Expand whitelist for media stream APIs.

chrome/renderer/chrome_content_renderer_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_content_renderer_client.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/path_service.h"
@@ skipping 761 matching lines @@
     WebPluginParams* params) {
   // Temporarily allow these URLs to run NaCl apps, as long as the manifest is
   // also whitelisted. We should remove this code when PNaCl ships.
   bool is_whitelisted_url =
       app_url.SchemeIs("https") &&
       (app_url.host() == "plus.google.com" ||
        app_url.host() == "plus.sandbox.google.com") &&
       manifest_url.SchemeIs("https") &&
       manifest_url.host() == "ssl.gstatic.com" &&
       ((manifest_url.path().find("s2/oz/nacl/") == 1) ||
-       (manifest_url.path().find("photos/nacl/") == 1));
+       (manifest_url.path().find("photos/nacl/") == 1) ||
+       (manifest_url.path().find("hangouts/nacl/") == 1));

[bbudge, 2013/09/06 18:50:57]

This expands the NaCl whitelist to hangouts.

 
   bool is_extension_from_webstore =
       extension && extension->from_webstore();
 
   bool is_invoked_by_hosted_app = extension &&
       extension->is_hosted_app() &&
       extension->web_extent().MatchesURL(app_url);
 
   // Allow built-in extensions and extensions under development.
   bool is_extension_unrestricted = extension &&
@@ skipping 482 matching lines @@
     return false;
 
   WebString tag_name = container->element().shadowHost().tagName();
   return tag_name.equals(WebString::fromUTF8(kWebViewTagName)) ||
     tag_name.equals(WebString::fromUTF8(kAdViewTagName));
 }
 
 bool ChromeContentRendererClient::AllowPepperMediaStreamAPI(
     const GURL& url) {
 #if !defined(OS_ANDROID)
-  std::string host = url.host();
   // Allow only the Hangouts app to use the MediaStream APIs. It's OK to check
   // the whitelist in the renderer, since we're only preventing access until
   // these APIs are public and stable.
-  if (url.SchemeIs(extensions::kExtensionScheme) &&
-      !host.compare("hpcogiolnobbkijnnkdahioejpdcdoph")) {
+  if (url.SchemeIs("https") &&
+      (url.host() == "plus.google.com" ||
+       url.host() == "plus.sandbox.google.com") &&
+      url.path().find("hangouts/") == 1) {

[bbudge, 2013/09/06 18:50:57]

This changes the way we identify the hangouts app. Now we look at the document
URL.

     return true;
   }
   // Allow access for tests.
   if (CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kEnablePepperTesting)) {
     return true;
   }
 #endif  // !defined(OS_ANDROID)
   return false;
 }
 
 bool ChromeContentRendererClient::ShouldReportDetailedMessageForSource(
     const base::string16& source) const {
   return GURL(source).SchemeIs(extensions::kExtensionScheme);
 }
 
 }  // namespace chrome