Add a policy list for access to capture devices

chrome/browser/policy/policy_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 48 matching lines @@
 #include "chrome/browser/ui/host_desktop.h"
 #include "chrome/browser/ui/omnibox/location_bar.h"
 #include "chrome/browser/ui/omnibox/omnibox_edit_model.h"
 #include "chrome/browser/ui/omnibox/omnibox_view.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_process_type.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/content_settings.h"
+#include "chrome/common/content_settings_pattern.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_constants.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "content/public/browser/browser_child_process_host_iterator.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_data.h"
@@ skipping 1906 matching lines @@
   // ShowHomeButton has policy ID 35.
   EXPECT_NE(std::string::npos, text.find("<br>35  ---"));
   // BookmarkBarEnabled has policy ID 82.
   EXPECT_NE(std::string::npos, text.find("<br>82  ---"));
 }
 
 class MediaStreamDevicesControllerBrowserTest
     : public PolicyTest,
       public testing::WithParamInterface<bool> {
  public:
-  MediaStreamDevicesControllerBrowserTest() {
+  MediaStreamDevicesControllerBrowserTest()
+      : request_url_allowed_via_whitelist_(false) {
     policy_value_ = GetParam();
   }
   virtual ~MediaStreamDevicesControllerBrowserTest() {}
 
+  // Configure a given policy map.
+  // The |policy_name| is the name of either the audio or video capture allow
+  // policy and must never be NULL.
+  // |whitelist_policy| and |allow_rule| are optional.  If NULL, no whitelist
+  // policy is set.  If non-NULL, the request_url_ will be set to be non empty
+  // and the whitelist policy is set to contain either the |allow_rule| (if
+  // non-NULL) or an "allow all" wildcard.
+  void ConfigurePolicyMap(PolicyMap* policies, const char* policy_name,
+                          const char* whitelist_policy,
+                          const char* allow_rule) {
+    policies->Set(policy_name, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
+        base::Value::CreateBooleanValue(policy_value_));
+
+    if (whitelist_policy) {
+      // TODO(tommi): Remove the kiosk mode flag when the whitelist is visible
+      // in the media exceptions UI.
+      // See discussion here: https://codereview.chromium.org/15738004/
+      CommandLine::ForCurrentProcess()->AppendSwitch(switches::kKioskMode);
+
+      // Add an entry to the whitelist that allows the specified URL regardless
+      // of the setting of kAudioCapturedAllowed.
+      request_url_ = GURL("http://www.example.com/foo");
+      base::ListValue* list = new base::ListValue();
+      if (allow_rule) {
+        list->AppendString(allow_rule);
+        request_url_allowed_via_whitelist_ = true;
+      } else {
+        list->AppendString(ContentSettingsPattern::Wildcard().ToString());
+        // We should ignore all wildcard entries in the whitelist, so even
+        // though we've added an entry, it should be ignored and our expectation
+        // is that the request has not been allowed via the whitelist.
+        request_url_allowed_via_whitelist_ = false;
+      }
+      policies->Set(whitelist_policy, POLICY_LEVEL_MANDATORY,
+                    POLICY_SCOPE_USER, list);
+    }
+  }
+
   void Accept(const content::MediaStreamDevices& devices,
               scoped_ptr<content::MediaStreamUI> ui) {
-    if (policy_value_) {
+    if (policy_value_ || request_url_allowed_via_whitelist_) {
       ASSERT_EQ(1U, devices.size());
       ASSERT_EQ("fake_dev", devices[0].id);
     } else {
       ASSERT_EQ(0U, devices.size());
     }
   }
 
   void FinishAudioTest() {
-    content::MediaStreamRequest request(0, 0, GURL(),
+    content::MediaStreamRequest request(0, 0, request_url_.GetOrigin(),
                                         content::MEDIA_OPEN_DEVICE, "fake_dev",
                                         content::MEDIA_DEVICE_AUDIO_CAPTURE,
                                         content::MEDIA_NO_SERVICE);
     MediaStreamDevicesController controller(
         browser()->tab_strip_model()->GetActiveWebContents(), request,
         base::Bind(&MediaStreamDevicesControllerBrowserTest::Accept, this));
     controller.DismissInfoBarAndTakeActionOnSettings();
 
