Ban cross origin WebSocket connections to the service protocol

runtime/bin/vmservice/vmservice_io.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library vmservice_io;
 
 import 'dart:async';
 import 'dart:collection';
 import 'dart:convert';
 import 'dart:io';
 import 'dart:isolate';
 import 'dart:_vmservice';
 
 part 'loader.dart';
 part 'server.dart';
 
 // The TCP ip/port that the HTTP server listens on.
 int _port;
 String _ip;
 // Should the HTTP server auto start?
 bool _autoStart;
-
+// Should the HTTP server run in devmode?
+bool _originCheckDisabled;
 bool _isWindows = false;
 var _signalWatch;
 var _signalSubscription;
 
 // HTTP server.
 Server server;
 Future<Server> serverFuture;
 
 _lazyServerBoot() {
   if (server != null) {
     return;
   }
   // Lazily create service.
   var service = new VMService();
   // Lazily create server.
-  server = new Server(service, _ip, _port);
+  server = new Server(service, _ip, _port, _originCheckDisabled);
 }
 
 Future cleanupCallback() async {
   shutdownLoaders();
   // Cancel the sigquit subscription.
   if (_signalSubscription != null) {
     await _signalSubscription.cancel();
     _signalSubscription = null;
   }
   if (server != null) {
@@ skipping 102 matching lines @@
     Timer.run(() {});
   }
   scriptLoadPort.handler = _processLoadRequest;
   // Register signal handler after a small delay to avoid stalling main
   // isolate startup.
   _registerSignalHandlerTimer = new Timer(shortDelay, _registerSignalHandler);
   return scriptLoadPort;
 }
 
 _shutdown() native "VMServiceIO_Shutdown";