Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(227)

Issue 1896953002: Fix cross-site popups to inherit their opener's sandbox flags even when popup opener is not set. (Closed)

Created:
4 years, 8 months ago by alexmos
Modified:
4 years, 8 months ago
Reviewers:
Charlie Reis
CC:
chromium-reviews
Base URL:
https://chromium.googlesource.com/chromium/src.git@2704
Target Ref:
refs/pending/branch-heads/2704
Project:
chromium
Visibility:
Public.

Description

Fix cross-site popups to inherit their opener's sandbox flags even when popup opener is not set. When a cross-process popup is opened from a sandboxed frame, and the popup doesn't have window.opener set (e.g., due to rel=noopener), the popup didn't inherit the opener frame's sandbox flags properly. This CL fixes this case to work: we already pass the right sandbox flags to be inherited in frame replication state, and they are also correctly applied on the browser process side, so there's no need to check for a non-null opener on the renderer side. BUG=576204 CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_site_isolation TBR=creis@chromium.org Review URL: https://codereview.chromium.org/1868823002 Cr-Commit-Position: refs/heads/master@{#386492} (cherry picked from commit f5fb5193353e4d19ff45ad2c8baac9196086333d) Committed: https://chromium.googlesource.com/chromium/src/+/3a1209ed605a19c071c188c564c5b6802024a6eb

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+75 lines, -3 lines) Patch
M content/browser/frame_host/render_frame_host_manager_browsertest.cc View 1 chunk +67 lines, -0 lines 0 comments Download
M content/renderer/render_view_impl.cc View 1 chunk +1 line, -2 lines 0 comments Download
M content/test/data/click-noreferrer-links.html View 1 chunk +7 lines, -1 line 0 comments Download

Messages

Total messages: 2 (1 generated)
alexmos
4 years, 8 months ago (2016-04-18 18:06:53 UTC) #2
Message was sent while issue was closed.
Committed patchset #1 (id:1) manually as
3a1209ed605a19c071c188c564c5b6802024a6eb.

Powered by Google App Engine
This is Rietveld 408576698