Harden the implementation of '--disable-web-security'

third_party/WebKit/Source/platform/weborigin/SecurityOrigin.h

Index: third_party/WebKit/Source/platform/weborigin/SecurityOrigin.h
diff --git a/third_party/WebKit/Source/platform/weborigin/SecurityOrigin.h b/third_party/WebKit/Source/platform/weborigin/SecurityOrigin.h
index e2468fd104ea4477421120f43b4773ab648bde03..a1f867a907686e9d0644cd466110b0542755ab31 100644
--- a/third_party/WebKit/Source/platform/weborigin/SecurityOrigin.h
+++ b/third_party/WebKit/Source/platform/weborigin/SecurityOrigin.h
@@ -150,8 +150,17 @@ public:
     // Explicitly grant the ability to access every other SecurityOrigin.
     //
     // WARNING: This is an extremely powerful ability. Use with caution!
+    //
+    // TODO(mkwst): Remove this API as soon as is fesiable. That will likely
+    // require creating a more limited replacement.
     void grantUniversalAccess();
 
+    // Grant `file:` origins universal access.
+    //
+    // TODO(mkwst): As soon as we can reasonably get WebView to stop offering
+    // the API which requires this method, we should remove it.

[Torne, 2015/12/09 12:55:56]

You can have this comment if you want, but realistically WebView is not going to
be able to actually remove this for a very long time - we're hoping to deprecate
it, strongly discourage it, and maybe even disable it in apps that target at
least some reasonably modern OS version, but it's hard to get away from backward
compatibility for old apps. :/

[Mike West, 2015/12/09 14:17:49]

*sigh*

+    void grantUniversalAccessForFileOrigins();
+
     bool canAccessDatabase() const { return !isUnique(); }
     bool canAccessLocalStorage() const { return !isUnique(); }
     bool canAccessSharedWorkers() const { return !isUnique(); }
@@ -228,6 +237,7 @@ public:
     //   - Use path-based file:// origins.
     struct PrivilegeData {
         bool m_universalAccess;
+        bool m_universalAccessForFileOrigins;
         bool m_canLoadLocalResources;
         bool m_blockLocalAccessFromLocalOrigin;
     };
@@ -258,6 +268,7 @@ private:
     unsigned short m_effectivePort;
     bool m_isUnique;
     bool m_universalAccess;
+    bool m_universalAccessForFileOrigins;
     bool m_domainWasSetInDOM;
     bool m_canLoadLocalResources;
     bool m_blockLocalAccessFromLocalOrigin;