fix service worker cross-origin problem in multibuffers

media/blink/resource_multibuffer_data_provider.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/blink/resource_multibuffer_data_provider.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 294 matching lines @@
         url_data_->multibuffer()->RemoveProvider(this));
     url_data_ = destination_url_data.get();
     // Give the ownership to our new owner.
     url_data_->multibuffer()->AddProvider(std::move(self));
 
     // Call callback to let upstream users know about the transfer.
     // This will merge the data from the two multibuffers and
     // cause clients to start using the new UrlData.
     old_url_data->RedirectTo(destination_url_data);
   }
+
+  // This test is vital for security!

[DaleCurtis, 2016/05/10 00:16:08]

Needs unit test too then; did we lose a test from the BufferedDataSource suite?

[hubbe, 2016/05/10 22:33:23]

Turns out we missed one test (added after fork), and some of the tests were not
working as they should, fixed now.

+  const GURL& original_url = response.wasFetchedViaServiceWorker()
+                                 ? response.originalURLViaServiceWorker()
+                                 : response.url();
+  if (!url_data_->ValidateDataOrigin(original_url.GetOrigin())) {
+    url_data_->Fail();
+  }
 }
 
 void ResourceMultiBufferDataProvider::didReceiveData(WebURLLoader* loader,
                                                      const char* data,
                                                      int data_length,
                                                      int encoded_data_length) {
   DVLOG(1) << "didReceiveData: " << data_length << " bytes";
   DCHECK(!Available());
   DCHECK(active_loader_);
   DCHECK_GT(data_length, 0);
@@ skipping 173 matching lines @@
   }
 
   if (byte_pos() != first_byte_position) {
     return false;
   }
 
   return true;
 }
 
 }  // namespace media