[Battery] Allow usage from SecureContext or top-level browsing context only.

third_party/WebKit/Source/modules/battery/NavigatorBattery.cpp

Index: third_party/WebKit/Source/modules/battery/NavigatorBattery.cpp
diff --git a/third_party/WebKit/Source/modules/battery/NavigatorBattery.cpp b/third_party/WebKit/Source/modules/battery/NavigatorBattery.cpp
index 5f6423f1c51a6e9bbb419a0c4de6c0893311d7d1..a6c7351d00ee32c2c5a555e8ef586002598b334f 100644
--- a/third_party/WebKit/Source/modules/battery/NavigatorBattery.cpp
+++ b/third_party/WebKit/Source/modules/battery/NavigatorBattery.cpp
@@ -4,8 +4,10 @@
 
 #include "modules/battery/NavigatorBattery.h"
 
-#include "core/dom/ExecutionContext.h"
-#include "core/frame/LocalFrame.h"
+#include "core/dom/DOMException.h"
+#include "core/dom/Document.h"
+#include "core/dom/ExceptionCode.h"
+#include "core/frame/LocalDOMWindow.h"
 #include "modules/battery/BatteryManager.h"
 
 namespace blink {
@@ -19,10 +21,26 @@ ScriptPromise NavigatorBattery::getBattery(ScriptState* script_state,
 }
 
 ScriptPromise NavigatorBattery::getBattery(ScriptState* script_state) {
-  if (!battery_manager_) {
-    battery_manager_ =
-        BatteryManager::Create(ExecutionContext::From(script_state));
+  ExecutionContext* execution_context = ExecutionContext::From(script_state);
+
+  // Check secure context.
+  String error_message;
+  if (!execution_context->IsSecureContext(error_message)) {
+    return ScriptPromise::RejectWithDOMException(
+        script_state, DOMException::Create(kSecurityError, error_message));
+  }
+
+  // Check top-level browsing context.
+  if (!ToDocument(execution_context)->domWindow()->GetFrame() ||
+      !ToDocument(execution_context)->GetFrame()->IsMainFrame()) {
+    return ScriptPromise::RejectWithDOMException(
+        script_state, DOMException::Create(
+                          kSecurityError, "Not a top-level browsing context."));
   }
+
+  if (!battery_manager_)
+    battery_manager_ = BatteryManager::Create(execution_context);
+
   return battery_manager_->StartRequest(script_state);
 }