     MessageLoop::current()->QuitWhenIdle();
   }
 
   void FinishVideoTest() {
-    content::MediaStreamRequest request(0, 0, GURL(),
+    content::MediaStreamRequest request(0, 0, request_url_.GetOrigin(),
                                         content::MEDIA_OPEN_DEVICE, "fake_dev",
                                         content::MEDIA_NO_SERVICE,
                                         content::MEDIA_DEVICE_VIDEO_CAPTURE);
     MediaStreamDevicesController controller(
         browser()->tab_strip_model()->GetActiveWebContents(), request,
         base::Bind(&MediaStreamDevicesControllerBrowserTest::Accept, this));
     controller.DismissInfoBarAndTakeActionOnSettings();
 
     MessageLoop::current()->QuitWhenIdle();
   }
 
   bool policy_value_;
+  bool request_url_allowed_via_whitelist_;
+  GURL request_url_;
+  static const char kExampleRequestPattern[];
 };
 
+// static
+const char MediaStreamDevicesControllerBrowserTest::kExampleRequestPattern[] =
+    "http://[*.]example.com/";
+
 IN_PROC_BROWSER_TEST_P(MediaStreamDevicesControllerBrowserTest,
                        AudioCaptureAllowed) {
   content::MediaStreamDevices audio_devices;
   content::MediaStreamDevice fake_audio_device(
       content::MEDIA_DEVICE_AUDIO_CAPTURE, "fake_dev", "Fake Audio Device");
   audio_devices.push_back(fake_audio_device);
 
   PolicyMap policies;
-  policies.Set(key::kAudioCaptureAllowed, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER,
-               base::Value::CreateBooleanValue(policy_value_));
+  ConfigurePolicyMap(&policies, key::kAudioCaptureAllowed, NULL, NULL);
   UpdateProviderPolicy(policies);
 
   content::BrowserThread::PostTaskAndReply(
       content::BrowserThread::IO, FROM_HERE,
       base::Bind(&MediaCaptureDevicesDispatcher::OnAudioCaptureDevicesChanged,
                  base::Unretained(MediaCaptureDevicesDispatcher::GetInstance()),
                  audio_devices),
       base::Bind(&MediaStreamDevicesControllerBrowserTest::FinishAudioTest,
                  this));
 
   MessageLoop::current()->Run();
 }
 
 IN_PROC_BROWSER_TEST_P(MediaStreamDevicesControllerBrowserTest,
+                       AudioCaptureAllowedUrls) {
+  content::MediaStreamDevices audio_devices;
+  content::MediaStreamDevice fake_audio_device(
+      content::MEDIA_DEVICE_AUDIO_CAPTURE, "fake_dev", "Fake Audio Device");
+  audio_devices.push_back(fake_audio_device);
+
+  const char* allow_pattern[] = {
+    kExampleRequestPattern,
+    // This will set an allow-all policy whitelist.  Since we do not allow
+    // setting an allow-all entry in the whitelist, this entry should be ignored
+    // and therefore the request should be denied.
+    NULL,
+  };
+
+  for (size_t i = 0; i < arraysize(allow_pattern); ++i) {
+    PolicyMap policies;
+    ConfigurePolicyMap(&policies, key::kAudioCaptureAllowed,
+                       key::kAudioCaptureAllowedUrls, allow_pattern[i]);
+    UpdateProviderPolicy(policies);
+
+    content::BrowserThread::PostTaskAndReply(
+        content::BrowserThread::IO, FROM_HERE,
+        base::Bind(
+            &MediaCaptureDevicesDispatcher::OnAudioCaptureDevicesChanged,
+            base::Unretained(MediaCaptureDevicesDispatcher::GetInstance()),
+            audio_devices),
+        base::Bind(
+            &MediaStreamDevicesControllerBrowserTest::FinishAudioTest,
+            this));
+
+    MessageLoop::current()->Run();
+  }
+}
+
+IN_PROC_BROWSER_TEST_P(MediaStreamDevicesControllerBrowserTest,
                        VideoCaptureAllowed) {
   content::MediaStreamDevices video_devices;
   content::MediaStreamDevice fake_video_device(
       content::MEDIA_DEVICE_VIDEO_CAPTURE, "fake_dev", "Fake Video Device");
   video_devices.push_back(fake_video_device);
 
