bluetooth: Test Web Bluetooth getCharacteristic calls against blacklist.

content/browser/bluetooth/bluetooth_dispatcher_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // ID Not In Map Note:
 // A service, characteristic, or descriptor ID not in the corresponding
 // BluetoothDispatcherHost map [service_to_device_, characteristic_to_service_,
 // descriptor_to_characteristic_] implies a hostile renderer because a renderer
 // obtains the corresponding ID from this class and it will be added to the map
 // at that time.
@@ skipping 774 matching lines @@
 void BluetoothDispatcherHost::OnGetCharacteristic(
     int thread_id,
     int request_id,
     int frame_routing_id,
     const std::string& service_instance_id,
     const std::string& characteristic_uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RecordWebBluetoothFunctionCall(UMAWebBluetoothFunction::GET_CHARACTERISTIC);
   RecordGetCharacteristicCharacteristic(characteristic_uuid);
 
+  // Check Blacklist for characteristic_uuid.
+  if (BluetoothBlacklist::Get().IsExcluded(

[ortuno, 2016/02/23 22:37:58]

You probably want to crash the renderer in QueryCacheForCharacteristic if the
UUID is blacklisted.

[scheib, 2016/02/24 19:51:28]

We discussed in person, and concluded that the initial blacklist checks will
result in service and characteristics not being found in respective lists and
also resulting in renderer crashes in QueryCache* methods if a blacklisted
resource is attempted to be accessed.

No code change made.

+          BluetoothUUID(characteristic_uuid))) {
+    RecordGetCharacteristicOutcome(UMAGetCharacteristicOutcome::BLACKLISTED);
+    Send(new BluetoothMsg_GetCharacteristicError(
+        thread_id, request_id,
+        WebBluetoothError::GetCharacteristicWithBlacklistedUUID));
+    return;
+  }
+
   const CacheQueryResult query_result =
       QueryCacheForService(GetOrigin(frame_routing_id), service_instance_id);
 
   if (query_result.outcome == CacheQueryOutcome::BAD_RENDERER) {
     return;
   }
 
   if (query_result.outcome != CacheQueryOutcome::SUCCESS) {
     RecordGetCharacteristicOutcome(query_result.outcome);
     Send(new BluetoothMsg_GetCharacteristicError(thread_id, request_id,
@@ skipping 717 matching lines @@
 
 bool BluetoothDispatcherHost::CanFrameAccessCharacteristicInstance(
     int frame_routing_id,
     const std::string& characteristic_instance_id) {
   return QueryCacheForCharacteristic(GetOrigin(frame_routing_id),
                                      characteristic_instance_id)
              .outcome != CacheQueryOutcome::BAD_RENDERER;
 }
 
 }  // namespace content