Fix security checks when navigating remote frames to javascript: URLs.

Fix security checks when navigating remote frames to javascript: URLs.

When navigating a frame by setting an iframe element's src attribute,
HTMLFrameElementBase::isURLAllowed has a security check for
javascript: URLs, which wasn't getting called for remote frames.  It
first referenced the contentDocument(), and only proceeded to do the
security check on that document's frame if the document is not null.
With a remote frame, there will be no Document, so this should
directly access the contentFrame() and use it for the security check.

BUG=588096, 582201
Committed: https://crrev.com/13de353d05728e9560672dd751402597efe3e6b8
Cr-Commit-Position: refs/heads/master@{#377040}

[alexmos, 2016-02-23 00:40:26]

alexmos@chromium.org changed reviewers:
+ dcheng@chromium.org

[alexmos, 2016-02-23 00:40:26]

Daniel, can you please take a look to see if this fix makes sense?  This is
necessary for https://codereview.chromium.org/1715993002/.  The tests in
https://crbug.com/582201 should cover this, though I can't re-enable them just
yet due to an unrelated crash I described in
https://codereview.chromium.org/1715993002/.

[dcheng, 2016-02-23 02:37:44]

dcheng@chromium.org changed reviewers:
+ yukishiino@chromium.org

[dcheng, 2016-02-23 02:37:45]

lgtm

+yukishiino for OWNERS review

[haraken, 2016-02-23 10:07:59]

haraken@chromium.org changed reviewers:
+ haraken@chromium.org

[haraken, 2016-02-23 10:08:00]

https://codereview.chromium.org/1718403002/diff/40001/third_party/WebKit/Sour...
File third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp (right):

https://codereview.chromium.org/1718403002/diff/40001/third_party/WebKit/Sour...
third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:86: bool
ScriptController::canAccessFromCurrentOrigin(ExecutionContext& context, Frame*
frame)

How about just passing v8::Isolate, rather than ExecutionContext?

[alexmos, 2016-02-23 17:51:05]

https://codereview.chromium.org/1718403002/diff/40001/third_party/WebKit/Sour...
File third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp (right):

https://codereview.chromium.org/1718403002/diff/40001/third_party/WebKit/Sour...
third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:86: bool
ScriptController::canAccessFromCurrentOrigin(ExecutionContext& context, Frame*
frame)
On 2016/02/23 10:07:59, haraken wrote:
> 
> How about just passing v8::Isolate, rather than ExecutionContext?

Done.

[haraken, 2016-02-23 17:54:46]

LGTM

[alexmos, 2016-02-23 18:23:14]

The CQ bit was checked by alexmos@chromium.org

[alexmos, 2016-02-23 18:23:14]

The patchset sent to the CQ was uploaded after l-g-t-m from dcheng@chromium.org
Link to the patchset: https://codereview.chromium.org/1718403002/#ps60001
(title: "Pass v8::Isolate directly")

[commit-bot: I haz the power, 2016-02-23 18:27:59]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1718403002/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1718403002/60001

[commit-bot: I haz the power, 2016-02-23 19:19:15]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2016-02-23 19:22:03]

Description was changed from

==========
Fix security checks when navigating remote frames to javascript: URLs.

When navigating a frame by setting an iframe element's src attribute,
HTMLFrameElementBase::isURLAllowed has a security check for
javascript: URLs, which wasn't getting called for remote frames.  It
first referenced the contentDocument(), and only proceeded to do the
security check on that document's frame if the document is not null.
With a remote frame, there will be no Document, so this should
directly access the contentFrame() and use it for the security check.

BUG=588096, 582201
==========

to

==========
Fix security checks when navigating remote frames to javascript: URLs.

When navigating a frame by setting an iframe element's src attribute,
HTMLFrameElementBase::isURLAllowed has a security check for
javascript: URLs, which wasn't getting called for remote frames.  It
first referenced the contentDocument(), and only proceeded to do the
security check on that document's frame if the document is not null.
With a remote frame, there will be no Document, so this should
directly access the contentFrame() and use it for the security check.

BUG=588096, 582201

Committed: https://crrev.com/13de353d05728e9560672dd751402597efe3e6b8
Cr-Commit-Position: refs/heads/master@{#377040}
==========

[commit-bot: I haz the power, 2016-02-23 19:22:04]

Patchset 4 (id:??) landed as
https://crrev.com/13de353d05728e9560672dd751402597efe3e6b8
Cr-Commit-Position: refs/heads/master@{#377040}