Don't auto allow access to media devices unless a the security origin of the requester is the same …

content/browser/renderer_host/media/media_stream_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/media/media_stream_manager.h"
 
 #include <list>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 220 matching lines @@
         requesting_process_id(requesting_process_id),
         requesting_frame_id(requesting_frame_id),
         page_request_id(page_request_id),
         security_origin(security_origin),
         user_gesture(user_gesture),
         request_type(request_type),
         options(options),
         salt_callback(salt_callback),
         state_(NUM_MEDIA_TYPES, MEDIA_REQUEST_STATE_NOT_REQUESTED),
         audio_type_(MEDIA_NO_SERVICE),
-        video_type_(MEDIA_NO_SERVICE) {
+        video_type_(MEDIA_NO_SERVICE),
+        target_process_id_(-1),
+        target_frame_id_(-1) {
   }
 
   ~DeviceRequest() {}
 
   void SetAudioType(MediaStreamType audio_type) {
     DCHECK(IsAudioInputMediaType(audio_type) ||
            audio_type == MEDIA_DEVICE_AUDIO_OUTPUT ||
            audio_type == MEDIA_NO_SERVICE);
     audio_type_ = audio_type;
   }
 
   MediaStreamType audio_type() const { return audio_type_; }
 
   void SetVideoType(MediaStreamType video_type) {
     DCHECK(IsVideoMediaType(video_type) || video_type == MEDIA_NO_SERVICE);
     video_type_ = video_type;
   }
 
   MediaStreamType video_type() const { return video_type_; }
 
   // Creates a MediaStreamRequest object that is used by this request when UI
   // is asked for permission and device selection.
   void CreateUIRequest(const std::string& requested_audio_device_id,
                        const std::string& requested_video_device_id) {
     DCHECK(!ui_request_);
+    target_process_id_ = requesting_process_id;
+    target_frame_id_ = requesting_frame_id;
     ui_request_.reset(new MediaStreamRequest(requesting_process_id,
                                              requesting_frame_id,
                                              page_request_id,
                                              security_origin,
                                              user_gesture,
                                              request_type,
                                              requested_audio_device_id,
                                              requested_video_device_id,
                                              audio_type_,
                                              video_type_));
   }
 
   // Creates a tab capture specific MediaStreamRequest object that is used by
   // this request when UI is asked for permission and device selection.
   void CreateTabCaptureUIRequest(int target_render_process_id,
-                                 int target_render_frame_id,
-                                 const std::string& tab_capture_id) {
+                                 int target_render_frame_id) {
     DCHECK(!ui_request_);
+    target_process_id_ = target_render_process_id;
+    target_frame_id_ = target_render_frame_id;
     ui_request_.reset(new MediaStreamRequest(target_render_process_id,
                                              target_render_frame_id,
                                              page_request_id,
                                              security_origin,
                                              user_gesture,
                                              request_type,
                                              "",
                                              "",
                                              audio_type_,
                                              video_type_));
-    ui_request_->tab_capture_device_id = tab_capture_id;
   }
 
-  const MediaStreamRequest* UIRequest() const { return ui_request_.get(); }
+  bool HasUIRequest() const { return ui_request_.get() != nullptr; }
+  scoped_ptr<MediaStreamRequest> DetachUIRequest() {
+    return ui_request_.Pass();
+  }
 
   // Update the request state and notify observers.
   void SetState(MediaStreamType stream_type, MediaRequestState new_state) {
     if (stream_type == NUM_MEDIA_TYPES) {
       for (int i = MEDIA_NO_SERVICE + 1; i < NUM_MEDIA_TYPES; ++i) {
         const MediaStreamType stream_type = static_cast<MediaStreamType>(i);
         state_[stream_type] = new_state;
       }
     } else {
       state_[stream_type] = new_state;
     }
 
     MediaObserver* media_observer =
         GetContentClient()->browser()->GetMediaObserver();
     if (!media_observer)
       return;
 
-    // If |ui_request_| doesn't exist, it means that the request has not yet
-    // been setup fully and there are no valid observers.
-    if (!ui_request_)
-      return;
-
     media_observer->OnMediaRequestStateChanged(
-        ui_request_->render_process_id, ui_request_->render_frame_id,
-        ui_request_->page_request_id, ui_request_->security_origin,
+        target_process_id_, target_frame_id_, page_request_id, security_origin,
         stream_type, new_state);
   }
 
   MediaRequestState state(MediaStreamType stream_type) const {
     return state_[stream_type];
   }
 
   MediaStreamRequester* const requester;  // Can be NULL.
 
