Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp |
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp |
index 9477c3ba4bbfa71438314cf301c5e5baa40c27d5..e89c5dfd36b70350cd7e74c8e8fc35fecbc189f0 100644 |
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp |
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp |
@@ -1346,16 +1346,25 @@ bool FrameLoader::shouldContinueForNavigationPolicy(const ResourceRequest& reque |
// If we're loading content into a subframe, check against the parent's Content Security Policy |
// and kill the load if that check fails, unless we should bypass the main world's CSP. |
- // FIXME: CSP checks are broken for OOPI. For now, this policy always allows frames with a remote parent... |
- if ((shouldCheckMainWorldContentSecurityPolicy == CheckContentSecurityPolicy) && (m_frame->deprecatedLocalOwner() && !m_frame->deprecatedLocalOwner()->document().contentSecurityPolicy()->allowChildFrameFromSource(request.url(), request.followedRedirect() ? ContentSecurityPolicy::DidRedirect : ContentSecurityPolicy::DidNotRedirect))) { |
- // Fire a load event, as timing attacks would otherwise reveal that the |
- // frame was blocked. This way, it looks like every other cross-origin |
- // page load. |
- m_frame->document()->enforceSandboxFlags(SandboxOrigin); |
- m_frame->owner()->dispatchLoad(); |
- return false; |
+ if (shouldCheckMainWorldContentSecurityPolicy == CheckContentSecurityPolicy) { |
+ Frame* parentFrame = m_frame->tree().parent(); |
+ if (parentFrame) { |
+ ContentSecurityPolicy* parentPolicy = parentFrame->securityContext()->contentSecurityPolicy(); |
+ ContentSecurityPolicy::RedirectStatus redirectStatus = request.followedRedirect() |
+ ? ContentSecurityPolicy::DidRedirect |
+ : ContentSecurityPolicy::DidNotRedirect; |
+ if (!parentPolicy->allowChildFrameFromSource(request.url(), redirectStatus)) { |
+ // Fire a load event, as timing attacks would otherwise reveal that the |
+ // frame was blocked. This way, it looks like every other cross-origin |
+ // page load. |
+ m_frame->document()->enforceSandboxFlags(SandboxOrigin); |
+ m_frame->owner()->dispatchLoad(); |
+ return false; |
+ } |
+ } |
} |
+ |
alexmos
2016/05/11 19:46:41
nit: unnecessary blank line.
Łukasz Anforowicz
2016/05/11 23:14:48
Done.
|
bool isFormSubmission = type == NavigationTypeFormSubmitted || type == NavigationTypeFormResubmitted; |
if (isFormSubmission && !m_frame->document()->contentSecurityPolicy()->allowFormAction(request.url())) |
return false; |