Media permissions: Remove plumbing for insecure pepper requests in Chrome

chrome/browser/media/media_stream_device_permission_context.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/media/media_stream_device_permission_context.h"
 #include "chrome/browser/media/media_stream_device_permissions.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/pref_names.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/content_settings/core/common/content_settings.h"
@@ skipping 17 matching lines @@
     const PermissionRequestID& id,
     const GURL& requesting_frame,
     const BrowserPermissionCallback& callback) {
   NOTREACHED() << "RequestPermission is not implemented";
   callback.Run(CONTENT_SETTING_BLOCK);
 }
 
 ContentSetting MediaStreamDevicePermissionContext::GetPermissionStatus(
     const GURL& requesting_origin,
     const GURL& embedding_origin) const {
-  return GetPermissionStatusInternal(requesting_origin, embedding_origin,
-                                     false);
-}
-
-ContentSetting MediaStreamDevicePermissionContext::
-    GetPermissionStatusAllowingInsecureForPepper(
-        const GURL& requesting_origin,
-        const GURL& embedding_origin) const {
-  return GetPermissionStatusInternal(requesting_origin, embedding_origin, true);
+  return GetPermissionStatusInternal(requesting_origin, embedding_origin);

[raymes, 2016/06/06 05:11:10]

nit: should we inline this now?

[tsergeant, 2016/06/06 07:19:33]

Done.

 }
 
 void MediaStreamDevicePermissionContext::ResetPermission(
     const GURL& requesting_origin,
     const GURL& embedding_origin) {
   NOTREACHED() << "ResetPermission is not implemented";
 }
 
 void MediaStreamDevicePermissionContext::CancelPermissionRequest(
     content::WebContents* web_contents,
     const PermissionRequestID& id) {
   NOTREACHED() << "CancelPermissionRequest is not implemented";
 }
 
 ContentSetting MediaStreamDevicePermissionContext::GetPermissionStatusInternal(
     const GURL& requesting_origin,
-    const GURL& embedding_origin,
-    bool is_pepper_request) const {
+    const GURL& embedding_origin) const {
   // TODO(raymes): Merge this policy check into content settings
   // crbug.com/244389.
   const char* policy_name = nullptr;
   const char* urls_policy_name = nullptr;
   if (content_settings_type_ == CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC) {
     policy_name = prefs::kAudioCaptureAllowed;
     urls_policy_name = prefs::kAudioCaptureAllowedUrls;
   } else {
     DCHECK(content_settings_type_ == CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA);
     policy_name = prefs::kVideoCaptureAllowed;
@@ skipping 13 matching lines @@
   }
 
   // Check the content setting. TODO(raymes): currently mic/camera permission
   // doesn't consider the embedder.
   ContentSetting setting = PermissionContextBase::GetPermissionStatus(
       requesting_origin, requesting_origin);
 
   if (setting == CONTENT_SETTING_DEFAULT)
     setting = CONTENT_SETTING_ASK;
 
-  // TODO(raymes): This is here for safety to ensure that we always ask the user
-  // even if a content setting is set to "allow" if the origin is insecure. In
-  // reality we shouldn't really need to check this here as we should respect
-  // the user's content setting. The problem is that pepper requests allow
-  // insecure origins to be persisted. We should remove this after
-  // crbug.com/526324 is fixed.
-  if (!ShouldPersistContentSetting(setting, requesting_origin,
-                                   is_pepper_request) &&
+  if (!ShouldPersistContentSetting(requesting_origin) &&
       !requesting_origin.SchemeIs(extensions::kExtensionScheme) &&
       !requesting_origin.SchemeIs(content::kChromeUIScheme) &&
       !requesting_origin.SchemeIs(content::kChromeDevToolsScheme)) {
     return CONTENT_SETTING_ASK;

[raymes, 2016/06/06 05:11:10]

I don't *think* we should ever hit this anymore.

I think we can delete this block and ShouldPersistContentSetting. The other two
places where it is used it is just used to check whether we should call
SetContentSetting. But that function will already check if the patterns are
valid.

[tsergeant, 2016/06/06 07:19:33]

Cool, I've removed it (I was unsure about whether the valid check was still
necessary).

   }
 
   return setting;
 }
 
 bool MediaStreamDevicePermissionContext::IsRestrictedToSecureOrigins() const {
   // Flash currently doesn't require secure origin to use mic/camera. If we
   // return true here, it'll break the use case like http://tinychat.com.
   // TODO(raymes): Change this to true after crbug.com/526324 is fixed.
   return false;
 }