Add --disable-webusb-security flag for testing existing devices.

Add --disable-webusb-security flag for testing existing devices.

This flag disables checking of the WebUSB allowed origins descriptors
that implement a CORS-like mechanism to secure origin to device
communications. This is intended for early adopters testing their
existing devices with WebUSB before they can update their firmware or
the public device registry (issue 598765) is implemented.

BUG=598763
Committed: https://crrev.com/344e0fd8d4c91ca9244055b27b521c24a08020cb
Cr-Commit-Position: refs/heads/master@{#384098}

[Reilly Grant (use Gerrit), 2016-03-29 20:23:57]

reillyg@chromium.org changed reviewers:
+ estark@chromium.org, pkasting@chromium.org

[Reilly Grant (use Gerrit), 2016-03-29 20:23:58]

pkasting@ for an OWNERS review.
estark@ for a security review.

[Peter Kasting, 2016-03-29 23:29:31]

LGTM since it seems like this flag has a deprecation plan.

https://codereview.chromium.org/1842643004/diff/1/chrome/browser/usb/usb_choo...
File chrome/browser/usb/usb_chooser_bubble_controller.cc (right):

https://codereview.chromium.org/1842643004/diff/1/chrome/browser/usb/usb_choo...
chrome/browser/usb/usb_chooser_bubble_controller.cc:36: return
device::FindInWebUsbAllowedOrigins(allowed_origins, origin);
Nit: Shorter:

  return base::CommandLine::ForCurrentProcess()->HasSwitch(
             switches::kDisableWebUsbSecurity) ||
         device::FindInWebUsbAllowedOrigins(allowed_origins, origin);

https://codereview.chromium.org/1842643004/diff/1/chrome/browser/usb/usb_choo...
chrome/browser/usb/usb_chooser_bubble_controller.cc:124:
::FindInWebUsbAllowedOrigins(
Don't make changes where we add identically-named functions such that the
presence or absence of :: matters.

Instead, either put the changes you've made above into the function these were
previously referencing, or use a different function name.  (2 places)

[estark, 2016-03-30 00:45:18]

lgtm but can you clarify the deprecation plan? Specifically, I imagine that even
once the public registry is live, developers will want to use this flag to test
their devices before putting them on the public registry. Will there be some
other way to do that so that this flag can go away?

[Reilly Grant (use Gerrit), 2016-03-30 17:32:42]

On 2016/03/30 at 00:45:18, estark wrote:
> lgtm but can you clarify the deprecation plan? Specifically, I imagine that
even once the public registry is live, developers will want to use this flag to
test their devices before putting them on the public registry. Will there be
some other way to do that so that this flag can go away?

Yes, the deprecation plan is to provide a local whitelisting UI either as part
of DevTools or on a chrome://webusb-internals page so that developers can
whitelist individual devices. This is tracked by https://crbug.com/598766.

[estark, 2016-03-30 17:34:03]

On 2016/03/30 17:32:42, Reilly Grant wrote:
> On 2016/03/30 at 00:45:18, estark wrote:
> > lgtm but can you clarify the deprecation plan? Specifically, I imagine that
> even once the public registry is live, developers will want to use this flag
to
> test their devices before putting them on the public registry. Will there be
> some other way to do that so that this flag can go away?
> 
> Yes, the deprecation plan is to provide a local whitelisting UI either as part
> of DevTools or on a chrome://webusb-internals page so that developers can
> whitelist individual devices. This is tracked by https://crbug.com/598766.

Ok, SG, thanks.

[Reilly Grant (use Gerrit), 2016-03-30 20:26:43]

https://codereview.chromium.org/1842643004/diff/1/chrome/browser/usb/usb_choo...
File chrome/browser/usb/usb_chooser_bubble_controller.cc (right):

https://codereview.chromium.org/1842643004/diff/1/chrome/browser/usb/usb_choo...
chrome/browser/usb/usb_chooser_bubble_controller.cc:36: return
device::FindInWebUsbAllowedOrigins(allowed_origins, origin);
On 2016/03/29 at 23:29:31, Peter Kasting wrote:
> Nit: Shorter:
> 
>   return base::CommandLine::ForCurrentProcess()->HasSwitch(
>              switches::kDisableWebUsbSecurity) ||
>          device::FindInWebUsbAllowedOrigins(allowed_origins, origin);

Done.

https://codereview.chromium.org/1842643004/diff/1/chrome/browser/usb/usb_choo...
chrome/browser/usb/usb_chooser_bubble_controller.cc:124:
::FindInWebUsbAllowedOrigins(
On 2016/03/29 at 23:29:31, Peter Kasting wrote:
> Don't make changes where we add identically-named functions such that the
presence or absence of :: matters.
> 
> Instead, either put the changes you've made above into the function these were
previously referencing, or use a different function name.  (2 places)

Layering-wise I can't move the check into device::FindInWebUsbAllowedOrigins but
I've made a new function UsbChooserBubbleController::DisplayDevice() that
contains the whole boolean expression from this if statement (including the new
logic) and puts it in a single place so that at least it isn't duplicated here
and in GotUsbDeviceList.

[Reilly Grant (use Gerrit), 2016-03-30 20:26:54]

The CQ bit was checked by reillyg@chromium.org

[Reilly Grant (use Gerrit), 2016-03-30 20:26:54]

The patchset sent to the CQ was uploaded after l-g-t-m from
pkasting@chromium.org, estark@chromium.org
Link to the patchset: https://codereview.chromium.org/1842643004/#ps20001
(title: "Renamed and refactored FindInWebUsbAllowedOrigins.")

[commit-bot: I haz the power, 2016-03-30 20:27:08]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1842643004/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1842643004/20001

[commit-bot: I haz the power, 2016-03-30 21:36:15]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-03-30 21:37:45]

Description was changed from

==========
Add --disable-webusb-security flag for testing existing devices.

This flag disables checking of the WebUSB allowed origins descriptors
that implement a CORS-like mechanism to secure origin to device
communications. This is intended for early adopters testing their
existing devices with WebUSB before they can update their firmware or
the public device registry (issue 598765) is implemented.

BUG=598763
==========

to

==========
Add --disable-webusb-security flag for testing existing devices.

This flag disables checking of the WebUSB allowed origins descriptors
that implement a CORS-like mechanism to secure origin to device
communications. This is intended for early adopters testing their
existing devices with WebUSB before they can update their firmware or
the public device registry (issue 598765) is implemented.

BUG=598763

Committed: https://crrev.com/344e0fd8d4c91ca9244055b27b521c24a08020cb
Cr-Commit-Position: refs/heads/master@{#384098}
==========

[commit-bot: I haz the power, 2016-03-30 21:37:46]

Patchset 2 (id:??) landed as
https://crrev.com/344e0fd8d4c91ca9244055b27b521c24a08020cb
Cr-Commit-Position: refs/heads/master@{#384098}