Prevent cross-site pages when --site-per-process is passed

content/browser/renderer_host/resource_loader.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/resource_loader.h"
 
 #include "base/message_loop.h"
 #include "base/time.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/renderer_host/doomed_resource_handler.h"
@@ skipping 285 matching lines @@
       render_view_id,
       ssl_info,
       fatal);
 }
 
 void ResourceLoader::OnResponseStarted(net::URLRequest* unused) {
   DCHECK_EQ(request_.get(), unused);
 
   VLOG(1) << "OnResponseStarted: " << request_->url().spec();
 
+  // We should allow the following case:
+  // Iframe page (a.com/svrRedirect.php) in page (a.com/index.html)
+  // do the server-side redirect to page (b.com/svrRedirect.php) which
+  // eventually redirect the iframe back to page (a.com/static.html).
+  // Since server-side redirect does not load the page into the render
+  // process, we are safe in this situation and should allow it.
+  //
+  // But we need to block the following case:
+  // Iframe page (a.com/svrRedirect.php) in page (a.com/index.html)
+  // do the server-side redirect to page (b.com/clientRedirect.php) which
+  // eventually redirect the iframe back to page (a.com/static.html).
+  // Since client-side redirect DOES load the page into the render
+  // process, we should block it.

[Charlie Reis, 2012/12/05 02:02:58]

This is a nice comment but it's kind of out of place here, since there's nothing
specific to the site-per-process policy here.  Let's simplify it to:

"The CanLoadPage check should take place after any server redirects have
finished, at the point in time that we know a page will commit in the renderer
process."

[irobert, 2012/12/05 19:00:03]

Done.

+  ResourceRequestInfoImpl* info = GetRequestInfo();
+  ChildProcessSecurityPolicyImpl* policy =
+      ChildProcessSecurityPolicyImpl::GetInstance();
+  if (!policy->CanLoadPage(info->GetChildID(),
+                           request_->url(),
+                           info->GetResourceType())) {
+    Cancel();
+    return;
+  }
+
   if (!request_->status().is_success()) {
     ResponseCompleted();
     return;
   }
 
   // We want to send a final upload progress message prior to sending the
   // response complete message even if we're waiting for an ack to to a
   // previous upload progress message.
   waiting_for_upload_progress_ack_ = false;
   ReportUploadProgress();
@@ skipping 257 matching lines @@
     // we resume.
     deferred_stage_ = DEFERRED_FINISH;
   }
 }
 
 void ResourceLoader::CallDidFinishLoading() {
   delegate_->DidFinishLoading(this);
 }
 
 }  // namespace content