Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(156)

Unified Diff: third_party/WebKit/Source/core/dom/Document.cpp

Issue 1676793003: Revert of Don't set the origin twice when navigating for javascript: URLs (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 4 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 46adc2123a9414a43b92a94147ada65814bb21ab..349b9f4c0e9af9b58c61ec56299843e99d568930 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -315,9 +315,16 @@
return true;
}
-static bool shouldInheritContentSecurityPolicyFromOwner(const KURL& url)
-{
- // TODO(jochen): Somehow unify this with DocumentInit::shouldInheritSecurityOriginFromOwner.
+static bool shouldInheritSecurityOriginFromOwner(const KURL& url)
+{
+ // http://www.whatwg.org/specs/web-apps/current-work/#origin-0
+ //
+ // If a Document has the address "about:blank"
+ // The origin of the Document is the origin it was assigned when its browsing context was created.
+ //
+ // Note: We generalize this to all "blank" URLs and invalid URLs because we
+ // treat all of these URLs as about:blank.
+ //
return url.isEmpty() || url.protocolIsAbout();
}
@@ -4929,7 +4936,7 @@
setBaseURLOverride(initializer.parentBaseURL());
}
- if (!initializer.shouldInheritSecurityOriginFromOwner())
+ if (!shouldInheritSecurityOriginFromOwner(m_url))
return;
// If we do not obtain a meaningful origin from the URL, then we try to
@@ -4961,7 +4968,7 @@
setContentSecurityPolicy(csp ? csp : ContentSecurityPolicy::create());
if (m_frame && m_frame->tree().parent() && m_frame->tree().parent()->isLocalFrame()) {
ContentSecurityPolicy* parentCSP = toLocalFrame(m_frame->tree().parent())->document()->contentSecurityPolicy();
- if (shouldInheritContentSecurityPolicyFromOwner(m_url)) {
+ if (shouldInheritSecurityOriginFromOwner(m_url)) {
contentSecurityPolicy()->copyStateFrom(parentCSP);
} else if (isPluginDocument()) {
// Per CSP2, plugin-types for plugin documents in nested browsing

Powered by Google App Engine
This is Rietveld 408576698