Disabling JavaScript in MHTML and limiting MHTML loading to top frames.

Source/core/loader/DocumentLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 590 matching lines @@
         if (doc->processingLoadEvent())
             return true;
         if (doc->hasActiveParser())
             return true;
     }
     return frameLoader()->subframeIsLoading();
 }
 
 bool DocumentLoader::maybeCreateArchive()
 {
+    // Only the top-frame can load MHTML.
+    if (m_frame->tree().parent())
+        return false;
+
     // Give the archive machinery a crack at this document. If the MIME type is not an archive type, it will return 0.
     if (!isArchiveMIMEType(m_response.mimeType()))
         return false;
 
     ASSERT(m_mainResource);
     m_archive = MHTMLArchive::create(m_response.url(), m_mainResource->resourceBuffer());
     // Invalid MHTML.
     if (!m_archive || !m_archive->mainResource()) {
         m_archive.clear();
         return false;
     }
 
+    // No JavaScript allowed in MHTML to prevent access to cookies for example.
+    if (m_frame->settings())
+        m_frame->settings()->setScriptEnabled(false);

[abarth-chromium, 2014/02/12 22:09:15]

Won't this setting persist until after the MHTML has left the frame?  Another
way of doing this is to call enforceSandboxFlags(...) on the document you
create.  Using the sandbox flags, you can disable JavaScript (and other features
if you wish), and they will propagate down to child documents.  They also won't
persist when the next Document is loaded into the frame.

[Jay Civelli, 2014/02/12 23:26:40]

Ah! Thanks for catching this, I did not realize the settings would persist.
I changed to use enforceSandboxFlags() with all sandbox flags, as I don't think
we need any of the features that we can sandbox (layout tests pass, trying a few
actual actual saved MHTML pages worked as well).

+
     addAllArchiveResources(m_archive.get());
     ArchiveResource* mainResource = m_archive->mainResource();
 
     // The origin is the MHTML file, we need to set the base URL to the document encoded in the MHTML so
     // relative URLs are resolved properly.
     ensureWriter(mainResource->mimeType(), m_archive->mainResource()->url());
 
     commitData(mainResource->data()->data(), mainResource->data()->size());
     return true;
 }
@@ skipping 212 matching lines @@
 void DocumentLoader::replaceDocument(const String& source, Document* ownerDocument)
 {
     m_frame->loader().stopAllLoaders();
     m_writer = createWriterFor(m_frame, ownerDocument, m_frame->document()->url(), mimeType(), m_writer ? m_writer->encoding() : emptyAtom,  m_writer ? m_writer->encodingWasChosenByUser() : false, true);
     if (!source.isNull())
         m_writer->appendReplacingData(source);
     endWriting(m_writer.get());
 }
 
 } // namespace WebCore