[sensors] Add Permission guard to the generic sensor apis.

third_party/WebKit/Source/modules/sensor/Sensor.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/sensor/Sensor.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContextTask.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "device/generic_sensor/public/interfaces/sensor.mojom-blink.h"
 #include "modules/sensor/SensorErrorEvent.h"
 #include "modules/sensor/SensorPollingStrategy.h"
 #include "modules/sensor/SensorProviderProxy.h"
 #include "modules/sensor/SensorReading.h"
+#include "platform/UserGestureIndicator.h"
 
 using namespace device::mojom::blink;
 
 namespace blink {
 
 Sensor::Sensor(ScriptState* scriptState,
                const SensorOptions& sensorOptions,
                ExceptionState& exceptionState,
                SensorType type)
     : ActiveScriptWrappable(this),
@@ skipping 39 matching lines @@
 
 void Sensor::start(ScriptState* scriptState, ExceptionState& exceptionState) {
   if (m_state != Sensor::SensorState::IDLE &&
       m_state != Sensor::SensorState::ERRORED) {
     exceptionState.throwDOMException(
         InvalidStateError,
         "Cannot start because SensorState is not idle or errored");
     return;
   }
 
+  // If the algorithm is not allowed to show a popup, throw SecurityError.
+  if (!UserGestureIndicator::consumeUserGesture()) {

[shalamov, 2016/11/16 11:10:22]

I have two comments for this line:

1. Since it does not need anything from the sensor, it can be moved to the proxy
where all permissions are handled now.

2. Why is this needed?

[riju_, 2016/11/16 12:38:25]

I am removing it now, as getting "sensor" information might not qualify as very
security-sensitive, as defined in
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/platform/UserG...

Let's check if this is required with the security-folks. If needed, I will add
this back to SensorProxy.

+    exceptionState.throwDOMException(
+        SecurityError,
+        "Must be handling a user gesture to show a permission request.");
+    return;
+  }
+
   initSensorProxyIfNeeded();
 
   if (!m_sensorProxy) {
     exceptionState.throwDOMException(
         InvalidStateError, "The Sensor is no longer associated to a frame.");
     return;
   }
 
   startListening();
 }
@@ skipping 75 matching lines @@
     return;
 
   Document* document = toDocument(getExecutionContext());
   if (!document || !document->frame())
     return;
 
   auto provider = SensorProviderProxy::from(document->frame());
   m_sensorProxy = provider->getSensor(m_type);
 
   if (!m_sensorProxy) {
-    m_sensorProxy =
-        provider->createSensor(m_type, createSensorReadingFactory());
+    m_sensorProxy = provider->createSensor(m_type, getExecutionContext(),
+                                           createSensorReadingFactory());
   }
 }
 
 void Sensor::contextDestroyed() {
   if (m_state == Sensor::SensorState::ACTIVE ||
       m_state == Sensor::SensorState::ACTIVATING)
     stopListening();
 }
 
 void Sensor::onSensorInitialized() {
@@ skipping 166 matching lines @@
 void Sensor::notifyStateChanged() {
   dispatchEvent(Event::create(EventTypeNames::statechange));
 }
 
 void Sensor::notifyError(DOMException* error) {
   dispatchEvent(
       SensorErrorEvent::create(EventTypeNames::error, std::move(error)));
 }
 
 }  // namespace blink