Block insecure pepper requests

chrome/browser/media/webrtc/media_stream_devices_controller_browsertest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/metrics/field_trial.h"
 #include "base/run_loop.h"
@@ skipping 13 matching lines @@
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/permission_bubble/mock_permission_prompt_factory.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/chrome_features.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/prefs/pref_service.h"
 #include "components/variations/variations_associated_data.h"
 #include "content/public/browser/render_frame_host.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/media_stream_request.h"
 #include "content/public/test/mock_render_process_host.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 enum class TestType {
   DEFAULT,
   TEST_WITH_GROUPED_MEDIA_REQUESTS,
 };
 
 class MediaStreamDevicesControllerTest
@@ skipping 796 matching lines @@
   ASSERT_EQ(content::MEDIA_DEVICE_OK, media_stream_result());
   ASSERT_TRUE(CheckDevicesListContains(content::MEDIA_DEVICE_AUDIO_CAPTURE));
   ASSERT_TRUE(CheckDevicesListContains(content::MEDIA_DEVICE_VIDEO_CAPTURE));
 }
 
 // For Pepper request from insecure origin, even if it's ALLOW, it won't be
 // changed to ASK.
 IN_PROC_BROWSER_TEST_P(MediaStreamDevicesControllerTest,
                        PepperRequestInsecure) {
   InitWithUrl(GURL("http://www.example.com"));
-  SetContentSettings(CONTENT_SETTING_ALLOW, CONTENT_SETTING_ALLOW);
+
+  SetPromptResponseType(PermissionRequestManager::ACCEPT_ALL);
 
   RequestPermissions(
       GetWebContents(),
       CreateRequestWithType(example_audio_id(), std::string(),
                             content::MEDIA_OPEN_DEVICE_PEPPER_ONLY),
       base::Bind(&MediaStreamDevicesControllerTest::OnMediaStreamResponse,
                  base::Unretained(this)));
+  ASSERT_EQ(2u, TotalPromptRequestCount());
+
+  ASSERT_EQ(content::MEDIA_DEVICE_OK, media_stream_result());
+  ASSERT_TRUE(CheckDevicesListContains(content::MEDIA_DEVICE_AUDIO_CAPTURE));
+  ASSERT_FALSE(CheckDevicesListContains(content::MEDIA_DEVICE_VIDEO_CAPTURE));
+
+  // Test that with the kRequireSecureOriginsForPepperMediaRequests flag enabled
+  // that permission will be denied.
+  ResetPromptCounters();
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitAndEnableFeature(
+      features::kRequireSecureOriginsForPepperMediaRequests);
+  RequestPermissions(
+      GetWebContents(),
+      CreateRequestWithType(example_audio_id(), example_video_id(),
+                            content::MEDIA_OPEN_DEVICE_PEPPER_ONLY),
+      base::Bind(&MediaStreamDevicesControllerTest::OnMediaStreamResponse,
+                 base::Unretained(this)));
   ASSERT_EQ(0u, TotalPromptRequestCount());
+
+  ASSERT_EQ(content::MEDIA_DEVICE_PERMISSION_DENIED, media_stream_result());
+  ASSERT_FALSE(CheckDevicesListContains(content::MEDIA_DEVICE_AUDIO_CAPTURE));
+  ASSERT_FALSE(CheckDevicesListContains(content::MEDIA_DEVICE_VIDEO_CAPTURE));
 }
 
 // Request and block microphone and camera access with kill switch.
 IN_PROC_BROWSER_TEST_P(MediaStreamDevicesControllerTest,
                        RequestAndKillSwitchMicCam) {
   std::map<std::string, std::string> params;
   params[PermissionUtil::GetPermissionString(
       CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC)] =
       PermissionContextBase::kPermissionsKillSwitchBlockedValue;
   params[PermissionUtil::GetPermissionString(
@@ skipping 18 matching lines @@
   ASSERT_EQ(content::MEDIA_DEVICE_KILL_SWITCH_ON, media_stream_result());
   ASSERT_FALSE(CheckDevicesListContains(content::MEDIA_DEVICE_AUDIO_CAPTURE));
   ASSERT_FALSE(CheckDevicesListContains(content::MEDIA_DEVICE_VIDEO_CAPTURE));
 }
 
 INSTANTIATE_TEST_CASE_P(
     MediaStreamDevicesControllerTestInstance,
     MediaStreamDevicesControllerTest,
     ::testing::Values(TestType::DEFAULT,
                       TestType::TEST_WITH_GROUPED_MEDIA_REQUESTS));