Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1002)

Unified Diff: third_party/WebKit/Source/core/loader/DocumentLoader.cpp

Issue 1710283003: OOPIF: Handle cross-site frames being blocked by X-Frame-Options or CSP. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Rebase Created 4 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/core/loader/DocumentLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
index d76d6e3208fb1cff218d29d6ee93b32c84f43535..ac11fac419f2dc2f1a37826aa9ee249b18b505ff 100644
--- a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
@@ -377,11 +377,18 @@ bool DocumentLoader::shouldContinueForResponse() const
void DocumentLoader::cancelLoadAfterXFrameOptionsOrCSPDenied(const ResourceResponse& response)
{
+ // TODO(alexmos): Figure out how this needs to be called in OOPIF scenarios.
InspectorInstrumentation::continueAfterXFrameOptionsDenied(m_frame, this, mainResourceIdentifier(), response);
- frame()->document()->enforceSandboxFlags(SandboxOrigin);
- if (FrameOwner* owner = frame()->owner())
- owner->dispatchLoad();
+ // If this load was started in a different process, that process needs to
+ // be notified about the block, so that it can fire the FrameOwner load
+ // event and set a unique origin for the frame that was blocked.
+ //
+ // TODO(mkwst,alexmos): This will become unnecessary after XFO and CSP
+ // enforcement is moved to the browser process (https://crbug.com/555418).
+ frameLoader()->client()->didCancelLoadAfterXFrameOptionsOrCSPDenied();
+
+ frame()->cancelLoadAfterXFrameOptionsOrCSPDenied();
// The load event might have detached this frame. In that case, the load will already have been cancelled during detach.
if (frameLoader())

Powered by Google App Engine
This is Rietveld 408576698