Avoid cross-origin iframe issues when loading PDF in print preview

content/browser/webui/url_data_manager_backend.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/webui/url_data_manager_backend.h"
 
 #include <set>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
@@ skipping 64 matching lines @@
   if (!url.is_valid()) {
     NOTREACHED();
     return false;
   }
 
   return true;
 }
 
 // Parse |url| to get the path which will be used to resolve the request. The
 // path is the remaining portion after the scheme and hostname.
-void URLToRequestPath(const GURL& url, std::string* path) {
+std::string URLToRequestPath(const GURL& url) {

[Charlie Reis, 2015/07/16 19:25:03]

Why can't we just use GURL::path()?  This seems to depend on the parsed version
for the offset anyway.

[raymes, 2015/07/17 01:58:29]

I don't know the answer to that, I didn't write this :) Perhaps we can. Do you
want me to do this in a followup patch?

[Charlie Reis, 2015/07/17 23:45:22]

Wow, this goes back to the initial commit:
https://chromium.googlesource.com/chromium/src/+blame/be7f2174ece293c452eb122...

I suppose we can leave it, but it'd be good to add tests for the query case in
url_data_manager_backend_unittest.cc if you can.  Parsing logic is almost always
worth testing.

[raymes, 2015/07/20 06:46:22]

I no longer change this file in the latest patchset. The approach I had here
didn't work because the dom distiller does something tricky and relies on Web UI
URLs that can have ? in them. I moved this code into UrlDataSource. Does this
seem ok to you? If so I can write a small test for that file.

   const std::string& spec = url.possibly_invalid_spec();
   const url::Parsed& parsed = url.parsed_for_possibly_invalid_spec();
   // + 1 to skip the slash at the beginning of the path.
   int offset = parsed.CountCharactersBefore(url::Parsed::PATH, false) + 1;
 
+  std::string path;
   if (offset < static_cast<int>(spec.size()))
-    path->assign(spec.substr(offset));
+    path = spec.substr(offset);
+
+  // Remove the query string if there is one.
+  return path.substr(0, path.find_last_of('?'));
 }
 
 // Returns a value of 'Origin:' header for the |request| if the header is set.
 // Otherwise returns an empty string.
 std::string GetOriginHeaderValue(const net::URLRequest* request) {
   std::string result;
   if (request->extra_request_headers().GetHeader(
           net::HttpRequestHeaders::kOrigin, &result))
     return result;
   net::HttpRequestHeaders headers;
@@ skipping 475 matching lines @@
   if (!CheckURLIsValid(request->url()))
     return false;
 
   URLDataSourceImpl* source = GetDataSourceFromURL(request->url());
   if (!source)
     return false;
 
   if (!source->source()->ShouldServiceRequest(request))
     return false;
 
-  std::string path;
-  URLToRequestPath(request->url(), &path);
+  std::string path = URLToRequestPath(request->url());
   source->source()->WillServiceRequest(request, &path);
 
   // Save this request so we know where to send the data.
   RequestID request_id = next_request_id_++;
   pending_requests_.insert(std::make_pair(request_id, job));
 
   job->set_allow_caching(source->source()->AllowCaching());
   job->set_add_content_security_policy(
       source->source()->ShouldAddContentSecurityPolicy());
   job->set_content_security_policy_object_source(
@@ skipping 164 matching lines @@
 
 }  // namespace
 
 net::URLRequestJobFactory::ProtocolHandler*
 CreateDevToolsProtocolHandler(content::ResourceContext* resource_context,
                               bool is_incognito) {
   return new DevToolsJobFactory(resource_context, is_incognito);
 }
 
 }  // namespace content