GitLab

In the future, Android phones will likely expose their security key
functionality over USB. This will be accessed by using the AOA[1]
protocol to communicate with a specific app on the phone. A request for
security key functionality is expressed by sending a magic string as the
AOA "version".

We don't wish to allow WebUSB, the USB extension API, or future users of
the USB Mojo interface to be able to exercise this. Thus this change
blocks such control transfers by default, unless the caller explicitly
indicates that they expect to be sending security key messages.

[1] https://source.android.com/devices/accessories/aoa

BUG=1002262

Change-Id: I785610ee58e319327950200b7dfb230099cadf6b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2462379Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Reviewed-by: Reilly Grant <reillyg@chromium.org>
Commit-Queue: Adam Langley <agl@chromium.org>
Cr-Commit-Position: refs/heads/master@{#816559}