Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/renderer/render_view_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view_impl.h"
 
 #include <algorithm>
 #include <cmath>
 #include <string>
 #include <vector>
@@ skipping 1972 matching lines @@
   bool is_content_initiated =
       DocumentState::FromDataSource(frame->provisionalDataSource())->
           navigation_state()->is_content_initiated();
 
   // Experimental:
   // If --enable-strict-site-isolation is enabled, send all top-level
   // navigations to the browser to let it swap processes when crossing site
   // boundaries.  This is currently expected to break some script calls and
   // navigations, such as form submissions.
   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
-  if (!frame->parent() && (is_content_initiated || is_redirect) &&
-      command_line.HasSwitch(switches::kEnableStrictSiteIsolation)) {
-    GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
-    OpenURL(frame, url, referrer, default_policy);
-    return WebKit::WebNavigationPolicyIgnore;
+  if (command_line.HasSwitch(switches::kEnableStrictSiteIsolation) &&
+      !frame->parent() && (is_content_initiated || is_redirect)) {
+    WebString origin_str = frame->document().securityOrigin().toString();
+    GURL frame_url(origin_str.utf8().data());
+    // TODO(cevans): revisit whether this origin check is still necessary once
+    // crbug.com/101395 is fixed.
+    if (frame_url.GetOrigin() != url.GetOrigin()) {
+      GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
+      OpenURL(frame, url, referrer, default_policy);
+      return WebKit::WebNavigationPolicyIgnore;
+    }
   }
 
   // If the browser is interested, then give it a chance to look at top level
   // navigations.
   if (is_content_initiated &&
       renderer_preferences_.browser_handles_top_level_requests &&
       IsNonLocalTopLevelNavigation(url, frame, type)) {
     GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
     // Reset these counters as the RenderView could be reused for the next
     // navigation.
@@ skipping 2713 matching lines @@
   return !!RenderThreadImpl::current()->compositor_thread();
 }
 
 void RenderViewImpl::OnJavaBridgeInit(
     const IPC::ChannelHandle& channel_handle) {
   DCHECK(!java_bridge_dispatcher_.get());
 #if defined(ENABLE_JAVA_BRIDGE)
   java_bridge_dispatcher_.reset(new JavaBridgeDispatcher(this, channel_handle));
 #endif
 }