Repository: electron/electron
File: shell/browser/electron_permission_manager.cc (C++)

Code before:
                                    });

  if (request_handler_.is_null()) {
    std::vector<content::PermissionResult> results;
    for (const auto& permission : permissions) {
      const auto permission_type =
          blink::PermissionDescriptorToPermissionType(permission);
      if (permission_type == blink::PermissionType::MIDI_SYSEX) {
        content::ChildProcessSecurityPolicy::GetInstance()
            ->GrantSendMidiSysExMessage(
                render_frame_host->GetProcess()->GetDeprecatedID());
      } else if (permission_type == blink::PermissionType::GEOLOCATION) {
        if (IsGeolocationDisabledViaCommandLine()) {
          results.emplace_back(content::PermissionResult(
              blink::mojom::PermissionStatus::DENIED,
              content::PermissionStatusSource::UNSPECIFIED));
          continue;
        } else {
          ElectronBrowserMainParts::Get()
              ->GetGeolocationControl()
              ->UserDidOptIntoLocationServices();
        }
      }
      results.emplace_back(content::PermissionResult(
          blink::mojom::PermissionStatus::GRANTED,
          content::PermissionStatusSource::UNSPECIFIED));
    }
    std::move(response_callback).Run(results);
    return;
  }

  auto* web_contents =
      content::WebContents::FromRenderFrameHost(render_frame_host);
  int request_id = pending_requests_.Add(std::make_unique<PendingRequest>(
      render_frame_host, std::move(permissions), std::move(response_callback)));

  details.Set("requestingUrl", render_frame_host->GetLastCommittedURL().spec());
  details.Set("isMainFrame", render_frame_host->GetParent() == nullptr);
  base::Value dict_value(std::move(details));

  for (size_t i = 0; i < request_description.permissions.size(); ++i) {
    const auto permission = blink::PermissionDescriptorToPermissionType(
        request_description.permissions[i]);
    const auto callback =
        base::BindRepeating(&ElectronPermissionManager::OnPermissionResponse,
                            base::Unretained(this), request_id, i);
    request_handler_.Run(web_contents, permission, callback, dict_value);
  }
}

void ElectronPermissionManager::OnPermissionResponse(

Review comment (security):
```suggestion
      results.emplace_back(
          blink::mojom::PermissionStatus::GRANTED,
          content::PermissionStatusSource::UNSPECIFIED);
```

Same comment as above.

Code after:
  auto permissions = base::ToVector(request_description.permissions,
                                    [](const auto& permission_descriptor) {
                                      return permission_descriptor.Clone();
                                    });

  if (request_handler_.is_null()) {
    std::vector<content::PermissionResult> results;
    for (const auto& permission : permissions) {
      const auto permission_type =
          blink::PermissionDescriptorToPermissionType(permission);
      if (permission_type == blink::PermissionType::MIDI_SYSEX) {
        content::ChildProcessSecurityPolicy::GetInstance()
            ->GrantSendMidiSysExMessage(
                render_frame_host->GetProcess()->GetDeprecatedID());
      } else if (permission_type == blink::PermissionType::GEOLOCATION) {
        if (IsGeolocationDisabledViaCommandLine()) {
          results.emplace_back(blink::mojom::PermissionStatus::DENIED,
                               content::PermissionStatusSource::UNSPECIFIED);
          continue;
        } else {
          ElectronBrowserMainParts::Get()
              ->GetGeolocationControl()
              ->UserDidOptIntoLocationServices();
        }
      }
      results.emplace_back(blink::mojom::PermissionStatus::GRANTED,
                           content::PermissionStatusSource::UNSPECIFIED);
    }
    std::move(response_callback).Run(results);
    return;
  }

  auto* web_contents =
      content::WebContents::FromRenderFrameHost(render_frame_host);
  int request_id = pending_requests_.Add(std::make_unique<PendingRequest>(
      render_frame_host, std::move(permissions), std::move(response_callback)));

  details.Set("requestingUrl", render_frame_host->GetLastCommittedURL().spec());
  details.Set("isMainFrame", render_frame_host->GetParent() == nullptr);
  base::Value dict_value(std::move(details));

  for (size_t i = 0; i < request_description.permissions.size(); ++i) {
    const auto permission = blink::PermissionDescriptorToPermissionType(
        request_description.permissions[i]);
    const auto callback =
        base::BindRepeating(&ElectronPermissionManager::OnPermissionResponse,
                            base::Unretained(this), request_id, i);
    request_handler_.Run(web_contents, permission, callback, dict_value);
  }
}