Don't auto allow access to media devices unless a the security origin of the requester is the same …

content/public/common/media_stream_request.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_COMMON_MEDIA_STREAM_REQUEST_H_
 #define CONTENT_PUBLIC_COMMON_MEDIA_STREAM_REQUEST_H_
 
 #include <map>
 #include <string>
 #include <vector>
@@ skipping 176 matching lines @@
 // media_stream_options.h no longer depends on this file.
 // TODO(vrk,justinlin,wjia): Figure out a way to share this code cleanly between
 // vanilla WebRTC, Tab Capture, and Pepper Video Capture. Right now there is
 // Tab-only stuff and Pepper-only stuff being passed around to all clients,
 // which is icky.
 struct CONTENT_EXPORT MediaStreamRequest {
   MediaStreamRequest(
       int render_process_id,
       int render_frame_id,
       int page_request_id,
+      const std::string& tab_capture_device_id,
       const GURL& security_origin,
       bool user_gesture,
       MediaStreamRequestType request_type,
       const std::string& requested_audio_device_id,
       const std::string& requested_video_device_id,
       MediaStreamType audio_type,
       MediaStreamType video_type);
 
   ~MediaStreamRequest();
 
@@ skipping 28 matching lines @@
 
   // Stores the requested raw device id for physical audio or video devices.
   std::string requested_audio_device_id;
   std::string requested_video_device_id;
 
   // Flag to indicate if the request contains audio.
   MediaStreamType audio_type;
 
   // Flag to indicate if the request contains video.
   MediaStreamType video_type;
+
+  // True if all ancestors of the requesting frame have the same origin.
+  bool all_ancestors_have_same_origin;
 };
 
 // Interface used by the content layer to notify chrome about changes in the
 // state of a media stream. Instances of this class are passed to content layer
 // when MediaStream access is approved using MediaResponseCallback.
 class MediaStreamUI {
  public:
   virtual ~MediaStreamUI() {}
 
   // Called when MediaStream capturing is started. Chrome layer can call |stop|
   // to stop the stream. Returns the platform-dependent window ID for the UI, or
   // 0 if not applicable.
   virtual gfx::NativeViewId OnStarted(const base::Closure& stop) = 0;
 };
 
 // Callback used return results of media access requests.
 typedef base::Callback<void(
     const MediaStreamDevices& devices,
     content::MediaStreamRequestResult result,
     scoped_ptr<MediaStreamUI> ui)> MediaResponseCallback;
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_COMMON_MEDIA_STREAM_REQUEST_H_