Change Win32k PPAPI lockdown to use finch params for mime type.

content/browser/ppapi_plugin_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/ppapi_plugin_process_host.h"
 
 #include <stddef.h>
 
 #include <string>
 #include <utility>
@@ skipping 71 matching lines @@
 
     // The Pepper process is as locked-down as a renderer except that it can
     // create the server side of Chrome pipes.
     sandbox::ResultCode result;
     result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
                              sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY,
                              L"\\\\.\\pipe\\chrome.*");
     if (result != sandbox::SBOX_ALL_OK)
       return false;
 
+    content::ContentBrowserClient* browser_client =
+        GetContentClient()->browser();
+
 #if !defined(NACL_WIN64)
-    for (const auto& mime_type : info_.mime_types) {
-      if (IsWin32kLockdownEnabledForMimeType(mime_type.mime_type)) {
-        if (!AddWin32kLockdownPolicy(policy))
-          return false;
-        break;
+    if (IsWin32kRendererLockdownEnabled()) {
+      for (const auto& mime_type : info_.mime_types) {
+        if (browser_client->IsWin32kLockdownEnabledForMimeType(
+                mime_type.mime_type)) {
+          if (!AddWin32kLockdownPolicy(policy))
+            return false;
+          break;
+        }
       }
     }
 #endif
     const base::string16& sid =
-        GetContentClient()->browser()->GetAppContainerSidForSandboxType(
-            GetSandboxType());
+        browser_client->GetAppContainerSidForSandboxType(GetSandboxType());
     if (!sid.empty())
       AddAppContainerPolicy(policy, sid.c_str());
 
     return true;
   }
 
 #elif defined(OS_POSIX)
 #if !defined(OS_MACOSX) && !defined(OS_ANDROID)
   ZygoteHandle* GetZygote() override {
     const base::CommandLine& browser_command_line =
@@ skipping 420 matching lines @@
   // sent_requests_ queue should be the one that the plugin just created.
   Client* client = sent_requests_.front();
   sent_requests_.pop();
 
   const ChildProcessData& data = process_->GetData();
   client->OnPpapiChannelOpened(channel_handle, base::GetProcId(data.handle),
                                data.id);
 }
 
 }  // namespace content