media: Restrict ProtectedMediaIdentifier permission to secure origins

media: Restrict ProtectedMediaIdentifier permission to secure origins

Currently EME is restricted to secure origins (see BUG). However, it's
possible that the renderer process is compromised and bypasses this
restriction. This CL restricts the ProtectedMediaIdentifier permission
to secure origin as well to add another layer of protection.

Origins whitelisted by the --unsafely-treat-insecure-origin-as-secure
flag will always be treated as "secure", and as such will not be
affected by this change.

BUG=672605
Review-Url: https://codereview.chromium.org/2859293003
Cr-Commit-Position: refs/heads/master@{#469866}
Committed: https://chromium.googlesource.com/chromium/src/+/fb4dd15c290ffa283c157f42f4d5abae97c3193d

[xhwang, 2017-05-04 21:38:48]

The CQ bit was checked by xhwang@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-05-04 21:39:15]

Dry run: CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[xhwang, 2017-05-04 21:50:29]

xhwang@chromium.org changed reviewers:
+ jrummell@chromium.org

[xhwang, 2017-05-04 21:50:30]

xhwang@chromium.org changed required reviewers:
+ jrummell@chromium.org

[xhwang, 2017-05-04 21:50:30]

jrummell: PTAL
ddorwin: FYI

[ddorwin, 2017-05-04 21:55:16]

ddorwin@chromium.org changed reviewers:
+ ddorwin@chromium.org

[ddorwin, 2017-05-04 21:55:16]

lgtm

[commit-bot: I haz the power, 2017-05-04 22:47:19]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-05-04 22:47:20]

Dry run: This issue passed the CQ dry run.

[jrummell, 2017-05-05 18:09:32]

lgtm

[xhwang, 2017-05-06 05:19:50]

The CQ bit was checked by xhwang@chromium.org

[commit-bot: I haz the power, 2017-05-06 05:20:18]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-05-06 19:07:18]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1494047990595840, "parent_rev":
"bfe1030ac8d3e23bd238376e9aeab0bfb3437ee7", "commit_rev":
"fb4dd15c290ffa283c157f42f4d5abae97c3193d"}

[commit-bot: I haz the power, 2017-05-06 19:07:28]

Description was changed from

==========
media: Restrict ProtectedMediaIdentifier permission to secure origins

Currently EME is restricted to secure origins (see BUG). However, it's
possible that the renderer process is compromised and bypasses this
restriction. This CL restricts the ProtectedMediaIdentifier permission
to secure origin as well to add another layer of protection.

Origins whitelisted by the --unsafely-treat-insecure-origin-as-secure
flag will always be treated as "secure", and as such will not be
affected by this change.

BUG=672605
==========

to

==========
media: Restrict ProtectedMediaIdentifier permission to secure origins

Currently EME is restricted to secure origins (see BUG). However, it's
possible that the renderer process is compromised and bypasses this
restriction. This CL restricts the ProtectedMediaIdentifier permission
to secure origin as well to add another layer of protection.

Origins whitelisted by the --unsafely-treat-insecure-origin-as-secure
flag will always be treated as "secure", and as such will not be
affected by this change.

BUG=672605

Review-Url: https://codereview.chromium.org/2859293003
Cr-Commit-Position: refs/heads/master@{#469866}
Committed:
https://chromium.googlesource.com/chromium/src/+/fb4dd15c290ffa283c157f42f4d5...
==========

[commit-bot: I haz the power, 2017-05-06 19:07:29]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/chromium/src/+/fb4dd15c290ffa283c157f42f4d5...