Code: bool MediaStreamDevicesController::IsRequestAllowedByDefault() const {
  if (ShouldAlwaysAllowOrigin())
    return true;

  struct {
    bool has_capability;
    const char* policy_name;
    const char* list_policy_name;
    ContentSettingsType settings_type;
  } device_checks[] = {
    { microphone_requested_, prefs::kAudioCaptureAllowed,
      prefs::kAudioCaptureAllowedUrls, CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC },
    { webcam_requested_, prefs::kVideoCaptureAllowed,
      prefs::kVideoCaptureAllowedUrls,
      CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA },
  };

  for (size_t i = 0; i < ARRAYSIZE_UNSAFE(device_checks); ++i) {
    if (!device_checks[i].has_capability)
      continue;
 
     DevicePolicy policy = GetDevicePolicy(device_checks[i].policy_name,
                                           device_checks[i].list_policy_name);
    if (policy == ALWAYS_DENY ||
        (policy == POLICY_NOT_SET &&
         profile_->GetHostContentSettingsMap()->GetContentSetting(
            request_.security_origin, request_.security_origin,
            device_checks[i].settings_type, NO_RESOURCE_IDENTIFIER) !=
         CONTENT_SETTING_ALLOW)) {
       return false;
     }
  }

  return true;
}

Vulnerability Type: +Info 
CWE ID: CWE-264
Summary: The Flash plug-in in Google Chrome before 27.0.1453.116, as used on Google Chrome OS before 27.0.1453.116 and separately, does not properly determine whether a user wishes to permit camera or microphone access by a Flash application, which allows remote attackers to obtain sensitive information from a machine's physical environment via a clickjacking attack, as demonstrated by an attack using a crafted Cascading Style Sheets (CSS) opacity property.
Commit Message: Make the content setting for webcam/mic sticky for Pepper requests.

This makes the content setting sticky for webcam/mic requests from Pepper from non-https origins.

BUG=249335
R=xians@chromium.org, yzshen@chromium.org

Review URL: https://codereview.chromium.org/17060006

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@206479 0039d316-1c4b-4281-b951-d872f2087c98