Make Document::isSecureContext() work for OOPIFs

third_party/WebKit/Source/platform/weborigin/SecurityOrigin.h

 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 26 matching lines @@
 
 namespace blink {
 
 class KURL;
 class SecurityOriginCache;
 
 class PLATFORM_EXPORT SecurityOrigin : public RefCounted<SecurityOrigin> {
     WTF_MAKE_NONCOPYABLE(SecurityOrigin);
 public:
     static PassRefPtr<SecurityOrigin> create(const KURL&);
+    static PassRefPtr<SecurityOrigin> createUnique(bool isPotentiallyTrustworthy, bool shouldBypassSecureContextCheck);
     static PassRefPtr<SecurityOrigin> createUnique();
 
     static PassRefPtr<SecurityOrigin> createFromString(const String&);
     static PassRefPtr<SecurityOrigin> create(const String& protocol, const String& host, int port);
 
     static void setCache(SecurityOriginCache*);
 
     // Some URL schemes use nested URLs for their security context. For example,
     // filesystem URLs look like the following:
     //
@@ skipping 80 matching lines @@
 
     // Returns true if the origin loads resources either from the local
     // machine or over the network from a
     // cryptographically-authenticated origin, as described in
     // https://w3c.github.io/webappsec/specs/powerfulfeatures/#is-origin-trustworthy.
     bool isPotentiallyTrustworthy() const;
 
     // Returns a human-readable error message describing that a non-secure origin's access to a feature is denied.
     static String isPotentiallyTrustworthyErrorMessage();
 
+    void setIsPotentiallyTrustworthySandboxedOrigin();
+
+    // Returns true if the origin should bypass the secure context check.
+    bool bypassSecureContextCheck() const;
+
     // Returns true if this SecurityOrigin can load local resources, such
     // as images, iframes, and style sheets, and can link to local URLs.
     // For example, call this function before creating an iframe to a
     // file:// URL.
     //
     // Note: A SecurityOrigin might be allowed to load local resources
     //       without being able to issue an XMLHttpRequest for a local URL.
     //       To determine whether the SecurityOrigin can issue an
     //       XMLHttpRequest for a URL, call canRequest(url).
     bool canLoadLocalResources() const { return m_canLoadLocalResources; }
@@ skipping 113 matching lines @@
     String m_host;
     String m_domain;
     String m_suboriginName;
     unsigned short m_port;
     unsigned short m_effectivePort;
     bool m_isUnique;
     bool m_universalAccess;
     bool m_domainWasSetInDOM;
     bool m_canLoadLocalResources;
     bool m_blockLocalAccessFromLocalOrigin;
+
+    // True if the origin is unique and should be considered potentially trustworthy.
+    bool m_isUniqueOriginPotentiallyTrustworthy;
+
+    // True if the origin is unique and should bypass the secure context check.
+    bool m_uniqueOriginShouldBypassSecureContextCheck;
 };
 
 } // namespace blink
 
 #endif // SecurityOrigin_h