[Sensors] Allow Sensor API only on secure top-level browsing contexts and add frequency checks

third_party/WebKit/Source/modules/sensor/Sensor.cpp

Index: third_party/WebKit/Source/modules/sensor/Sensor.cpp
diff --git a/third_party/WebKit/Source/modules/sensor/Sensor.cpp b/third_party/WebKit/Source/modules/sensor/Sensor.cpp
index 872afd786fdd7de5f4333a06813c33abd1eb43ad..ae1fa919f8623b4d5bd4f92dbda9aac2684134b8 100644
--- a/third_party/WebKit/Source/modules/sensor/Sensor.cpp
+++ b/third_party/WebKit/Source/modules/sensor/Sensor.cpp
@@ -17,7 +17,7 @@ using namespace device::mojom::blink;
 
 namespace blink {
 
-Sensor::Sensor(ExecutionContext* executionContext, const SensorOptions& sensorOptions, SensorType type)
+Sensor::Sensor(ScriptState* scriptState, ExecutionContext* executionContext, const SensorOptions& sensorOptions, ExceptionState& exceptionState, SensorType type)
     : ActiveScriptWrappable(this)
     , ContextLifecycleObserver(executionContext)
     , PageVisibilityObserver(toDocument(executionContext)->page())
@@ -26,6 +26,31 @@ Sensor::Sensor(ExecutionContext* executionContext, const SensorOptions& sensorOp
     , m_state(Sensor::SensorState::IDLE)
     , m_storedData()
 {
+    // Check secure context.
+    String errorMessage;
+    if (!executionContext->isSecureContext(errorMessage)) {
+        exceptionState.throwDOMException(SecurityError, errorMessage);
+        return;
+    }
+
+    // Check top-level browsing context.
+    if (!scriptState->domWindow()->frame() || !scriptState->domWindow()->frame()->isMainFrame()) {

[haraken, 2016/09/19 13:09:41]

You need to add '!scriptState->domWindow() ||' as well.

[Mikhail, 2016/09/19 14:18:02]

Done.

+        exceptionState.throwSecurityError("Must be in a top-level browsing context");
+        return;
+    }
+
+    // Check the given frequency value.
+    if (m_sensorOptions.hasFrequency()) {
+        double frequency = m_sensorOptions.frequency();
+        if (frequency <= 0.0) {
+            exceptionState.throwRangeError("Frequency must be positive");

[shalamov, 2016/09/19 13:11:42]

nit: Dot at the end of error message.

[Mikhail, 2016/09/19 14:18:02]

Done.

+            return;
+        }
+        // Cap to 60.0 Hz
+        const double kMaxAllowedFrequency = 60.0;
+        if (frequency > kMaxAllowedFrequency)
+            m_sensorOptions.setFrequency(kMaxAllowedFrequency);
+    }
 }
 
 Sensor::~Sensor() = default;