Disallow use of Web Bluetooth from cross-origin iframes.

content/browser/bluetooth/bluetooth_dispatcher_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // ID Not In Map Note:
 // A service, characteristic, or descriptor ID not in the corresponding
 // BluetoothDispatcherHost map [service_to_device_, characteristic_to_service_,
 // descriptor_to_characteristic_] implies a hostile renderer because a renderer
 // obtains the corresponding ID from this class and it will be added to the map
 // at that time.
@@ skipping 1119 matching lines @@
         thread_id, request_id,
         WebBluetoothError::REQUEST_DEVICE_WITHOUT_FRAME));
     return;
   }
 
   const url::Origin requesting_origin =
       render_frame_host->GetLastCommittedOrigin();
   const url::Origin embedding_origin =
       web_contents->GetMainFrame()->GetLastCommittedOrigin();
 
-  if (requesting_origin.unique()) {
-    VLOG(1) << "Request device with unique origin.";

[Jeffrey Yasskin, 2016/04/06 05:38:31]

I'm dropping the VLOG because we send the same information to the renderer's
console, and it's nice to avoid extra strings in the release build.

+  // TODO(crbug.com/518042): Enforce correctly-delegated permissions instead of
+  // matching origins. When relaxing this, take care to handle non-sandboxed
+  // unique origins.
+  if (embedding_origin != requesting_origin) {

[Mike West, 2016/04/06 06:06:59]

I'd prefer `!embedding_origin.IsSameOriginWith(requesting_origin)` here. As
noted down in origin.h, we only added `==` to make test matchers like
`EXPECT_EQ` happy, as they provide helpful output. Given the non-reflexive
behavior, I think it might be confusing for `==` to spread throughout the
codebase.

[Jeffrey Yasskin, 2016/04/06 06:17:15]

Done, thanks for the clear opinion and rationale.

     Send(new BluetoothMsg_RequestDeviceError(
         thread_id, request_id,
-        WebBluetoothError::REQUEST_DEVICE_WITH_UNIQUE_ORIGIN));
+        WebBluetoothError::REQUEST_DEVICE_FROM_CROSS_ORIGIN_IFRAME));
     return;
   }
+  // The above also excludes unique origins, which are not even same-origin with
+  // themselves.
+  DCHECK(!requesting_origin.unique());
 
   DCHECK(adapter_.get());
 
   if (!adapter_->IsPresent()) {
     VLOG(1) << "Bluetooth Adapter not present. Can't serve requestDevice.";
     RecordRequestDeviceOutcome(
         UMARequestDeviceOutcome::BLUETOOTH_ADAPTER_NOT_PRESENT);
     Send(new BluetoothMsg_RequestDeviceError(
         thread_id, request_id, WebBluetoothError::NO_BLUETOOTH_ADAPTER));
     return;
@@ skipping 459 matching lines @@
 
 bool BluetoothDispatcherHost::CanFrameAccessCharacteristicInstance(
     int frame_routing_id,
     const std::string& characteristic_instance_id) {
   return QueryCacheForCharacteristic(GetOrigin(frame_routing_id),
                                      characteristic_instance_id)
              .outcome != CacheQueryOutcome::BAD_RENDERER;
 }
 
 }  // namespace content