| Index: content/browser/child_process_security_policy.cc
|
| ===================================================================
|
| --- content/browser/child_process_security_policy.cc (revision 112335)
|
| +++ content/browser/child_process_security_policy.cc (working copy)
|
| @@ -78,7 +78,6 @@
|
| // Schemes that have not been granted default to being denied.
|
| bool CanRequestURL(const GURL& url) {
|
| SchemeMap::const_iterator judgment(scheme_policy_.find(url.scheme()));
|
| -
|
| if (judgment == scheme_policy_.end())
|
| return false; // Unmentioned schemes are disallowed.
|
|
|
| @@ -359,30 +358,32 @@
|
| if (IsWebSafeScheme(url.scheme()))
|
| return true; // The scheme has been white-listed for every child process.
|
|
|
| - if (IsPseudoScheme(url.scheme())) {
|
| - // There are a number of special cases for pseudo schemes.
|
| + // There are a number of special cases for pseudo-schemes.
|
| + if (url.SchemeIs(chrome::kViewSourceScheme)) {
|
| + // A view-source URL is allowed if the child process is permitted to
|
| + // request the embedded URL. Careful to avoid pointless recursion.
|
| + GURL child_url(url.path());
|
| + if (child_url.SchemeIs(chrome::kViewSourceScheme) &&
|
| + url.SchemeIs(chrome::kViewSourceScheme))
|
| + return false;
|
|
|
| - if (url.SchemeIs(chrome::kViewSourceScheme)) {
|
| - // A view-source URL is allowed if the child process is permitted to
|
| - // request the embedded URL. Careful to avoid pointless recursion.
|
| - GURL child_url(url.path());
|
| - if (child_url.SchemeIs(chrome::kViewSourceScheme) &&
|
| - url.SchemeIs(chrome::kViewSourceScheme))
|
| - return false;
|
| + return CanRequestURL(child_id, child_url);
|
| + }
|
|
|
| - return CanRequestURL(child_id, child_url);
|
| - }
|
| + if (url.SchemeIs(chrome::kAboutScheme)) {
|
| + // Every child process can request <about:blank> but URLs like
|
| + // <about:memory> and <about:crash> shouldn't be requestable by any
|
| + // child process.
|
| + return LowerCaseEqualsASCII(url.spec(), chrome::kAboutBlankURL);
|
| + }
|
|
|
| - if (LowerCaseEqualsASCII(url.spec(), chrome::kAboutBlankURL))
|
| - return true; // Every child process can request <about:blank>.
|
| -
|
| - // URLs like <about:memory> and <about:crash> shouldn't be requestable by
|
| - // any child process. Also, this case covers <javascript:...>, which should
|
| - // be handled internally by the process and not kicked up to the browser.
|
| + if (url.SchemeIs(chrome::kJavaScriptScheme)) {
|
| + // The <javascript:...> case should be handled internally by the process
|
| + // and not kicked up to the browser.
|
| return false;
|
| }
|
|
|
| - if (!net::URLRequest::IsHandledURL(url))
|
| + if (!IsPseudoScheme(url.scheme()) && !net::URLRequest::IsHandledURL(url))
|
| return true; // This URL request is destined for ShellExecute.
|
|
|
| {
|
|
|