Don't allow HTTP origins for the CryptoToken extension.

chrome/browser/resources/cryptotoken/enroller.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview Handles web page requests for gnubby enrollment.
  */
 
 'use strict';
 
@@ skipping 32 matching lines @@
 
   function timeout() {
     sendErrorResponse({errorCode: ErrorCodes.TIMEOUT});
   }
 
   var sender = createSenderFromMessageSender(messageSender);
   if (!sender) {
     sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
     return null;
   }
+  if (sender.origin.indexOf('http://') == 0 && !HTTP_ORIGINS_ALLOWED) {
+    sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
+    return null;
+  }
 
   if (!isValidEnrollRequest(request, 'enrollChallenges', 'signData')) {
     sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
     return null;
   }
 
   var timeoutValueSeconds = getTimeoutValueFromRequest(request);
   // Attenuate watchdog timeout value less than the enroller's timeout, so the
   // watchdog only fires after the enroller could reasonably have called back,
   // not before.
@@ skipping 54 matching lines @@
 
   function timeout() {
     sendErrorResponse({errorCode: ErrorCodes.TIMEOUT});
   }
 
   var sender = createSenderFromMessageSender(messageSender);
   if (!sender) {
     sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
     return null;
   }
+  if (sender.origin.indexOf('http://') == 0 && !HTTP_ORIGINS_ALLOWED) {
+    sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
+    return null;
+  }
 
   if (!isValidEnrollRequest(request, 'registerRequests', 'signRequests',
       'registeredKeys')) {
     sendErrorResponse({errorCode: ErrorCodes.BAD_REQUEST});
     return null;
   }
 
   var timeoutValueSeconds = getTimeoutValueFromRequest(request);
   // Attenuate watchdog timeout value less than the enroller's timeout, so the
   // watchdog only fires after the enroller could reasonably have called back,
@@ skipping 525 matching lines @@
       // For U2F_V2, the challenge sent to the gnubby is modified to be the hash
       // of the browser data. Include the browser data.
       browserData = this.browserData_[reply.version];
     }
 
     this.notifySuccess_(/** @type {string} */ (reply.version),
                         /** @type {string} */ (reply.enrollData),
                         browserData);
   }
 };