Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/browser/renderer_host/resource_dispatcher_host.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/browser/renderer_host/resource_dispatcher_host.h"
 
 #include <set>
 #include <vector>
@@ skipping 522 matching lines @@
     load_flags |= net::LOAD_SUB_FRAME;
   } else if (request_data.resource_type == ResourceType::PREFETCH) {
     load_flags |= (net::LOAD_PREFETCH | net::LOAD_DO_NOT_PROMPT_FOR_LOGIN);
   } else if (request_data.resource_type == ResourceType::FAVICON) {
     load_flags |= net::LOAD_DO_NOT_PROMPT_FOR_LOGIN;
   }
 
   if (sync_result)
     load_flags |= net::LOAD_IGNORE_LIMITS;
 
+  ChildProcessSecurityPolicy* policy =
+      ChildProcessSecurityPolicy::GetInstance();
+  if (!policy->CanUseCookiesForOrigin(child_id, request_data.url)) {
+    load_flags |= (net::LOAD_DO_NOT_SEND_COOKIES |
+                   net::LOAD_DO_NOT_SEND_AUTH_DATA |
+                   net::LOAD_DO_NOT_SAVE_COOKIES);
+  }
+
   // Raw headers are sensitive, as they inclide Cookie/Set-Cookie, so only
   // allow requesting them if requestor has ReadRawCookies permission.
   if ((load_flags & net::LOAD_REPORT_RAW_HEADERS)
-      && !ChildProcessSecurityPolicy::GetInstance()->
-              CanReadRawCookies(child_id)) {
+      && !policy->CanReadRawCookies(child_id)) {
     VLOG(1) << "Denied unathorized request for raw headers";
     load_flags &= ~net::LOAD_REPORT_RAW_HEADERS;
   }
 
   request->set_load_flags(load_flags);
   request->set_context(
       filter_->GetURLRequestContext(request_data.resource_type));
   request->set_priority(DetermineRequestPriority(request_data.resource_type));
 
   // Set upload data.
@@ skipping 1598 matching lines @@
   return HTTP_AUTH_RESOURCE_BLOCKED_CROSS;
 }
 
 bool ResourceDispatcherHost::allow_cross_origin_auth_prompt() {
   return allow_cross_origin_auth_prompt_;
 }
 
 void ResourceDispatcherHost::set_allow_cross_origin_auth_prompt(bool value) {
   allow_cross_origin_auth_prompt_ = value;
 }