Whitelist hangouts.google.com further to allow video effects plugin access.

chrome/renderer/chrome_content_renderer_client.cc

Index: chrome/renderer/chrome_content_renderer_client.cc
diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index b70bbeb30f38116b330225195fd5cc357c2a915f..69b31a46e4d8bb0e110616e875eb2e305098ac10 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -928,13 +928,13 @@ bool ChromeContentRendererClient::IsNaClAllowed(
       // Whitelisted apps must be served over secure scheme.
       app_url.SchemeIsCryptographic() && manifest_url.SchemeIsFileSystem() &&
       manifest_url.inner_url()->SchemeIsCryptographic() &&
-      (base::EndsWith(app_url_host, "talkgadget.google.com",
+      (base::EndsWith(app_url_host, "hangouts.google.com",

[tommi (sloooow) - chröme, 2016/05/16 19:51:56]

It looks like this change doesn't make a difference - is it just moving this
check up or am I missing what the change is?

[AlexZ, 2016/05/17 16:43:56]

Was just making the two lists the same. Moving to single domain check.

+                      base::CompareCase::INSENSITIVE_ASCII) ||
+       base::EndsWith(app_url_host, "talkgadget.google.com",
                       base::CompareCase::INSENSITIVE_ASCII) ||
        base::EndsWith(app_url_host, "plus.google.com",
                       base::CompareCase::INSENSITIVE_ASCII) ||
        base::EndsWith(app_url_host, "plus.sandbox.google.com",
-                      base::CompareCase::INSENSITIVE_ASCII) ||
-       base::EndsWith(app_url_host, "hangouts.google.com",
                       base::CompareCase::INSENSITIVE_ASCII)) &&
       // The manifest must be loaded from the host's FileSystem.
       (manifest_fs_host == app_url_host);
@@ -1235,7 +1235,9 @@ bool ChromeContentRendererClient::AllowPepperMediaStreamAPI(
   // these APIs are public and stable.
   std::string url_host = url.host();
   if (url.SchemeIs("https") &&
-      (base::EndsWith(url_host, "talkgadget.google.com",
+      (base::EndsWith(url_host, "hangouts.google.com",

[tommi (sloooow) - chröme, 2016/05/16 19:51:56]

I guess this is the real change.  Since this looks like the same list as above
and we missed updating it before, can you extract the list out to where other
whitelists are at the top of the file, e.g.:

const char* const kPredefinedAllowedPepperMediaStreamOrigins[] = {
  "hangouts.google.com",
  "talkgadget.google.com",
  "plus.google.com",
  "plus.sandbox.google.com",
};


and then update this part and the one above to something like:

// Allow access for tests.
if (base::CommandLine::ForCurrentProcess()->HasSwitch(
        switches::kEnablePepperTesting)) {
  return true;
}

if (!url.SchemeIs("https"))  <- should we be using url::kHttpsScheme?
  return false;

if (!base::StartsWith(url.path(), "/hangouts/",
        base::CompareCase::INSENSITIVE_ASCII)) {
  return false;
}

std::string url_host = url.host();
for (const char* entry : kPredefinedAllowedPepperMediaStreamOrigins) {
  if (base::EndsWith(url_host, entry, base::CompareCase::INSENSITIVE_ASCII)
    return true;
}

return false;

[AlexZ, 2016/05/17 16:43:56]

Moving to single domain check.

+                      base::CompareCase::INSENSITIVE_ASCII) ||
+       base::EndsWith(url_host, "talkgadget.google.com",
                       base::CompareCase::INSENSITIVE_ASCII) ||
        base::EndsWith(url_host, "plus.google.com",
                       base::CompareCase::INSENSITIVE_ASCII) ||