Disabling JavaScript in MHTML and limiting MHTML loading to top frames.

Source/core/loader/DocumentLoader.cpp

Index: Source/core/loader/DocumentLoader.cpp
diff --git a/Source/core/loader/DocumentLoader.cpp b/Source/core/loader/DocumentLoader.cpp
index f8af711a12b8279d58e6b41a534ba26de10cb7d0..9c2f4ae630727f72461562a76f551c710b572f20 100644
--- a/Source/core/loader/DocumentLoader.cpp
+++ b/Source/core/loader/DocumentLoader.cpp
@@ -589,6 +589,10 @@ void DocumentLoader::clearMainResourceHandle()
 
 bool DocumentLoader::maybeCreateArchive()
 {
+    // Only the top-frame can load MHTML.
+    if (m_frame->tree().parent())
+        return false;
+
     // Give the archive machinery a crack at this document. If the MIME type is not an archive type, it will return 0.
     if (!isArchiveMIMEType(m_response.mimeType()))
         return false;
@@ -608,6 +612,9 @@ bool DocumentLoader::maybeCreateArchive()
     // relative URLs are resolved properly.
     ensureWriter(mainResource->mimeType(), m_archive->mainResource()->url());
 
+    // The Document has now been created.
+    document()->enforceSandboxFlags(SandboxAll);
+
     commitData(mainResource->data()->data(), mainResource->data()->size());
     return true;
 }