   PolicyMap policies;
-  policies.Set(key::kVideoCaptureAllowed, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER,
-               base::Value::CreateBooleanValue(policy_value_));
+  ConfigurePolicyMap(&policies, key::kVideoCaptureAllowed, NULL, NULL);
   UpdateProviderPolicy(policies);
 
   content::BrowserThread::PostTaskAndReply(
       content::BrowserThread::IO, FROM_HERE,
       base::Bind(&MediaCaptureDevicesDispatcher::OnVideoCaptureDevicesChanged,
                  base::Unretained(MediaCaptureDevicesDispatcher::GetInstance()),
                  video_devices),
       base::Bind(&MediaStreamDevicesControllerBrowserTest::FinishVideoTest,
                  this));
 
   MessageLoop::current()->Run();
 }
 
+IN_PROC_BROWSER_TEST_P(MediaStreamDevicesControllerBrowserTest,
+                       VideoCaptureAllowedUrls) {
+  content::MediaStreamDevices video_devices;
+  content::MediaStreamDevice fake_video_device(
+      content::MEDIA_DEVICE_VIDEO_CAPTURE, "fake_dev", "Fake Video Device");
+  video_devices.push_back(fake_video_device);
+
+  const char* allow_pattern[] = {
+    kExampleRequestPattern,
+    // This will set an allow-all policy whitelist.  Since we do not allow
+    // setting an allow-all entry in the whitelist, this entry should be ignored
+    // and therefore the request should be denied.
+    NULL,
+  };
+
+  for (size_t i = 0; i < arraysize(allow_pattern); ++i) {
+    PolicyMap policies;
+    ConfigurePolicyMap(&policies, key::kVideoCaptureAllowed,
+                       key::kVideoCaptureAllowedUrls, allow_pattern[i]);
+    UpdateProviderPolicy(policies);
+
+    content::BrowserThread::PostTaskAndReply(
+        content::BrowserThread::IO, FROM_HERE,
+        base::Bind(
+            &MediaCaptureDevicesDispatcher::OnVideoCaptureDevicesChanged,
+            base::Unretained(MediaCaptureDevicesDispatcher::GetInstance()),
+            video_devices),
+        base::Bind(
+            &MediaStreamDevicesControllerBrowserTest::FinishVideoTest,
+            this));
+
+    MessageLoop::current()->Run();
+  }
+}
+
 INSTANTIATE_TEST_CASE_P(MediaStreamDevicesControllerBrowserTestInstance,
                         MediaStreamDevicesControllerBrowserTest,
                         testing::Bool());
 
 #if !defined(OS_CHROMEOS)
 // Similar to PolicyTest but sets the proper policy before the browser is
 // started.
 class PolicyVariationsServiceTest : public PolicyTest {
  public:
   virtual void SetUpInProcessBrowserTestFixture() OVERRIDE {
@@ skipping 17 matching lines @@
       chrome_variations::VariationsService::GetVariationsServerURL(
           g_browser_process->local_state());
   EXPECT_TRUE(StartsWithASCII(url.spec(), default_variations_url, true));
   std::string value;
   EXPECT_TRUE(net::GetValueForKeyInQuery(url, "restrict", &value));
   EXPECT_EQ("restricted", value);
 }
 #endif
 
 }  // namespace policy