Check origin before providing initData in encrypted event

Source/modules/encryptedmedia/HTMLMediaElementEncryptedMedia.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/encryptedmedia/HTMLMediaElementEncryptedMedia.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptPromise.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
@@ skipping 497 matching lines @@
     event->setTarget(&element);
     element.scheduleEvent(event.release());
 }
 
 void HTMLMediaElementEncryptedMedia::encrypted(HTMLMediaElement& element, const String& initDataType, const unsigned char* initData, unsigned initDataLength)
 {
     WTF_LOG(Media, "HTMLMediaElementEncryptedMedia::encrypted: initDataType=%s", initDataType.utf8().data());
 
     if (RuntimeEnabledFeatures::encryptedMediaEnabled()) {
         // Send event for WD EME.
-        // FIXME: Check origin before providing initData. http://crbug.com/418233.
-        RefPtrWillBeRawPtr<Event> event = createEncryptedEvent(initDataType, initData, initDataLength);
+        RefPtrWillBeRawPtr<Event> event;
+        if (element.mediaDataIsCORSSameOrigin(element.executionContext()->securityOrigin())) {
+            event = createEncryptedEvent(initDataType, initData, initDataLength);
+        } else {
+            // Current page is not allowed to see content from the media file,
+            // so don't return the initData. However, they still get an event.
+            event = createEncryptedEvent(emptyString(), nullptr, 0);
+        }
+
         event->setTarget(&element);
         element.scheduleEvent(event.release());
     }
 
     if (RuntimeEnabledFeatures::prefixedEncryptedMediaEnabled()) {
         // Send event for v0.1b EME.
         RefPtrWillBeRawPtr<Event> event = createWebkitNeedKeyEvent(initData, initDataLength);
         event->setTarget(&element);
         element.scheduleEvent(event.release());
     }
@@ skipping 21 matching lines @@
     return thisElement.contentDecryptionModule();
 }
 
 void HTMLMediaElementEncryptedMedia::trace(Visitor* visitor)
 {
     visitor->trace(m_mediaKeys);
     WillBeHeapSupplement<HTMLMediaElement>::trace(visitor);
 }
 
 } // namespace blink