Prevent leaking PDF data cross-origin

pdf/out_of_process_instance.cc

Index: pdf/out_of_process_instance.cc
diff --git a/pdf/out_of_process_instance.cc b/pdf/out_of_process_instance.cc
index 705da85ab7d9bf424d5a2a23b06568420d3c7405..946202b20b634a3a3e5cdfc37aae88910294d37b 100644
--- a/pdf/out_of_process_instance.cc
+++ b/pdf/out_of_process_instance.cc
@@ -305,23 +305,25 @@ bool OutOfProcessInstance::Init(uint32_t argc,
                                 const char* argn[],
                                 const char* argv[]) {
   // Check if the PDF is being loaded in the PDF chrome extension. We only allow
-  // the plugin to be put into "full frame" mode when it is being loaded in the
-  // extension because this enables some features that we don't want pages
-  // abusing outside of the extension.
+  // the plugin to be loaded in the extension to avoid exposing sensitive APIs

[Sam McNally, 2015/08/25 03:11:20]

And print preview?

[raymes, 2015/08/25 04:02:23]

Done.

+  // directly to external websites.
   pp::Var document_url_var = pp::URLUtil_Dev::Get()->GetDocumentURL(this);
   std::string document_url = document_url_var.is_string() ?

[Sam McNally, 2015/08/25 03:11:20]

if (!document_url_var.is_string())
  return false;

[raymes, 2015/08/25 04:02:23]

Done.

       document_url_var.AsString() : std::string();
   std::string extension_url = std::string(kChromeExtension);
-  bool in_extension =
-      !document_url.compare(0, extension_url.size(), extension_url);
-
-  if (in_extension) {
-    // Check if the plugin is full frame. This is passed in from JS.
-    for (uint32_t i = 0; i < argc; ++i) {
-      if (strcmp(argn[i], "full-frame") == 0) {
-        full_ = true;
-        break;
-      }
+  std::string print_preview_url = std::string(kChromePrint);
+  bool allowed =
+      !document_url.compare(0, extension_url.size(), extension_url) ||

[Sam McNally, 2015/08/25 03:11:20]

if (!base::StringPiece(document_url).starts_with(kChromeExtension) &&
    !base::StringPiece(document_url).starts_with(kChromePrint)) {
  return false;
}

[raymes, 2015/08/25 04:02:23]

Done.

+      !document_url.compare(0, print_preview_url.size(), print_preview_url);
+
+  if (!allowed)
+    return false;
+
+  // Check if the plugin is full frame. This is passed in from JS.
+  for (uint32_t i = 0; i < argc; ++i) {
+    if (strcmp(argn[i], "full-frame") == 0) {
+      full_ = true;
+      break;
     }
   }