Ignore 'X-Frame-Options' inside '<meta>' tags.

third_party/WebKit/Source/core/loader/HttpEquiv.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/loader/HttpEquiv.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/ScriptableDocumentParser.h"
 #include "core/dom/StyleEngine.h"
 #include "core/fetch/ClientHintsPreferences.h"
@@ skipping 17 matching lines @@
         processHttpEquivDefaultStyle(document, content);
     } else if (equalIgnoringCase(equiv, "refresh")) {
         processHttpEquivRefresh(document, content);
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         processHttpEquivSetCookie(document, content);
     } else if (equalIgnoringCase(equiv, "content-language")) {
         document.setContentLanguage(content);
     } else if (equalIgnoringCase(equiv, "x-dns-prefetch-control")) {
         document.parseDNSPrefetchControlHeader(content);
     } else if (equalIgnoringCase(equiv, "x-frame-options")) {
-        processHttpEquivXFrameOptions(document, content);
+        document.addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>."));
     } else if (equalIgnoringCase(equiv, "accept-ch")) {
         processHttpEquivAcceptCH(document, content);
     } else if (equalIgnoringCase(equiv, "content-security-policy") || equalIgnoringCase(equiv, "content-security-policy-report-only")) {
         if (inDocumentHeadElement)
             processHttpEquivContentSecurityPolicy(document, equiv, content);
         else
             document.contentSecurityPolicy()->reportMetaOutsideHead(content);
     } else if (equalIgnoringCase(equiv, "suborigin")) {
         document.addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Error with Suborigin header: Suborigin header with value '" + content + "' was delivered via a <meta> element and not an HTTP header, which is disallowed. The Suborigin has been ignored."));
     } else if (equalIgnoringCase(equiv, HTTPNames::Origin_Trial)) {
@@ skipping 36 matching lines @@
 void HttpEquiv::processHttpEquivSetCookie(Document& document, const AtomicString& content)
 {
     // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
     if (!document.isHTMLDocument())
         return;
 
     // Exception (for sandboxed documents) ignored.
     toHTMLDocument(document).setCookie(content, IGNORE_EXCEPTION);
 }
 
-void HttpEquiv::processHttpEquivXFrameOptions(Document& document, const AtomicString& content)
-{
-    LocalFrame* frame = document.frame();
-    if (!frame)
-        return;
-
-    unsigned long requestIdentifier = document.loader()->mainResourceIdentifier();
-    if (!frame->loader().shouldInterruptLoadForXFrameOptions(content, document.url(), requestIdentifier))
-        return;
-
-    ConsoleMessage* consoleMessage = ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel,
-        "Refused to display '" + document.url().elidedString() + "' in a frame because it set 'X-Frame-Options' to '" + content + "'.");
-    consoleMessage->setRequestIdentifier(requestIdentifier);
-    document.addConsoleMessage(consoleMessage);
-
-    frame->loader().stopAllLoaders();
-    // Stopping the loader isn't enough, as we're already parsing the document; to honor the header's
-    // intent, we must navigate away from the possibly partially-rendered document to a location that
-    // doesn't inherit the parent's SecurityOrigin.
-    // TODO(dglazkov): This should probably check document lifecycle instead.
-    if (document.frame())
-        frame->navigate(document, SecurityOrigin::urlWithUniqueSecurityOrigin(), true, UserGestureStatus::None);
-}
-
 } // namespace blink