Fix for cross-origin video check for webgl on android

content/renderer/media/android/webmediaplayer_android.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/media/android/webmediaplayer_android.h"
 
 #include <limits>
 
+#include "base/android/build_info.h"
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "cc/layers/video_layer.h"
@@ skipping 29 matching lines @@
 #include "third_party/WebKit/public/web/WebFrame.h"
 #include "third_party/WebKit/public/web/WebRuntimeFeatures.h"
 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 #include "third_party/WebKit/public/web/WebView.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkPaint.h"
 #include "third_party/skia/include/core/SkTypeface.h"
 #include "ui/gfx/image/image.h"
 
 static const uint32 kGLTextureExternalOES = 0x8D65;
+static const int kSDKVersionToSupportSecurityOriginCheck = 20;
 
 using blink::WebMediaPlayer;
 using blink::WebSize;
 using blink::WebString;
 using blink::WebTimeRanges;
 using blink::WebURL;
 using gpu::gles2::GLES2Interface;
 using media::MediaPlayerAndroid;
 using media::VideoFrame;
 
@@ skipping 63 matching lines @@
       has_size_info_(false),
       stream_texture_factory_(factory),
       needs_external_surface_(false),
       video_frame_provider_client_(NULL),
       pending_playback_(false),
       player_type_(MEDIA_PLAYER_TYPE_URL),
       current_time_(0),
       is_remote_(false),
       media_log_(media_log),
       web_cdm_(NULL),
+      allow_stored_credentials_(false),
       weak_factory_(this) {
   DCHECK(player_manager_);
   DCHECK(cdm_manager_);
 
   DCHECK(main_thread_checker_.CalledOnValidThread());
 
   player_id_ = player_manager_->RegisterMediaPlayer(this);
 
 #if defined(VIDEO_HOLE)
   force_use_overlay_embedded_video_ = CommandLine::ForCurrentProcess()->
@@ skipping 73 matching lines @@
       media_source_delegate_->InitializeMediaSource(
           base::Bind(&WebMediaPlayerAndroid::OnMediaSourceOpened,
                      weak_factory_.GetWeakPtr()),
           base::Bind(&WebMediaPlayerAndroid::OnNeedKey,
                      weak_factory_.GetWeakPtr()),
           set_decryptor_ready_cb,
           base::Bind(&WebMediaPlayerAndroid::UpdateNetworkState,
                      weak_factory_.GetWeakPtr()),
           base::Bind(&WebMediaPlayerAndroid::OnDurationChanged,
                      weak_factory_.GetWeakPtr()));
-      InitializePlayer(demuxer_client_id);
+      InitializePlayer(url_, frame_->document().firstPartyForCookies(),
+                       true, demuxer_client_id);
     }
   } else {
     info_loader_.reset(
         new MediaInfoLoader(
             url,
             cors_mode,
             base::Bind(&WebMediaPlayerAndroid::DidLoadMediaInfo,
                        weak_factory_.GetWeakPtr())));
-    // TODO(qinmin): The url might be redirected when android media player
-    // requests the stream. As a result, we cannot guarantee there is only
-    // a single origin. Remove the following line when b/12573548 is fixed.
-    // Check http://crbug.com/334204.
-    info_loader_->set_single_origin(false);
     info_loader_->Start(frame_);
   }
 
   UpdateNetworkState(WebMediaPlayer::NetworkStateLoading);
   UpdateReadyState(WebMediaPlayer::ReadyStateHaveNothing);
 }
 
-void WebMediaPlayerAndroid::DidLoadMediaInfo(MediaInfoLoader::Status status) {
+void WebMediaPlayerAndroid::DidLoadMediaInfo(
+    MediaInfoLoader::Status status,
+    const GURL& redirected_url,
+    const GURL& first_party_for_cookies,
+    bool allow_stored_credentials) {
   DCHECK(!media_source_delegate_);
   if (status == MediaInfoLoader::kFailed) {
     info_loader_.reset();
     UpdateNetworkState(WebMediaPlayer::NetworkStateNetworkError);
     return;
   }
 
-  InitializePlayer(0);
+  InitializePlayer(
+      redirected_url, first_party_for_cookies, allow_stored_credentials, 0);
 
