Disabling JavaScript in MHTML and limiting MHTML loading to top frames.

Source/core/loader/DocumentLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 261 matching lines @@
         frameLoader()->checkLoadComplete();
 
     // If the document specified an application cache manifest, it violates the author's intent if we store it in the memory cache
     // and deny the appcache the chance to intercept it in the future, so remove from the memory cache.
     if (m_frame) {
         if (m_mainResource && m_frame->document()->hasManifest())
             memoryCache()->remove(m_mainResource.get());
     }
     m_applicationCacheHost->finishedLoadingMainResource();
     clearMainResourceHandle();
+
+    if (m_archive && document())
+        document()->enforceSandboxFlags(SandboxAll);

[abarth-chromium, 2014/02/12 23:35:39]

This is probably too late.  You want to enforce these flags from the beginning
of the load.  Isn't this the end of the load?

This code should probably be inside the MHTML code, right before it starts
adding content to the document...

 }
 
 bool DocumentLoader::isRedirectAfterPost(const ResourceRequest& newRequest, const ResourceResponse& redirectResponse)
 {
     int status = redirectResponse.httpStatusCode();
     if (((status >= 301 && status <= 303) || status == 307)
         && m_originalRequest.httpMethod() == "POST")
         return true;
 
     return false;
@@ skipping 309 matching lines @@
         if (doc->processingLoadEvent())
             return true;
         if (doc->hasActiveParser())
             return true;
     }
     return frameLoader()->subframeIsLoading();
 }
 
 bool DocumentLoader::maybeCreateArchive()
 {
+    // Only the top-frame can load MHTML.
+    if (m_frame->tree().parent())
+        return false;
+
     // Give the archive machinery a crack at this document. If the MIME type is not an archive type, it will return 0.
     if (!isArchiveMIMEType(m_response.mimeType()))
         return false;
 
     ASSERT(m_mainResource);
     m_archive = MHTMLArchive::create(m_response.url(), m_mainResource->resourceBuffer());
     // Invalid MHTML.
     if (!m_archive || !m_archive->mainResource()) {
         m_archive.clear();
         return false;
@@ skipping 224 matching lines @@
 void DocumentLoader::replaceDocument(const String& source, Document* ownerDocument)
 {
     m_frame->loader().stopAllLoaders();
     m_writer = createWriterFor(m_frame, ownerDocument, m_frame->document()->url(), mimeType(), m_writer ? m_writer->encoding() : emptyAtom,  m_writer ? m_writer->encodingWasChosenByUser() : false, true);
     if (!source.isNull())
         m_writer->appendReplacingData(source);
     endWriting(m_writer.get());
 }
 
 } // namespace WebCore