Check origin before providing initData in encrypted event

Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1546 matching lines @@
     }
 
     if (!document().contentSecurityPolicy()->allowMediaFromSource(url)) {
         WTF_LOG(Media, "HTMLMediaElement::isSafeToLoadURL(%p, %s) -> rejected by Content Security Policy", this, urlForLoggingMedia(url).utf8().data());
         return false;
     }
 
     return true;
 }
 
+bool HTMLMediaElement::mediaDataIsCORSSameOrigin(SecurityOrigin* origin) const

[ddorwin, 2015/02/06 21:41:33]

Does the new function really tell us that it is CORS-same-origin? (As discussed
elsewhere) taintsCanvas() is basically canRequest(), which has more to do with
access than same-origin.

hasSingleSecurityOrigin() apparently tells us whether the origin in the src is
the same as the actual request (i.e. after redirect). If correct, it would be
nice to add a comment in WebMediaPlayer.h.

I think didPassCORSAccessCheck() means it was a successful CORS-enabled fetch
(vs. non-CORS-enabled or failed).

Then, taintsCanvas() must check that it is not a URL that requires CORS - that
is, same origin. However, it also does some other things, which I guess are
valid exceptions.

I suppose at a high level, it is equivalent to CORS-same-origin.

[jrummell, 2015/02/07 00:12:26]

Acknowledged. Added comments to indicate this, just so the next person looking
at it has somewhere to start.

+{
+    return hasSingleSecurityOrigin() && ((webMediaPlayer() && webMediaPlayer()->didPassCORSAccessCheck()) || !origin->taintsCanvas(currentSrc()));
+}
+
 void HTMLMediaElement::startProgressEventTimer()
 {
     if (m_progressEventTimer.isActive())
         return;
 
     m_previousProgressTime = WTF::currentTime();
     // 350ms is not magic, it is in the spec!
     m_progressEventTimer.startRepeating(0.350, FROM_HERE);
 }
 
@@ skipping 2534 matching lines @@
 
 #if ENABLE(WEB_AUDIO)
 void HTMLMediaElement::clearWeakMembers(Visitor* visitor)
 {
     if (!visitor->isAlive(m_audioSourceNode) && audioSourceProvider())
         audioSourceProvider()->setClient(nullptr);
 }
 #endif
 
 }