   UpdateNetworkState(WebMediaPlayer::NetworkStateIdle);
 }
 
 void WebMediaPlayerAndroid::play() {
 #if defined(VIDEO_HOLE)
   if (hasVideo() && needs_external_surface_ &&
       !player_manager_->IsInFullscreen(frame_)) {
     DCHECK(!needs_establish_peer_);
     player_manager_->RequestExternalSurface(player_id_, last_computed_rect_);
@@ skipping 321 matching lines @@
 
   web_graphics_context->deleteTexture(src_texture);
   web_graphics_context->flush();
 
   SyncPointClientImpl client(web_graphics_context);
   video_frame->UpdateReleaseSyncPoint(&client);
   return true;
 }
 
 bool WebMediaPlayerAndroid::hasSingleSecurityOrigin() const {
-  if (info_loader_)
-    return info_loader_->HasSingleOrigin();
-  // The info loader may have failed.
-  if (player_type_ == MEDIA_PLAYER_TYPE_URL)
+  if (player_type_ != MEDIA_PLAYER_TYPE_URL)
+    return true;
+
+  if (!info_loader_ || !info_loader_->HasSingleOrigin())
     return false;
-  return true;
+
+  // TODO(qinmin): The url might be redirected when android media player
+  // requests the stream. As a result, we cannot guarantee there is only
+  // a single origin. Only if the HTTP request was made without credentials,
+  // we will honor the return value from  HasSingleSecurityOriginInternal()
+  // in pre-L android versions.
+  // Check http://crbug.com/334204.
+  if (!allow_stored_credentials_)
+    return true;
+
+  return base::android::BuildInfo::GetInstance()->sdk_int() >=
+      kSDKVersionToSupportSecurityOriginCheck;

[dshwang, 2014/08/11 08:01:33]

This method allows SSO for systems >=L although the description said we are
reenabling video for webgl for systems <=K.
I guess we should replace >= to <, right?

Video on WebGL still is in trouble on systems <= K. e.g.
http://browsertests.herokuapp.com/media/mdn_samples_webgl_sample8/index.html

[dshwang, 2014/08/15 09:25:55]

This CL makes WebGL more restricted on systems <K, not less restricted, because
this line; return system >= L as hasSingleSecurityOrigin
So there is not any difference for system <= K compared to before-this-CL

 }
 
 bool WebMediaPlayerAndroid::didPassCORSAccessCheck() const {
   if (info_loader_)
     return info_loader_->DidPassCORSAccessCheck();
   return false;
 }
 
 double WebMediaPlayerAndroid::mediaTimeForTimeValue(double timeValue) const {
   return ConvertSecondsToTimestamp(timeValue).InSecondsF();
@@ skipping 309 matching lines @@
     SetNeedsEstablishPeer(true);
 }
 
 void WebMediaPlayerAndroid::OnDestruct() {
   NOTREACHED() << "WebMediaPlayer should be destroyed before any "
                   "RenderFrameObserver::OnDestruct() gets called when "
                   "the RenderFrame goes away.";
 }
 
 void WebMediaPlayerAndroid::InitializePlayer(
+    const GURL& url,
+    const GURL& first_party_for_cookies,
+    bool allow_stored_credentials,
     int demuxer_client_id) {
-  GURL first_party_url = frame_->document().firstPartyForCookies();
+  allow_stored_credentials_ = allow_stored_credentials;
   player_manager_->Initialize(
-      player_type_, player_id_, url_, first_party_url, demuxer_client_id,
-      frame_->document().url());
+      player_type_, player_id_, url, first_party_for_cookies, demuxer_client_id,
+      frame_->document().url(), allow_stored_credentials);
   if (player_manager_->ShouldEnterFullscreen(frame_))
     player_manager_->EnterFullscreen(player_id_, frame_);
 }
 
 void WebMediaPlayerAndroid::Pause(bool is_media_related_action) {
   player_manager_->Pause(player_id_, is_media_related_action);
   UpdatePlayingState(false);
 }
 
 void WebMediaPlayerAndroid::DrawRemotePlaybackText(
@@ skipping 646 matching lines @@
     player_manager_->EnterFullscreen(player_id_, frame_);
     SetNeedsEstablishPeer(false);
   }
 }
 
 bool WebMediaPlayerAndroid::canEnterFullscreen() const {
   return player_manager_->CanEnterFullscreen(frame_);
 }
 
 }  // namespace content