Prevent bindings escalation on an existing NavigationEntry.

content/browser/web_contents/navigation_entry_impl.h

Index: content/browser/web_contents/navigation_entry_impl.h
diff --git a/content/browser/web_contents/navigation_entry_impl.h b/content/browser/web_contents/navigation_entry_impl.h
index c65bdb32b75a9d9dea2f212e344bb4000ae06810..944a24f8810bce03cc1ba2c4078979cba2b8add0 100644
--- a/content/browser/web_contents/navigation_entry_impl.h
+++ b/content/browser/web_contents/navigation_entry_impl.h
@@ -91,6 +91,16 @@ class CONTENT_EXPORT NavigationEntryImpl
     return site_instance_.get();
   }
 
+  // Remember the set of bindings granted to this NavigationEntry at the time
+  // of commit, to ensure that we do not grant it additional bindings if we
+  // navigate back to it in the future.
+  void set_bindings(int bindings) {
+    bindings_ = bindings;

[Chris Evans, 2013/02/01 22:47:47]

Should this ever be called more than one? Assert?

[Charlie Reis, 2013/02/04 06:03:40]

It's set every time you commit, but we can ensure that it's always the same
value after the first time.  I changed it to initialize to -1 and ensure that it
always gets set to a real value and stays there.  That should avoid any cases
where an attacker tricks us into escalating the bindings later.

+  }

[Chris Evans, 2013/02/01 22:47:47]

Nit: add newline?

[Charlie Reis, 2013/02/04 06:03:40]

This is consistent with the rest of the file.

+  int bindings() const {
+    return bindings_;
+  }
+
   void set_page_type(PageType page_type) {
     page_type_ = page_type;
   }
@@ -185,6 +195,8 @@ class CONTENT_EXPORT NavigationEntryImpl
   // See the accessors above for descriptions.
   int unique_id_;
   scoped_refptr<SiteInstanceImpl> site_instance_;
+  // TODO(creis): Persist bindings_. http://crbug.com/173672.
+  int bindings_;
   PageType page_type_;
   GURL url_;
   Referrer referrer_;