Make Document::isSecureContext() work for OOPIFs

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 3b619f154c6fca9d60b09d3a99f30145ba36c663..a94c85e450ead03879d5862f9236011eeb94bdf1 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -545,6 +545,7 @@ bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeName, OnDidChangeName)
     IPC_MESSAGE_HANDLER(FrameHostMsg_EnforceStrictMixedContentChecking,
                         OnEnforceStrictMixedContentChecking)
+    IPC_MESSAGE_HANDLER(FrameHostMsg_UpdateOrigin, OnUpdateOrigin)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidAssignPageId, OnDidAssignPageId)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeSandboxFlags,
                         OnDidChangeSandboxFlags)
@@ -1475,6 +1476,13 @@ void RenderFrameHostImpl::OnEnforceStrictMixedContentChecking() {
   frame_tree_node()->SetEnforceStrictMixedContentChecking(true);
 }
 
+void RenderFrameHostImpl::OnUpdateOrigin(
+    const url::Origin& origin,
+    bool is_potentially_trustworthy_unique_origin) {
+  frame_tree_node()->SetCurrentOrigin(origin,

[alexmos, 2016/03/14 22:20:36]

I know this is temporary until we fix issue 594645, but I'm still wary of adding
this in unrestricted form, as it basically lets a compromised renderer set any
origin it wishes.  Nasko recently added commit-time verification of the renderer
origin to ensure it's valid: https://codereview.chromium.org/1775543002/, so we
don't want to undermine that with this IPC.  That said, this IPC isn't entirely
weird, as we could need a renderer->browser origin update IPC later on for other
things, e.g. document.domain updates, PrivilegeData bits, etc. (though atm I
don't have a use case that requires it in mind).

A couple of things we could do:
- restrict this function to only work if |origin| is unique, i.e., for the only
use case today.
- call Nasko's RenderFrameHostImpl::CanCommitOrigin here to validate the origin.
 That has an early-exit for unique origins, so it should allow our use case, and
it'd be safe for potentially other use cases in the future, but I'm not sure we
want to add a broad hole for updating origins without motivating use cases.
- Go back to having a dedicated IPC for this, something like
OnDidSetUniqueOrigin that takes the trustworthiness bool.  That's safe as it's
always ok for renderer to restrict itself to a unique origin.  It'd be nice to
eventually figure out the trustworthiness in the browser process as well (we do
have the URL here, but I guess we'd need to make 
SchemeRegistry::shouldTreatURLSchemeAsSecure and
SecurityPolicy::isOriginWhiteListedTrustworthy available on the browser side).

+Nasko for opinions on this, and also to start doing an owner's review for
content/, since everything else looks good to me. :)

[estark, 2016/03/15 01:04:41]

Oh, I wasn't aware that we were already validating the origin on navigation. I
think in that case it makes sense to make it OnUpdateToUniqueOrigin() or
something. I've gone ahead and done that, though I'm happy to change it to
something else if Nasko ends up having another opinion.

+                                      is_potentially_trustworthy_unique_origin);
+}
+
 void RenderFrameHostImpl::OnDidAssignPageId(int32_t page_id) {
   // Update the RVH's current page ID so that future IPCs from the renderer
   // correspond to the new page.