 
@@ skipping 24 matching lines @@
 
   StreamDeviceInfoArray devices;
 
   // Callback to the requester which audio/video devices have been selected.
   // It can be null if the requester has no interest to know the result.
   // Currently it is only used by |DEVICE_ACCESS| type.
   MediaStreamManager::MediaRequestResponseCallback callback;
 
   scoped_ptr<MediaStreamUIProxy> ui_proxy;
 
+  std::string tab_capture_device_id;
+
  private:
   std::vector<MediaRequestState> state_;
   scoped_ptr<MediaStreamRequest> ui_request_;
   MediaStreamType audio_type_;
   MediaStreamType video_type_;
+  int target_process_id_;
+  int target_frame_id_;
 };
 
 MediaStreamManager::EnumerationCache::EnumerationCache()
     : valid(false) {
 }
 
 MediaStreamManager::EnumerationCache::~EnumerationCache() {
 }
 
 MediaStreamManager::MediaStreamManager()
@@ skipping 773 matching lines @@
       requests_.erase(request_it);
       return;
     }
   }
   NOTREACHED();
 }
 
 void MediaStreamManager::PostRequestToUI(const std::string& label,
                                          DeviceRequest* request) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  DCHECK(request->UIRequest());
+  DCHECK(request->HasUIRequest());
   DVLOG(1) << "PostRequestToUI({label= " << label << "})";
 
   const MediaStreamType audio_type = request->audio_type();
   const MediaStreamType video_type = request->video_type();
 
   // Post the request to UI and set the state.
   if (IsAudioInputMediaType(audio_type))
     request->SetState(audio_type, MEDIA_REQUEST_STATE_PENDING_APPROVAL);
   if (IsVideoMediaType(video_type))
     request->SetState(video_type, MEDIA_REQUEST_STATE_PENDING_APPROVAL);
@@ skipping 19 matching lines @@
     }
 
     fake_ui_->SetAvailableDevices(devices);
 
     request->ui_proxy = fake_ui_.Pass();
   } else {
     request->ui_proxy = MediaStreamUIProxy::Create();
   }
 
   request->ui_proxy->RequestAccess(
-      *request->UIRequest(),
+      request->DetachUIRequest(),
       base::Bind(&MediaStreamManager::HandleAccessRequestResponse,
                  base::Unretained(this), label));
 }
 
 void MediaStreamManager::SetupRequest(const std::string& label) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DeviceRequest* request = FindRequest(label);
   if (!request) {
     DVLOG(1) << "SetupRequest label " << label << " doesn't exist!!";
     return;  // This can happen if the request has been canceled.
@@ skipping 116 matching lines @@
 
   bool has_valid_device_id = WebContentsCaptureUtil::ExtractTabCaptureTarget(
       capture_device_id, &target_render_process_id, &target_render_frame_id);
   if (!has_valid_device_id ||
       (request->audio_type() != MEDIA_TAB_AUDIO_CAPTURE &&
        request->audio_type() != MEDIA_NO_SERVICE) ||
       (request->video_type() != MEDIA_TAB_VIDEO_CAPTURE &&
        request->video_type() != MEDIA_NO_SERVICE)) {
     return false;
   }
+  request->tab_capture_device_id = capture_device_id;
 
   request->CreateTabCaptureUIRequest(target_render_process_id,
-                                     target_render_frame_id,
-                                     capture_device_id);
+                                     target_render_frame_id);
 
   DVLOG(3) << "SetupTabCaptureRequest "
            << ", {capture_device_id = " << capture_device_id <<  "}"
            << ", {target_render_process_id = " << target_render_process_id
            << "}"
            << ", {target_render_frame_id = " << target_render_frame_id << "}";
   return true;
 }
 
 bool MediaStreamManager::SetupScreenCaptureRequest(DeviceRequest* request) {
@@ skipping 549 matching lines @@
   // Process all newly-accepted devices for this request.
   bool found_audio = false;
   bool found_video = false;
   for (MediaStreamDevices::const_iterator device_it = devices.begin();
        device_it != devices.end(); ++device_it) {
     StreamDeviceInfo device_info;
     device_info.device = *device_it;
 
     if (device_info.device.type == content::MEDIA_TAB_VIDEO_CAPTURE ||
         device_info.device.type == content::MEDIA_TAB_AUDIO_CAPTURE) {
-      device_info.device.id = request->UIRequest()->tab_capture_device_id;
+      device_info.device.id = request->tab_capture_device_id;
 
       // Initialize the sample_rate and channel_layout here since for audio
       // mirroring, we don't go through EnumerateDevices where these are usually
       // initialized.
       if (device_info.device.type == content::MEDIA_TAB_AUDIO_CAPTURE) {
         const media::AudioParameters parameters =
             audio_manager_->GetDefaultOutputStreamParameters();
         int sample_rate = parameters.sample_rate();
         // If we weren't able to get the native sampling rate or the sample_rate
         // is outside the valid range for input devices set reasonable defaults.
@@ skipping 229 matching lines @@
   }
 }
 
 void MediaStreamManager::SetKeyboardMicOnDeviceThread() {
   DCHECK(device_task_runner_->BelongsToCurrentThread());
   audio_manager_->SetHasKeyboardMic();
 }
 #endif
 
 }  // namespace content