Don't auto allow access to media devices unless a the security origin of the requester is the same …

content/browser/renderer_host/media/media_stream_ui_proxy.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/media/media_stream_ui_proxy.h"
 
 #include "base/command_line.h"
+#include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_switches.h"
 #include "media/video/capture/fake_video_capture_device.h"
 
 namespace content {
 
+void SetAndCheckAncestorFlag(MediaStreamRequest* request) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
+  RenderFrameHostImpl* rfh =
+      RenderFrameHostImpl::FromID(request->render_process_id,
+                                  request->render_frame_id);
+
+  if (rfh == NULL) {
+    // RenderFrame destroyed before the request is handled?
+    return;
+  }
+  FrameTreeNode* node = rfh->frame_tree_node();
+
+  while (node->parent() != NULL) {
+    if (!node->HasSameOrigin(*node->parent())) {
+      request->all_ancestors_have_same_origin =  false;
+      return;
+    }
+    node = node->parent();
+  }
+  request->all_ancestors_have_same_origin = true;
+}
+
 class MediaStreamUIProxy::Core {
  public:
   explicit Core(const base::WeakPtr<MediaStreamUIProxy>& proxy,
                 RenderFrameHostDelegate* test_render_delegate);
   ~Core();
 
-  void RequestAccess(const MediaStreamRequest& request);
+  void RequestAccess(scoped_ptr<MediaStreamRequest> request);
   bool CheckAccess(const GURL& security_origin,
                    MediaStreamType type,
                    int process_id,
                    int frame_id);
   void OnStarted(gfx::NativeViewId* window_id);
 
  private:
   void ProcessAccessRequestResponse(const MediaStreamDevices& devices,
                                     content::MediaStreamRequestResult result,
                                     scoped_ptr<MediaStreamUI> stream_ui);
@@ skipping 18 matching lines @@
     : proxy_(proxy),
       test_render_delegate_(test_render_delegate),
       weak_factory_(this) {
 }
 
 MediaStreamUIProxy::Core::~Core() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 }
 
 void MediaStreamUIProxy::Core::RequestAccess(
-    const MediaStreamRequest& request) {
+    scoped_ptr<MediaStreamRequest> request) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   RenderFrameHostDelegate* render_delegate = GetRenderFrameHostDelegate(
-      request.render_process_id, request.render_frame_id);
+      request->render_process_id, request->render_frame_id);
 
   // Tab may have gone away, or has no delegate from which to request access.
   if (!render_delegate) {
     ProcessAccessRequestResponse(MediaStreamDevices(),
                                  MEDIA_DEVICE_FAILED_DUE_TO_SHUTDOWN,
                                  scoped_ptr<MediaStreamUI>());
     return;
   }
+  SetAndCheckAncestorFlag(request.get());
 
   render_delegate->RequestMediaAccessPermission(
-      request, base::Bind(&Core::ProcessAccessRequestResponse,
-                          weak_factory_.GetWeakPtr()));
+      *request, base::Bind(&Core::ProcessAccessRequestResponse,
+                           weak_factory_.GetWeakPtr()));
 }
 
 bool MediaStreamUIProxy::Core::CheckAccess(const GURL& security_origin,
                                            MediaStreamType type,
                                            int render_process_id,
                                            int render_frame_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   RenderFrameHostDelegate* render_delegate =
       GetRenderFrameHostDelegate(render_process_id, render_frame_id);
@@ skipping 59 matching lines @@
     : weak_factory_(this) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   core_.reset(new Core(weak_factory_.GetWeakPtr(), test_render_delegate));
 }
 
 MediaStreamUIProxy::~MediaStreamUIProxy() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 }
 
 void MediaStreamUIProxy::RequestAccess(
-    const MediaStreamRequest& request,
+    scoped_ptr<MediaStreamRequest> request,
     const ResponseCallback& response_callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   response_callback_ = response_callback;
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
-      base::Bind(&Core::RequestAccess, base::Unretained(core_.get()), request));
+      base::Bind(&Core::RequestAccess, base::Unretained(core_.get()),
+                 base::Passed(&request)));
 }
 
 void MediaStreamUIProxy::CheckAccess(
     const GURL& security_origin,
     MediaStreamType type,
     int render_process_id,
     int render_frame_id,
     const base::Callback<void(bool)>& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
@@ skipping 80 matching lines @@
 
 void FakeMediaStreamUIProxy::SetMicAccess(bool access) {
   mic_access_ = access;
 }
 
 void FakeMediaStreamUIProxy::SetCameraAccess(bool access) {
   camera_access_ = access;
 }
 
 void FakeMediaStreamUIProxy::RequestAccess(
-    const MediaStreamRequest& request,
+    scoped_ptr<MediaStreamRequest> request,
     const ResponseCallback& response_callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   response_callback_ = response_callback;
 
   if (base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
           switches::kUseFakeUIForMediaStream) == "deny") {
     // Immediately deny the request.
     BrowserThread::PostTask(
           BrowserThread::IO, FROM_HERE,
           base::Bind(&MediaStreamUIProxy::ProcessAccessRequestResponse,
                      weak_factory_.GetWeakPtr(),
                      MediaStreamDevices(),
                      MEDIA_DEVICE_PERMISSION_DENIED));
     return;
   }
 
   MediaStreamDevices devices_to_use;
   bool accepted_audio = false;
   bool accepted_video = false;
 
   // Use the first capture device of the same media type in the list for the
   // fake UI.
   for (MediaStreamDevices::const_iterator it = devices_.begin();
        it != devices_.end(); ++it) {
     if (!accepted_audio &&
-        IsAudioInputMediaType(request.audio_type) &&
+        IsAudioInputMediaType(request->audio_type) &&
         IsAudioInputMediaType(it->type) &&
-        (request.requested_audio_device_id.empty() ||
-         request.requested_audio_device_id == it->id)) {
+        (request->requested_audio_device_id.empty() ||
+         request->requested_audio_device_id == it->id)) {
       devices_to_use.push_back(*it);
       accepted_audio = true;
     } else if (!accepted_video &&
-               IsVideoMediaType(request.video_type) &&
+               IsVideoMediaType(request->video_type) &&
                IsVideoMediaType(it->type) &&
-               (request.requested_video_device_id.empty() ||
-                request.requested_video_device_id == it->id)) {
+               (request->requested_video_device_id.empty() ||
+                request->requested_video_device_id == it->id)) {
       devices_to_use.push_back(*it);
       accepted_video = true;
     }
   }
 
   // Fail the request if a device doesn't exist for the requested type.
-  if ((request.audio_type != MEDIA_NO_SERVICE && !accepted_audio) ||
-      (request.video_type != MEDIA_NO_SERVICE && !accepted_video)) {
+  if ((request->audio_type != MEDIA_NO_SERVICE && !accepted_audio) ||
+      (request->video_type != MEDIA_NO_SERVICE && !accepted_video)) {
     devices_to_use.clear();
   }
 
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
       base::Bind(&MediaStreamUIProxy::ProcessAccessRequestResponse,
                  weak_factory_.GetWeakPtr(),
                  devices_to_use,
                  devices_to_use.empty() ?
                      MEDIA_DEVICE_NO_HARDWARE :
@@ skipping 25 matching lines @@
                  callback,
                  have_access));
   return;
 }
 
 void FakeMediaStreamUIProxy::OnStarted(
     const base::Closure& stop_callback,
     const WindowIdCallback& window_id_callback) {}
 
 }  // namespace content