Validate the Origin HTTP header in the browser process.

content/browser/child_process_security_policy_impl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_
 #define CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_
 
 
 #include <map>
 #include <set>
@@ skipping 108 matching lines @@
   void GrantReadRawCookies(int child_id);
 
   // Revoke read raw cookies permission.
   void RevokeReadRawCookies(int child_id);
 
   // Before servicing a child process's request for a URL, the browser should
   // call this method to determine whether the process has the capability to
   // request the URL.
   bool CanRequestURL(int child_id, const GURL& url);
 
+  // Whether the process is allowed to commit a page from the given URL. This is

[nasko, 2015/08/14 22:14:42]

nit: s/page/document/

[Charlie Reis, 2015/08/14 23:23:32]

Done.

+  // more restrictive than CanRequestURL, since CanRequestURL allows requests
+  // that might lead to cross-process navigations or ShellExecute (external to

[nasko, 2015/08/14 22:14:42]

nit: ShellExecute is a Windows specific API. This is related to external
protocol handlers, right? Why not state it that way, since it is already hinted
at in the parenthesized text?

[Charlie Reis, 2015/08/14 23:23:32]

Done.

+  // the browser).
+  bool CanCommitURL(int child_id, const GURL& url);
+
   // Explicit permissions checks for FileSystemURL specified files.
   bool CanReadFileSystemFile(int child_id, const storage::FileSystemURL& url);
   bool CanWriteFileSystemFile(int child_id, const storage::FileSystemURL& url);
   bool CanCreateFileSystemFile(int child_id, const storage::FileSystemURL& url);
   bool CanCreateReadWriteFileSystemFile(int child_id,
                                         const storage::FileSystemURL& url);
   bool CanCopyIntoFileSystemFile(int child_id,
                                  const storage::FileSystemURL& url);
   bool CanDeleteFileSystemFile(int child_id, const storage::FileSystemURL& url);
 
@@ skipping 100 matching lines @@
   WorkerToMainProcessMap worker_map_;
 
   FileSystemPermissionPolicyMap file_system_policy_map_;
 
   DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicyImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_CHILD_PROCESS_SECURITY_POLICY_IMPL_H_