Add explicit capability class enforcement.

services/shell/tests/connect/connect_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
 #include <utility>
 
@@ skipping 289 matching lines @@
   connection->GetInterface(&standalone_app);
   std::string string1, string2;
   base::RunLoop loop;
   standalone_app->ConnectToClassInterface(
       base::Bind(&ReceiveTwoStrings, &string1, &string2, &loop));
   loop.Run();
   EXPECT_EQ("PONG", string1);
   EXPECT_EQ("CLASS APP", string2);
 }
 
+TEST_F(ConnectTest, ConnectWithoutExplicitClassBlocked) {
+  // We not be able to bind a ClassInterfacePtr since the connect_unittest app
+  // does not explicitly request the "class" capability from
+  // connect_test_class_app. This test will hang if it is bound.
+  std::unique_ptr<Connection> connection =
+      connector()->Connect(kTestClassAppName);
+  test::mojom::ClassInterfacePtr class_interface;
+  connection->GetInterface(&class_interface);
+  base::RunLoop loop;
+  class_interface.set_connection_error_handler(base::Bind(&QuitLoop, &loop));
+  loop.Run();
+}
+
 TEST_F(ConnectTest, ConnectAsDifferentUser_Allowed) {
   std::unique_ptr<Connection> connection = connector()->Connect(kTestAppName);
   test::mojom::UserIdTestPtr user_id_test;
   connection->GetInterface(&user_id_test);
   mojom::ConnectResult result;
   Identity target(kTestClassAppName, base::GenerateGUID());
   Identity result_identity;
   {
     base::RunLoop loop;
     user_id_test->ConnectToClassAppAsDifferentUser(
@@ skipping 130 matching lines @@
       run_loop.Run();
       CompareConnectionState(
           kTestAppAName, test_name(), test_userid(), test_instance_id(),
           kTestAppAName, connection->GetRemoteIdentity().user_id(), remote_id);
     }
 
   }
 }
 
 }  // namespace shell