Enhance --enable-strict-site-isolation to prevent a site-isolated renderer

content/renderer/render_view_impl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view_impl.h"
 
 #include <algorithm>
 #include <cmath>
 #include <string>
 #include <vector>
@@ skipping 2003 matching lines @@
   bool is_content_initiated =
       NavigationState::FromDataSource(frame->provisionalDataSource())->
           is_content_initiated();
 
   // Experimental:
   // If --enable-strict-site-isolation is enabled, send all top-level
   // navigations to the browser to let it swap processes when crossing site
   // boundaries.  This is currently expected to break some script calls and
   // navigations, such as form submissions.
   const CommandLine& command_line = *CommandLine::ForCurrentProcess();
-  if (!frame->parent() && (is_content_initiated || is_redirect) &&
-      command_line.HasSwitch(switches::kEnableStrictSiteIsolation)) {
-    GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
-    OpenURL(frame, url, referrer, default_policy);
-    return WebKit::WebNavigationPolicyIgnore;
+  if (command_line.HasSwitch(switches::kEnableStrictSiteIsolation) &&
+      !frame->parent() && (is_content_initiated || is_redirect)) {
+    WebString origin_str = frame->document().securityOrigin().toString();
+    GURL frame_url(origin_str.utf8().data());
+    if (frame_url.GetOrigin() != url.GetOrigin()) {

[Charlie Reis, 2011/11/10 01:09:26]

This doesn't agree with the logic the browser uses to decide when it's safe to
swap processes.  For example, two different subdomains of the same domain will
not cause a swap (but this logic will needlessly send it over to the browser),
while a hosted app that covers part of an origin should cause a swap (but this
logic would not send it over to the browser).  There's other things that catch
the hosted app case, but my point is that it's not quite the logic we want.

I think this origin comparison is only needed because POSTs don't work when we
punt them to the browser process yet (http://crbug.com/101395).  I agree that
this workaround is useful until then, so can you add a TODO to remove it when
101395 is fixed?

+      GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
+      OpenURL(frame, url, referrer, default_policy);
+      return WebKit::WebNavigationPolicyIgnore;
+    }
   }
 
   // If the browser is interested, then give it a chance to look at top level
   // navigations.
   if (is_content_initiated &&
       renderer_preferences_.browser_handles_top_level_requests &&
       IsNonLocalTopLevelNavigation(url, frame, type)) {
     GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
     // Reset these counters as the RenderView could be reused for the next
     // navigation.
@@ skipping 2665 matching lines @@
   return webview()->settings()->useThreadedCompositor();
 }
 
 void RenderViewImpl::OnJavaBridgeInit(
     const IPC::ChannelHandle& channel_handle) {
   DCHECK(!java_bridge_dispatcher_.get());
 #if defined(ENABLE_JAVA_BRIDGE)
   java_bridge_dispatcher_.reset(new JavaBridgeDispatcher(this, channel_handle));
 #endif
 }