice()->GetAddress();
+  const std::string& device_address = service.GetDevice()->GetAddress();
   auto insert_result =
-      service_to_device_.insert(make_pair(service_identifier, device_id));
+      service_to_device_.insert(make_pair(service_identifier, device_address));
 
   // If a value is already in map, DCHECK it's valid.
   if (!insert_result.second)
-    DCHECK_EQ(insert_result.first->second, device_id);
+    DCHECK_EQ(insert_result.first->second, device_address);
 
   RecordGetPrimaryServiceOutcome(UMAGetPrimaryServiceOutcome::SUCCESS);
   Send(new BluetoothMsg_GetPrimaryServiceSuccess(thread_id, request_id,
                                                  service_identifier));
 }
 
 void BluetoothDispatcherHost::OnCharacteristicValueRead(
     int thread_id,
     int request_id,
     const std::vector<uint8_t>& value) {
@@ skipping 60 matching lines @@
 
 void BluetoothDispatcherHost::OnStopNotifySession(
     int thread_id,
     int request_id,
     const std::string& characteristic_instance_id) {
   characteristic_id_to_notify_session_.erase(characteristic_instance_id);
   Send(new BluetoothMsg_StopNotificationsSuccess(thread_id, request_id));
 }
 
 BluetoothDispatcherHost::CacheQueryResult
-BluetoothDispatcherHost::QueryCacheForDevice(const std::string& device_id) {
+BluetoothDispatcherHost::QueryCacheForDevice(const url::Origin& origin,
+                                             const std::string& device_id) {
+  const std::string& device_address =
+      allowed_devices_map_.GetDeviceAddress(origin, device_id);
+  if (device_address.empty()) {
+    bad_message::ReceivedBadMessage(
+        this, bad_message::BDH_DEVICE_NOT_ALLOWED_FOR_ORIGIN);
+    return CacheQueryResult(CacheQueryOutcome::BAD_RENDERER);
+  }
+
   CacheQueryResult result;
-  result.device = adapter_->GetDevice(device_id);
+  result.device = adapter_->GetDevice(device_address);
+
   // When a device can't be found in the BluetoothAdapter, that generally
   // indicates that it's gone out of range. We reject with a NetworkError in
   // that case.
   // https://webbluetoothchrome.github.io/web-bluetooth/#dom-bluetoothdevice-connectgatt
   if (result.device == nullptr) {
     result.outcome = CacheQueryOutcome::NO_DEVICE;
   }
   return result;
 }
 
 BluetoothDispatcherHost::CacheQueryResult
 BluetoothDispatcherHost::QueryCacheForService(
+    const url::Origin& origin,
     const std::string& service_instance_id) {
   auto device_iter = service_to_device_.find(service_instance_id);
 
   // Kill the renderer, see "ID Not In Map Note" above.
   if (device_iter == service_to_device_.end()) {
     bad_message::ReceivedBadMessage(this, bad_message::BDH_INVALID_SERVICE_ID);
     return CacheQueryResult(CacheQueryOutcome::BAD_RENDERER);
   }
 
-  // TODO(ortuno): Check if domain has access to device.
-  // https://crbug.com/493459
+  const std::string& device_id =
+      allowed_devices_map_.GetDeviceId(origin, device_iter->second);
+  // Kill the renderer if the origin is not allowed to access the device.
+  if (device_id.empty()) {
+    bad_message::ReceivedBadMessage(
+        this, bad_message::BDH_DEVICE_NOT_ALLOWED_FOR_ORIGIN);
+    return CacheQueryResult(CacheQueryOutcome::BAD_RENDERER);
+  }
 
-  CacheQueryResult result = QueryCacheForDevice(device_iter->second);
+  CacheQueryResult result = QueryCacheForDevice(origin, device_id);
 
   if (result.outcome != CacheQueryOutcome::SUCCESS) {
     return result;
   }
 
   result.service = result.device->GetGattService(service_instance_id);
   if (result.service == nullptr) {
     result.outcome = CacheQueryOutcome::NO_SERVICE;
   }
   return result;
 }
 
 BluetoothDispatcherHost::CacheQueryResult
 BluetoothDispatcherHost::QueryCacheForCharacteristic(
+    const url::Origin& origin,
     const std::string& characteristic_instance_id) {
   auto characteristic_iter =
       characteristic_to_service_.find(characteristic_instance_id);
 
   // Kill the renderer, see "ID Not In Map Note" above.
   if (characteristic_iter == characteristic_to_service_.end()) {
     bad_message::ReceivedBadMessage(this,
                                     bad_message::BDH_INVALID_CHARACTERISTIC_ID);
     return CacheQueryResult(CacheQueryOutcome::BAD_RENDERER);
   }
 
-  CacheQueryResult result = QueryCacheForService(characteristic_iter->second);
+  CacheQueryResult result =
+      QueryCacheForService(origin, characteristic_iter->second);
   if (result.outcome != CacheQueryOutcome::SUCCESS) {
     return result;
   }
 
   result.characteristic =
       result.service->GetCharacteristic(characteristic_instance_id);
 
   if (result.characteristic == nullptr) {
     result.outcome = CacheQueryOutcome::NO_CHARACTERISTIC;
   }
 
   return result;
 }
 
 void BluetoothDispatcherHost::AddToPendingPrimaryServicesRequest(
-    const std::string& device_id,
+    const std::string& device_address,
     const PrimaryServicesRequest& request) {
-  pending_primary_services_requests_[device_id].push_back(request);
+  pending_primary_services_requests_[device_address].push_back(request);
+}
+
+url::Origin BluetoothDispatcherHost::GetOrigin(int frame_routing_id) {
+  return RenderFrameHostImpl::FromID(render_process_id_, frame_routing_id)
+      ->GetLastCommittedOrigin();
+}
+
+bool BluetoothDispatcherHost::CanFrameAccessCharacteristicInstance(
+    int frame_routing_id,
+    const std::string& characteristic_instance_id) {
+  return QueryCacheForCharacteristic(GetOrigin(frame_routing_id),
+                                     characteristic_instance_id)
+             .outcome != CacheQueryOutcome::BAD_RENDERER;
 }
 
 void BluetoothDispatcherHost::ShowBluetoothOverviewLink() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   NOTIMPLEMENTED();
 }
 
 void BluetoothDispatcherHost::ShowBluetoothPairingLink() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   NOTIMPLEMENTED();
 }
 
 void BluetoothDispatcherHost::ShowBluetoothAdapterOffLink() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   NOTIMPLEMENTED();
 }
 
 void BluetoothDispatcherHost::ShowNeedLocationLink() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   NOTIMPLEMENTED();
 }
 
 }  // namespace content