Check the response URL origin in BufferedDataSource to avoid mixing cross-origin responses.

media/blink/buffered_data_source.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MEDIA_BLINK_BUFFERED_DATA_SOURCE_H_
 #define MEDIA_BLINK_BUFFERED_DATA_SOURCE_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 141 matching lines @@
   // the render thread.
   void ReadInternal();
 
   // BufferedResourceLoader::Start() callback for initial load.
   void StartCallback(BufferedResourceLoader::Status status);
 
   // BufferedResourceLoader::Start() callback for subsequent loads (i.e.,
   // when accessing ranges that are outside initial buffered region).
   void PartialReadStartCallback(BufferedResourceLoader::Status status);
 
+  // Returns true if we can accept the new partial response.
+  bool CheckPartialResponseURL(const GURL& partial_response_original_url) const;
+
   // BufferedResourceLoader callbacks.
   void ReadCallback(BufferedResourceLoader::Status status, int bytes_read);
   void LoadingStateChangedCallback(BufferedResourceLoader::LoadingState state);
   void ProgressCallback(int64 position);
 
   // Update |loader_|'s deferring strategy in response to a play/pause, or
   // change in playback rate.
   void UpdateDeferStrategy(bool paused);
 
   // URL of the resource requested.
@@ skipping 59 matching lines @@
   // Current playback rate.
   double playback_rate_;
 
   scoped_refptr<MediaLog> media_log_;
 
   // Host object to report buffered byte range changes to.
   BufferedDataSourceHost* host_;
 
   DownloadingCB downloading_cb_;
 
+  // The original URL of the first response. If the request is redirected to
+  // another URL it is the URL after redirected. If the response is generated in
+  // a Service Worker this URL is empty. BufferedDataSource checks the original
+  // URL of each successive response. If the origin URL of it is different from
+  // the original URL of the first response, it is treated as an error.
+  GURL response_original_url_;
+
   // Disallow rebinding WeakReference ownership to a different thread by keeping
   // a persistent reference. This avoids problems with the thread-safety of
   // reaching into this class from multiple threads to attain a WeakPtr.
   base::WeakPtr<BufferedDataSource> weak_ptr_;
   base::WeakPtrFactory<BufferedDataSource> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(BufferedDataSource);
 };
 
 }  // namespace media
 
 #endif  // MEDIA_BLINK_BUFFERED_DATA_SOURCE_H_