Prototype an 'allow-unsandboxed-auxiliary' sandbox flag.

Source/core/page/CreateWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 100 matching lines @@
     if (features.ySet)
         windowRect.setY(features.y);
     if (features.widthSet)
         windowRect.setWidth(features.width + (windowRect.width() - viewportSize.width()));
     if (features.heightSet)
         windowRect.setHeight(features.height + (windowRect.height() - viewportSize.height()));
 
     host->chrome().setWindowRect(windowRect);
     host->chrome().show(policy);
 
-    frame.loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
+    if (openerFrame.document()->isSandboxed(SandboxUnsandboxedAuxiliary))

[philipj_slow, 2015/05/13 10:36:19]

The name is quite cryptic in this context. If you sandbox something unsandboxed,
it's no longer unsandboxed... Since the meaning is inverted from the syntax,
something like SandboxAuxiliaryBrowsingContexts would be clearer, but that would
make it harder to find this code if you just know the syntax.

No suggestion for how to make this better, just hoping you have an idea :)

[Mike West, 2015/05/13 11:22:01]

That's a fair point. Maybe something like
"SandboxPropagatesToAuxiliaryBrowsingContexts"? That seems more consistent with
the way flags are defined in HTML (I assume this would end up as something like
"Sandbox Propagates to Auxiliary Browsing Contexts flag" in
https://html.spec.whatwg.org/multipage/browsers.html#sandboxing). *shrug*

[philipj_slow, 2015/05/13 12:29:04]

That name is much more clear for now, thanks!

+        frame.loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
 
     created = true;
     return &frame;
 }
 
 LocalFrame* createWindow(const String& urlString, const AtomicString& frameName, const WindowFeatures& windowFeatures,
     LocalDOMWindow& callingWindow, LocalFrame& firstFrame, LocalFrame& openerFrame)
 {
     LocalFrame* activeFrame = callingWindow.frame();
     ASSERT(activeFrame);
@@ skipping 61 matching lines @@
     if (shouldSendReferrer == MaybeSendReferrer) {
         newFrame->loader().setOpener(&openerFrame);
         newFrame->document()->setReferrerPolicy(openerFrame.document()->referrerPolicy());
     }
     FrameLoadRequest newRequest(0, request.resourceRequest());
     newRequest.setFormState(request.formState());
     newFrame->loader().load(newRequest);
 }
 
 } // namespace blink