[HBD] Blanket BLOCK on all non-HTTP(s) and non-FILE URLs for Flash.

chrome/browser/plugins/plugin_utils.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/plugins/plugin_utils.h"
 
 #include "base/values.h"
+#include "chrome/common/chrome_features.h"
 #include "chrome/common/plugin_utils.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "content/public/common/webplugininfo.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 namespace {
 
 const char kFlashPluginID[] = "adobe-flash-player";
 
 void GetPluginContentSettingInternal(
     const HostContentSettingsMap* host_content_settings_map,
     bool use_javascript_setting,
-    const GURL& policy_url,
+    const url::Origin& policy_origin,
     const GURL& plugin_url,
     const std::string& resource,
     ContentSetting* setting,
     bool* uses_default_content_setting,
     bool* is_managed) {
+  GURL policy_url =
+      policy_origin.unique() ? GURL() : GURL(policy_origin.Serialize());
+
   std::unique_ptr<base::Value> value;
   content_settings::SettingInfo info;
   bool uses_plugin_specific_setting = false;
   if (use_javascript_setting) {
     value = host_content_settings_map->GetWebsiteSetting(
         policy_url, policy_url, CONTENT_SETTINGS_TYPE_JAVASCRIPT, std::string(),
         &info);
   } else {
+    // For non-JavaScript treated plugins (Flash), always return BLOCK if the
+    // top level origin is any scheme other HTTP, HTTPS, or FILE.
+    if (base::FeatureList::IsEnabled(features::kPreferHtmlOverPlugins) &&
+        !policy_url.SchemeIsHTTPOrHTTPS() && !policy_url.SchemeIsFile()) {

[jochen (gone - plz use gerrit), 2016/09/30 10:50:34]

aren't file urls unique as well?

[tommycli, 2016/09/30 17:44:43]

Surprisingly... no. I tested this, And I got:

WebSecurityOrigin isunique: 0 string: null
url::Origin isunique: 0 string: file://

I thought they were unique as well, but they don't seem to be.

[tommycli, 2016/09/30 17:46:21]

+cc dcheng/alexmos - I thought file:// urls were unique, but they don't seem to
be. - in either WebSecurityOrigin or url::Origin.

+      *setting = CONTENT_SETTING_BLOCK;
+      if (uses_default_content_setting)
+        *uses_default_content_setting = true;
+      if (is_managed)
+        *is_managed = true;
+      return;
+    }
+
     content_settings::SettingInfo specific_info;
     std::unique_ptr<base::Value> specific_setting =
         host_content_settings_map->GetWebsiteSetting(
             policy_url, plugin_url, CONTENT_SETTINGS_TYPE_PLUGINS, resource,
             &specific_info);
     content_settings::SettingInfo general_info;
     std::unique_ptr<base::Value> general_setting =
         host_content_settings_map->GetWebsiteSetting(
             policy_url, plugin_url, CONTENT_SETTINGS_TYPE_PLUGINS,
             std::string(), &general_info);
@@ skipping 20 matching lines @@
   if (is_managed)
     *is_managed = info.source == content_settings::SETTING_SOURCE_POLICY;
 }
 
 }  // namespace
 
 // static
 void PluginUtils::GetPluginContentSetting(
     const HostContentSettingsMap* host_content_settings_map,
     const content::WebPluginInfo& plugin,
-    const GURL& policy_url,
+    const url::Origin& policy_url,
     const GURL& plugin_url,
     const std::string& resource,
     ContentSetting* setting,
     bool* uses_default_content_setting,
     bool* is_managed) {
   GetPluginContentSettingInternal(host_content_settings_map,
                                   ShouldUseJavaScriptSettingForPlugin(plugin),
                                   policy_url, plugin_url, resource, setting,
                                   uses_default_content_setting, is_managed);
 }
 
 // static
 ContentSetting PluginUtils::GetFlashPluginContentSetting(
     const HostContentSettingsMap* host_content_settings_map,
-    const GURL& policy_url,
+    const url::Origin& policy_url,
     const GURL& plugin_url,
     bool* is_managed) {
   ContentSetting plugin_setting = CONTENT_SETTING_DEFAULT;
   GetPluginContentSettingInternal(
       host_content_settings_map, false /* use_javascript_setting */, policy_url,
       plugin_url, kFlashPluginID, &plugin_setting, nullptr, is_managed);
   return plugin_setting;
 }