Exempt about: URLs from self-reference check for nested frames

third_party/WebKit/Source/core/frame/LocalFrame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 736 matching lines @@
         IntRect rect = editor().firstRectForRange(nextCharacterRange);
         if (rect.contains(framePoint))
             return EphemeralRange(nextCharacterRange);
     }
 
     return EphemeralRange();
 }
 
 bool LocalFrame::isURLAllowed(const KURL& url) const
 {
+    // srcdoc is always allowed
+    if (equalIgnoringFragmentIdentifier(document()->completeURL(AtomicString("about:srcdoc")), url))

[dcheng, 2015/10/29 14:47:07]

How about using Document::isSrcdocDocument() instead? Also, this should be
integrated into the for loop below: otherwise, you can use srcdoc to break the
self-reference checker.

+        return true;
+
     // We allow one level of self-reference because some sites depend on that,
     // but we don't allow more than one.
     bool foundSelfReference = false;
     for (const Frame* frame = this; frame; frame = frame->tree().parent()) {
         if (!frame->isLocalFrame())
             continue;
         if (equalIgnoringFragmentIdentifier(toLocalFrame(frame)->document()->url(), url)) {
             if (foundSelfReference)
                 return false;
             foundSelfReference = true;
@@ skipping 136 matching lines @@
     if (!context)
         return;
 
     WebSecurityOrigin securityOrigin(context->securityOrigin());
     frameScheduler()->setFrameOrigin(&securityOrigin);
 }
 
 DEFINE_WEAK_IDENTIFIER_MAP(LocalFrame);
 
 } // namespace blink