Modifies WindowProxy::setSecurityToken so that the frame's SecurityOrigin is taken into account whe…

Source/bindings/core/v8/WindowProxy.cpp

Index: Source/bindings/core/v8/WindowProxy.cpp
diff --git a/Source/bindings/core/v8/WindowProxy.cpp b/Source/bindings/core/v8/WindowProxy.cpp
index 0feb32db4bbeed456e71777b4a2346a9e745af64..a6cec28c0ba6bd4a3615bf8fb3c065289dcd5937 100644
--- a/Source/bindings/core/v8/WindowProxy.cpp
+++ b/Source/bindings/core/v8/WindowProxy.cpp
@@ -454,8 +454,16 @@ void WindowProxy::setSecurityToken(SecurityOrigin* origin)
         return;
     }
 
-    if (m_world->isPrivateScriptIsolatedWorld())
+    if (m_world->isPrivateScriptIsolatedWorld()) {
         token = "private-script://" + token;
+    } else if (m_world->isIsolatedWorld()) {
+        String frameSecurityToken = m_frame->securityContext()->securityOrigin()->toString();
+        if (frameSecurityToken.isEmpty() || frameSecurityToken == "null") {
+            context->UseDefaultSecurityToken();
+            return;
+        }
+        token = frameSecurityToken + token;

[haraken, 2015/09/10 23:34:20]

Just help me understand: Why do we need to add a per-frame information to the
token? What we need is to add a per-world information (e.g., world id) to the
token, isn't it?

[epertoso, 2015/09/11 13:18:22]

The rationale here is: the extension can access some domain, e.g.
'http://www.abc.de/*'. 

A page on abc.de has an iframe, whose source is still
'http://www.abc.de/something', so the extension script is injected in that frame
too.

IIUC, there are now two worlds for the same script, but the same-origin policy
doesn't prevent the iframe from accessing the content of the document in which
it is contained, because they have the same protocol, host and port.

+    }
 
     CString utf8Token = token.utf8();
     // NOTE: V8 does identity comparison in fast path, must use a symbol