Disabling JavaScript in MHTML and limiting MHTML loading to top frames.

Source/core/loader/DocumentLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 571 matching lines @@
 void DocumentLoader::clearMainResourceHandle()
 {
     if (!m_mainResource)
         return;
     m_mainResource->removeClient(this);
     m_mainResource = 0;
 }
 
 bool DocumentLoader::maybeCreateArchive()
 {
+    // Only the top-frame can load MHTML.
+    if (m_frame->tree().parent())
+        return false;
+
     // Give the archive machinery a crack at this document. If the MIME type is not an archive type, it will return 0.
     if (!isArchiveMIMEType(m_response.mimeType()))
         return false;
 
     ASSERT(m_mainResource);
     m_archive = MHTMLArchive::create(m_response.url(), m_mainResource->resourceBuffer());
     // Invalid MHTML.
     if (!m_archive || !m_archive->mainResource()) {
         m_archive.clear();
         return false;
     }
 
     addAllArchiveResources(m_archive.get());
     ArchiveResource* mainResource = m_archive->mainResource();
 
     // The origin is the MHTML file, we need to set the base URL to the document encoded in the MHTML so
     // relative URLs are resolved properly.
     ensureWriter(mainResource->mimeType(), m_archive->mainResource()->url());
 
+    // The Document has now been created.
+    document()->enforceSandboxFlags(SandboxAll);
+
     commitData(mainResource->data()->data(), mainResource->data()->size());
     return true;
 }
 
 void DocumentLoader::addAllArchiveResources(MHTMLArchive* archive)
 {
     ASSERT(archive);
     if (!m_archiveResourceCollection)
         m_archiveResourceCollection = adoptPtr(new ArchiveResourceCollection);
     m_archiveResourceCollection->addAllResources(archive);
@@ skipping 200 matching lines @@
 void DocumentLoader::replaceDocument(const String& source, Document* ownerDocument)
 {
     m_frame->loader().stopAllLoaders();
     m_writer = createWriterFor(m_frame, ownerDocument, m_frame->document()->url(), mimeType(), m_writer ? m_writer->encoding() : emptyAtom,  m_writer ? m_writer->encodingWasChosenByUser() : false, true);
     if (!source.isNull())
         m_writer->appendReplacingData(source);
     endWriting(m_writer.get());
 }
 
 } // namespace WebCore