Avoid cross-origin iframe issues when loading PDF in print preview

content/browser/webui/web_ui_data_source_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/webui/web_ui_data_source_impl.h"
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/memory/ref_counted_memory.h"
@@ skipping 53 matching lines @@
     return URLDataSource::GetContentSecurityPolicyObjectSrc();
   }
   std::string GetContentSecurityPolicyFrameSrc() const override {
     if (parent_->frame_src_set_)
       return parent_->frame_src_;
     return URLDataSource::GetContentSecurityPolicyFrameSrc();
   }
   bool ShouldDenyXFrameOptions() const override {
     return parent_->deny_xframe_options_;
   }
+  void WillServiceRequest(const net::URLRequest* request,
+                          std::string* path) const override {
+    // We want to remove any query strings from the path.
+    *path = path->substr(0, path->find_last_of('?'));

[Evan Stade, 2015/12/18 23:15:10]

I'm sure someone more knowledgeable than me has already taken a look at this,
but why is find_last_of the right thing? If it's possible to have multiple ?s,
why is

  path.js?q=string?r=strong

being changed into

  path.js?q=string

and not

  path.js

[raymes, 2016/01/04 01:56:18]

Oops good catch. Thank you and I added a test to catch this :)

+  }
 
  private:
   WebUIDataSourceImpl* parent_;
 };
 
 WebUIDataSourceImpl::WebUIDataSourceImpl(const std::string& source_name)
     : URLDataSourceImpl(
           source_name,
           new InternalDataSource(this)),
       source_name_(source_name),
@@ skipping 154 matching lines @@
 }
 
 void WebUIDataSourceImpl::SendFromResourceBundle(
     const URLDataSource::GotDataCallback& callback, int idr) {
   scoped_refptr<base::RefCountedStaticMemory> response(
       GetContentClient()->GetDataResourceBytes(idr));
   callback.Run(response.get());
 }
 
 }  // namespace content