Add window access checks for Suborigins

Source/core/frame/DOMWindow.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/DOMWindow.h"
 
 #include "bindings/core/v8/ScriptCallStackFactory.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExceptionCode.h"
@@ skipping 113 matching lines @@
 
     // If this DOMWindow isn't currently active in the Frame, then there's no
     // way we should allow the access.
     if (isCurrentlyDisplayedInFrame()) {
         // FIXME: Is there some way to eliminate the need for a separate "callingWindow == this" check?
         if (&callingWindow == this)
             return false;
 
         // FIXME: The name canAccess seems to be a roundabout way to ask "can execute script".
         // Can we name the SecurityOrigin function better to make this more clear?
-        if (callingWindow.frame()->securityContext()->securityOrigin()->canAccess(frame()->securityContext()->securityOrigin()))
+        if (callingWindow.frame()->securityContext()->securityOrigin()->canAccessCheckSuborigins(frame()->securityContext()->securityOrigin()))
             return false;
     }
 
     callingWindow.printErrorMessage(crossDomainAccessErrorMessage(&callingWindow));
     return true;
 }
 
 void DOMWindow::resetLocation()
 {
     // Location needs to be reset manually because it doesn't inherit from DOMWindowProperty.
@@ skipping 68 matching lines @@
 // http://crbug.com/17325
 String DOMWindow::sanitizedCrossDomainAccessErrorMessage(LocalDOMWindow* callingWindow)
 {
     if (!callingWindow || !callingWindow->document() || !frame())
         return String();
 
     const KURL& callingWindowURL = callingWindow->document()->url();
     if (callingWindowURL.isNull())
         return String();
 
-    ASSERT(!callingWindow->document()->securityOrigin()->canAccess(frame()->securityContext()->securityOrigin()));
+    ASSERT(!callingWindow->document()->securityOrigin()->canAccessCheckSuborigins(frame()->securityContext()->securityOrigin()));
 
     SecurityOrigin* activeOrigin = callingWindow->document()->securityOrigin();
     String message = "Blocked a frame with origin \"" + activeOrigin->toString() + "\" from accessing a cross-origin frame.";
 
     // FIXME: Evaluate which details from 'crossDomainAccessErrorMessage' may safely be reported to JavaScript.
 
     return message;
 }
 
 String DOMWindow::crossDomainAccessErrorMessage(LocalDOMWindow* callingWindow)
 {
     if (!callingWindow || !callingWindow->document() || !frame())
         return String();
 
     const KURL& callingWindowURL = callingWindow->document()->url();
     if (callingWindowURL.isNull())
         return String();
 
     // FIXME: This message, and other console messages, have extra newlines. Should remove them.
     SecurityOrigin* activeOrigin = callingWindow->document()->securityOrigin();
     SecurityOrigin* targetOrigin = frame()->securityContext()->securityOrigin();
-    ASSERT(!activeOrigin->canAccess(targetOrigin));
+    ASSERT(!activeOrigin->canAccessCheckSuborigins(targetOrigin));
 
     String message = "Blocked a frame with origin \"" + activeOrigin->toString() + "\" from accessing a frame with origin \"" + targetOrigin->toString() + "\". ";
 
     // Sandbox errors: Use the origin of the frames' location, rather than their actual origin (since we know that at least one will be "null").
     KURL activeURL = callingWindow->document()->url();
     // TODO(alexmos): RemoteFrames do not have a document, and their URLs
     // aren't replicated.  For now, construct the URL using the replicated
     // origin for RemoteFrames. If the target frame is remote and sandboxed,
     // there isn't anything else to show other than "null" for its origin.
     KURL targetURL = isLocalDOMWindow() ? document()->url() : KURL(KURL(), targetOrigin->toString());
@@ skipping 22 matching lines @@
     return message + "Protocols, domains, and ports must match.";
 }
 
 DEFINE_TRACE(DOMWindow)
 {
     visitor->trace(m_location);
     EventTargetWithInlineData::trace(visitor);
 }
 
 } // namespace blink