Make Document::isSecureContext() work for OOPIFs

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/containers/hash_tables.h"
@@ skipping 527 matching lines @@
     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptMessage,
                                     OnRunJavaScriptMessage)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm,
                                     OnRunBeforeUnloadConfirm)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidAccessInitialDocument,
                         OnDidAccessInitialDocument)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeOpener, OnDidChangeOpener)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeName, OnDidChangeName)
     IPC_MESSAGE_HANDLER(FrameHostMsg_EnforceStrictMixedContentChecking,
                         OnEnforceStrictMixedContentChecking)
+    IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateOrigin, OnUpdateOrigin)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidAssignPageId, OnDidAssignPageId)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeSandboxFlags,
                         OnDidChangeSandboxFlags)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeFrameOwnerProperties,
                         OnDidChangeFrameOwnerProperties)
     IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateTitle, OnUpdateTitle)
     IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateEncoding, OnUpdateEncoding)
     IPC_MESSAGE_HANDLER(FrameHostMsg_BeginNavigation,
                         OnBeginNavigation)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DispatchLoad, OnDispatchLoad)
@@ skipping 910 matching lines @@
   frame_tree_node()->SetFrameName(name, unique_name);
   if (old_name.empty() && !name.empty())
     frame_tree_node_->render_manager()->CreateProxiesForNewNamedFrame();
   delegate_->DidChangeName(this, name);
 }
 
 void RenderFrameHostImpl::OnEnforceStrictMixedContentChecking() {
   frame_tree_node()->SetEnforceStrictMixedContentChecking(true);
 }
 
+void RenderFrameHostImpl::OnUpdateOrigin(
+    const url::Origin& origin,
+    bool is_potentially_trustworthy_unique_origin) {
+  frame_tree_node()->SetCurrentOrigin(origin,

[alexmos, 2016/03/14 22:20:36]

I know this is temporary until we fix issue 594645, but I'm still wary of adding
this in unrestricted form, as it basically lets a compromised renderer set any
origin it wishes.  Nasko recently added commit-time verification of the renderer
origin to ensure it's valid: https://codereview.chromium.org/1775543002/, so we
don't want to undermine that with this IPC.  That said, this IPC isn't entirely
weird, as we could need a renderer->browser origin update IPC later on for other
things, e.g. document.domain updates, PrivilegeData bits, etc. (though atm I
don't have a use case that requires it in mind).

A couple of things we could do:
- restrict this function to only work if |origin| is unique, i.e., for the only
use case today.
- call Nasko's RenderFrameHostImpl::CanCommitOrigin here to validate the origin.
 That has an early-exit for unique origins, so it should allow our use case, and
it'd be safe for potentially other use cases in the future, but I'm not sure we
want to add a broad hole for updating origins without motivating use cases.
- Go back to having a dedicated IPC for this, something like
OnDidSetUniqueOrigin that takes the trustworthiness bool.  That's safe as it's
always ok for renderer to restrict itself to a unique origin.  It'd be nice to
eventually figure out the trustworthiness in the browser process as well (we do
have the URL here, but I guess we'd need to make 
SchemeRegistry::shouldTreatURLSchemeAsSecure and
SecurityPolicy::isOriginWhiteListedTrustworthy available on the browser side).

+Nasko for opinions on this, and also to start doing an owner's review for
content/, since everything else looks good to me. :)

[estark, 2016/03/15 01:04:41]

Oh, I wasn't aware that we were already validating the origin on navigation. I
think in that case it makes sense to make it OnUpdateToUniqueOrigin() or
something. I've gone ahead and done that, though I'm happy to change it to
something else if Nasko ends up having another opinion.

+                                      is_potentially_trustworthy_unique_origin);
+}
+
 void RenderFrameHostImpl::OnDidAssignPageId(int32_t page_id) {
   // Update the RVH's current page ID so that future IPCs from the renderer
   // correspond to the new page.
   render_view_host_->page_id_ = page_id;
 }
 
 FrameTreeNode* RenderFrameHostImpl::FindAndVerifyChild(
     int32_t child_frame_routing_id,
     bad_message::BadMessageReason reason) {
   FrameTreeNode* child = frame_tree_node()->frame_tree()->FindByRoutingID(
@@ skipping 1143 matching lines @@
   *dst = src;
 
   if (src.routing_id != -1)
     dst->tree_id = RoutingIDToAXTreeID(src.routing_id);
 
   if (src.parent_routing_id != -1)
     dst->parent_tree_id = RoutingIDToAXTreeID(src.parent_routing_id);
 }
 
 }  // namespace content